{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,9,13]],"date-time":"2026-09-13T03:41:47Z","timestamp":1789270907227,"version":"build-2803163510"},"reference-count":52,"publisher":"MDPI AG","issue":"3","license":[{"start":{"date-parts":[[2022,2,23]],"date-time":"2022-02-23T00:00:00Z","timestamp":1645574400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Information"],"abstract":"<jats:p>Several disruptive attacks against companies in the maritime industry have led experts to consider the increased risk imposed by cyber threats as a major obstacle to undergoing digitization. The industry is heading toward increased automation and connectivity, leading to reduced human involvement in the different navigational functions and increased reliance on sensor data and software for more autonomous modes of operations. To meet the objectives of increased automation under the threat of cyber attacks, the different software modules that are expected to be involved in different navigational functions need to be prepared to detect such attacks utilizing suitable detection techniques. Therefore, we propose a systematic approach for analyzing the navigational NMEA messages carrying the data of the different sensors, their possible anomalies, malicious causes of such anomalies as well as the appropriate detection algorithms. The proposed approach is evaluated through two use cases, traditional Integrated Navigation System (INS) and Autonomous Passenger Ship (APS). The results reflect the utility of specification and frequency-based detection in detecting the identified anomalies with high confidence. Furthermore, the analysis is found to facilitate the communication of threats through indicating the possible impact of the identified anomalies against the navigational operations. Moreover, we have developed a testing environment that facilitates conducting the analysis. The environment includes a developed tool, NMEA-Manipulator that enables the invocation of the identified anomalies through a group of cyber attacks on sensor data. Our work paves the way for future work in the analysis of NMEA anomalies toward the development of an NMEA intrusion detection system.<\/jats:p>","DOI":"10.3390\/info13030104","type":"journal-article","created":{"date-parts":[[2022,2,23]],"date-time":"2022-02-23T22:54:02Z","timestamp":1645656842000},"page":"104","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":30,"title":["Navigation Data Anomaly Analysis and Detection"],"prefix":"10.3390","volume":"13","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-3390-0772","authenticated-orcid":false,"given":"Ahmed","family":"Amro","sequence":"first","affiliation":[{"name":"Department of Information Security and Communication Technology, Faculty of Information Technology and Electrical Engineering, Norwegian University of Science and Technology, 2815 Gj\u00f8vik, Norway"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-3359-068X","authenticated-orcid":false,"given":"Aybars","family":"Oruc","sequence":"additional","affiliation":[{"name":"Department of Information Security and Communication Technology, Faculty of Information Technology and Electrical Engineering, Norwegian University of Science and Technology, 2815 Gj\u00f8vik, Norway"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Vasileios","family":"Gkioulos","sequence":"additional","affiliation":[{"name":"Department of Information Security and Communication Technology, Faculty of Information Technology and Electrical Engineering, Norwegian University of Science and Technology, 2815 Gj\u00f8vik, Norway"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-2966-9683","authenticated-orcid":false,"given":"Sokratis","family":"Katsikas","sequence":"additional","affiliation":[{"name":"Department of Information Security and Communication Technology, Faculty of Information Technology and Electrical Engineering, Norwegian University of Science and Technology, 2815 Gj\u00f8vik, Norway"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1968","published-online":{"date-parts":[[2022,2,23]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","first-page":"1411066","DOI":"10.1080\/23311975.2017.1411066","article-title":"Digitization in maritime logistics\u2014What is there and what is missing?","volume":"4","author":"Fruth","year":"2017","journal-title":"Cogent Bus. Manag."},{"key":"ref_2","doi-asserted-by":"crossref","unstructured":"Levander, O., and Marine, R.R. (2016, January 26\u201327). Ship intelligence\u2014A new era in shipping. Proceedings of the Royal Institution of Naval Architects, Smart Ship Technology, International Conference Proceedings, London, UK.","DOI":"10.3940\/rina.sst.2016.12"},{"key":"ref_3","unstructured":"IMO (2022, February 18). Autonomous Ships: Regulatory Scoping Exercise Completed. Available online: https:\/\/bit.ly\/3gFLigk."},{"key":"ref_4","unstructured":"(2022, February 18). Autonomous All-Electric Passenger Ferries for Urban Water Transport. Available online: https:\/\/www.ntnu.edu\/autoferry."},{"key":"ref_5","unstructured":"N.M.E. Association (2022, February 18). NMEA0183 Standard. Available online: https:\/\/www.nmea.org\/content\/STANDARDS\/NMEA_0183_Standard."},{"key":"ref_6","unstructured":"Luft, L.A., Anderson, L., and Cassidy, F. (2002, January 28\u201330). Nmea 2000 a digital interface for the 21st century. Proceedings of the 2002 National Technical Meeting of The Institute of Navigation, San Diego, CA, USA."},{"key":"ref_7","doi-asserted-by":"crossref","unstructured":"Jethwa, B., Panchasara, M., Zanzarukiya, A., and Parekh, R. (2020, January 2\u20134). Realtime Wireless Embedded Electronics for Soldier Security. Proceedings of the 2020 IEEE International Conference on Electronics, Computing and Communication Technologies (CONECCT), Bangalore, India.","DOI":"10.1109\/CONECCT50063.2020.9198537"},{"key":"ref_8","first-page":"99031","article-title":"Design of universal module for personal security","volume":"9","author":"Singh","year":"2016","journal-title":"Indian J. Sci. Technol."},{"key":"ref_9","doi-asserted-by":"crossref","unstructured":"Aishwarya, K., and Manjesh, R. (2020). A Novel Technique for Vehicle Theft Detection System Using MQTT on IoT. International Conference on Communication, Computing and Electronics Systems, Springer.","DOI":"10.1007\/978-981-15-2612-1_69"},{"key":"ref_10","doi-asserted-by":"crossref","first-page":"239","DOI":"10.3390\/jcp1020013","article-title":"Marine Network Protocols and Security Risks","volume":"1","author":"Tran","year":"2021","journal-title":"J. Cybersecur. Priv."},{"key":"ref_11","doi-asserted-by":"crossref","first-page":"20","DOI":"10.1007\/978-3-030-12786-2_2","article-title":"Cyber-Attacks Against the Autonomous Ship","volume":"Volume 11387","author":"Katsikas","year":"2019","journal-title":"Computer Security"},{"key":"ref_12","doi-asserted-by":"crossref","unstructured":"Haugen, S., Barros, A., van Gulijk, C., Kongsvik, T., and Vinnem, J.E. (2018). Risk from cyberattacks on autonomous ships. Safety and Reliability\u2014Safe Societies in a Changing World, Taylor & Francis.","DOI":"10.1201\/9781351174664"},{"key":"ref_13","doi-asserted-by":"crossref","unstructured":"Svilicic, B., Rudan, I., Jugovi\u0107, A., and Zec, D. (2019). A Study on Cyber Security Threats in a Shipboard Integrated Navigational System. J. Mar. Sci. Eng., 7.","DOI":"10.3390\/jmse7100364"},{"key":"ref_14","doi-asserted-by":"crossref","first-page":"124","DOI":"10.1016\/j.adhoc.2018.10.002","article-title":"A taxonomy and survey of cyber-physical intrusion detection approaches for vehicles","volume":"84","author":"Loukas","year":"2019","journal-title":"Ad Hoc Netw."},{"key":"ref_15","first-page":"68","article-title":"NMEA Communication Standard for Shipboard Data Architecture","volume":"60","author":"Krile","year":"2013","journal-title":"Int. J. Marit. Sci. Technol."},{"key":"ref_16","doi-asserted-by":"crossref","unstructured":"De Sousa, J.P.C., and Gondim, J.J.C. (September, January 31). Extraction and analysis of volatile memory in android systems: An approach focused on trajectory reconstruction based on nmea 0183 standard. Proceedings of the 2016 11th International Conference on Availability, Reliability and Security (ARES), Salzburg, Austria.","DOI":"10.1109\/ARES.2016.17"},{"key":"ref_17","doi-asserted-by":"crossref","unstructured":"Cantelli-Forti, A. (2018, January 8\u201320). Forensic Analysis of Industrial Critical Systems: The Costa Concordia\u2019s Voyage Data Recorder Case. Proceedings of the 2018 IEEE International Conference on Smart Computing (SMARTCOMP), Taormina, Italy.","DOI":"10.1109\/SMARTCOMP.2018.00046"},{"key":"ref_18","doi-asserted-by":"crossref","unstructured":"Lee, D.K., Miralles, D., Akos, D., Konovaltsev, A., Kurz, L., Lo, S., and Nedelkov, F. (2020, January 23\u201324). Detection of GNSS Spoofing using NMEA Messages. Proceedings of the 2020 European Navigation Conference (ENC), Dresden, Germany.","DOI":"10.23919\/ENC48637.2020.9317470"},{"key":"ref_19","doi-asserted-by":"crossref","unstructured":"Sivkov, Y. (2018, January 3\u20136). Transformation of NMEA ship network from sensor-based to information-based model. Proceedings of the 2018 20th International Symposium on Electrical Apparatus and Technologies (SIELA), Bourgas, Bulgaria.","DOI":"10.1109\/SIELA.2018.8446659"},{"key":"ref_20","doi-asserted-by":"crossref","unstructured":"Fiorini, M. (2012, January 5\u20138). Maritime awareness through data sharing in VTS systems. Proceedings of the 2012 12th International Conference on ITS Telecommunications, Taipei, Taiwan.","DOI":"10.1109\/ITST.2012.6425207"},{"key":"ref_21","first-page":"5412","article-title":"Implementation of voyage data recording device using a digital forensics-based hash algorithm","volume":"9","author":"Seong","year":"2019","journal-title":"Int. J. Electr. Comput. Eng."},{"key":"ref_22","doi-asserted-by":"crossref","unstructured":"Boudehenn, C., Jacq, O., Lannuzel, M., Cexus, J.C., and Boudraa, A. (2021, January 4\u201318). Navigation anomaly detection: An added value for Maritime Cyber Situational Awareness. Proceedings of the 2021 International Conference on Cyber Situational Awareness, Data Analytics and Assessment (CyberSA), Dublin, Ireland.","DOI":"10.1109\/CyberSA52016.2021.9478189"},{"key":"ref_23","doi-asserted-by":"crossref","unstructured":"Furumoto, K., Kolehmainen, A., Silverajan, B., Takahashi, T., Inoue, D., and Nakao, K. (2020, January 2\u20136). Toward automated smart ships: Designing effective cyber risk management. Proceedings of the 2020 International Conferences on Internet of Things (iThings) and IEEE Green Computing and Communications (GreenCom) and IEEE Cyber, Physical and Social Computing (CPSCom) and IEEE Smart Data (SmartData) and IEEE Congress on Cybermatics (Cybermatics), Rhodes, Greece.","DOI":"10.1109\/iThings-GreenCom-CPSCom-SmartData-Cybermatics50389.2020.00034"},{"key":"ref_24","doi-asserted-by":"crossref","first-page":"35","DOI":"10.12716\/1001.15.01.02","article-title":"BRAT: A BRidge Attack Tool for Cyber Security Assessments of Maritime Systems","volume":"15","author":"Hemminghaus","year":"2021","journal-title":"TransNav"},{"key":"ref_25","unstructured":"IMO (2015). Resolution A.1106(29) Revised Guidelines for the Onboard Operational Use of Shipborne Automatic Identification Systems (AIS)."},{"key":"ref_26","unstructured":"IMO (2013). SOLAS Ch. V Safety of Navigation, Regulation 19 Carriage Requirements for Shipborne Navigational Systems and Equipment."},{"key":"ref_27","unstructured":"ITU (2014). Recommendation ITU-R M.1371-5 Technical Characteristics for an Automatic Identification System Using Time Division Multiple Access in the VHF Maritime Mobile Frequency Band, ITU."},{"key":"ref_28","doi-asserted-by":"crossref","first-page":"113219","DOI":"10.1016\/j.eswa.2020.113219","article-title":"Data integrity assessment for maritime anomaly detection","volume":"147","author":"Iphar","year":"2020","journal-title":"Expert Syst. Appl."},{"key":"ref_29","unstructured":"Blauwkamp, D., Nguyen, T.D., and Xie, G.G. (2022, February 18). Toward a Deep Learning Approach to Behavior-based AIS Traffic Anomaly Detection. Dynamic and Novel Advances in Machine Learning and Intelligent Cyber Security (DYNAMICS) Workshop, San Juan, PR. Available online: http:\/\/faculty.nps.edu\/Xie\/papers\/ais_analysis_18.pdf."},{"key":"ref_30","unstructured":"Bosch, R. (1991). CAN Specification Version 2.0, Rober Bousch GmbH."},{"key":"ref_31","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1186\/s13638-019-1484-3","article-title":"Intrusion detection system for automotive Controller Area Network (CAN) bus system: A review","volume":"2019","author":"Lokman","year":"2019","journal-title":"EURASIP J. Wirel. Commun. Netw."},{"key":"ref_32","doi-asserted-by":"crossref","unstructured":"Sabaliauskaite, G., Adepu, S., and Mathur, A. (2016). A six-step model for safety and security analysis of cyber-physical systems. International Conference on Critical Information Infrastructures Security, Springer.","DOI":"10.1007\/978-3-319-71368-7_16"},{"key":"ref_33","doi-asserted-by":"crossref","first-page":"1025","DOI":"10.1017\/S0373463318000164","article-title":"Enhancing navigator competence by demonstrating maritime cyber security","volume":"71","author":"Hareide","year":"2018","journal-title":"J. Navig."},{"key":"ref_34","unstructured":"Strom, B.E., Applebaum, A., Miller, D.P., Nickels, K.C., Pennington, A.G., and Thomas, C.B. (2022, February 16). Mitre ATT&Ck: Design and Philosophy, Available online: https:\/\/attack.mitre.org\/docs\/ATTACK_Design_and_Philosophy_March_2020.pdf."},{"key":"ref_35","doi-asserted-by":"crossref","unstructured":"Loshin, D. (2010). The Practitioner\u2019s Guide to Data Quality Improvement, Morgan Kaufmann Publishers Inc.","DOI":"10.1016\/B978-0-12-373717-5.00011-7"},{"key":"ref_36","unstructured":"IMO (2018). Resolution MSC.252(83) Adoption of the Revised Performance Standards for Integrated Navigation Systems (INS) Introduction Contents Module A-B."},{"key":"ref_37","doi-asserted-by":"crossref","unstructured":"Amro, A., Gkioulos, V., and Katsikas, S. (2021). Communication architecture for autonomous passenger ship. Proc. Inst. Mech. Eng. Part O J. Risk Reliab.","DOI":"10.1177\/1748006X211002546"},{"key":"ref_38","unstructured":"IMO (2018). Resolution MSC.252(83) Adoption of the Revised Performance Standards for Integrated Navigation Systems (INS)\u2014Appendices."},{"key":"ref_39","doi-asserted-by":"crossref","unstructured":"R\u00f8dseth, \u00d8.J., Kvamstad, B., Porathe, T., and Burmeister, H.C. (2013, January 10\u201314). Communication architecture for an unmanned merchant ship. Proceedings of the OCEANS-Bergen, 2013 MTS\/IEEE, Bergen, Norway.","DOI":"10.1109\/OCEANS-Bergen.2013.6608075"},{"key":"ref_40","unstructured":"DNV GL (2022, February 16). DNVGL-CG-0264: Autonomous and Remotely Operated Ships. Available online: https:\/\/rules.dnv.com\/docs\/pdf\/DNV\/cg\/2018-09\/dnvgl-cg-0264.pdf."},{"key":"ref_41","unstructured":"Amro, A., Gkioulos, V., and Katsikas, S. (2022, February 16). Assessing Cyber Risk in Cyber-Physical Systems Using the ATT&CK Framework. Submitted for Review to ACM Transactions on Privacy and Security (TOPS). Available online: https:\/\/www.researchgate.net\/publication\/355203975."},{"key":"ref_42","unstructured":"Commission I.I.E. (2022, February 16). IEC 61162-1. Available online: https:\/\/webstore.iec.ch\/publication\/25754."},{"key":"ref_43","unstructured":"(2022, February 16). Manipulation of View\u2014ATT&CK ICS. Available online: https:\/\/cutt.ly\/MoV."},{"key":"ref_44","unstructured":"(2022, February 16). Denial of View\u2014ATT&CK ICS. Available online: https:\/\/cutt.ly\/DoV."},{"key":"ref_45","doi-asserted-by":"crossref","unstructured":"Kruegel, C., and Toth, T. (2003). Using decision trees to improve signature-based intrusion detection. International Workshop on Recent Advances in Intrusion Detection, Springer.","DOI":"10.1007\/978-3-540-45248-5_10"},{"key":"ref_46","doi-asserted-by":"crossref","first-page":"18","DOI":"10.1016\/j.cose.2008.08.003","article-title":"Anomaly-based network intrusion detection: Techniques, systems and challenges","volume":"28","year":"2009","journal-title":"Comput. Secur."},{"key":"ref_47","doi-asserted-by":"crossref","unstructured":"Tseng, C.Y., Balasubramanyam, P., Ko, C., Limprasittiporn, R., Rowe, J., and Levitt, K. (2003, January 30). A specification-based intrusion detection system for AODV. Proceedings of the 1st ACM Workshop on Security of Ad Hoc and Sensor Networks, Fairfax, VA, USA.","DOI":"10.1145\/986858.986876"},{"key":"ref_48","doi-asserted-by":"crossref","unstructured":"Amro, A., and Gkioulos, V. (2021). Communication and Cybersecurity Testbed for Autonomous Passenger Ship. Computer Security, ESORICS 2021 International Workshops, Springer. ESORICS 2021; Lecture Notes in Computer Science.","DOI":"10.1007\/978-3-030-95484-0_1"},{"key":"ref_49","unstructured":"Orebaugh, A., Ramirez, G., and Beale, J. (2006). Wireshark & Ethereal Network Protocol Analyzer Toolkit, Elsevier."},{"key":"ref_50","unstructured":"Amro, A. (2021). Cyber-Physical Tracking of IoT Devices: A Maritime Use Case. Norsk IKT-Konferanse for Forskning og Utdanning, Available online: https:\/\/ojs.bibsys.no\/index.php\/NIK\/article\/view\/961."},{"key":"ref_51","unstructured":"(2022, February 07). OneNet Standard for IP Networking of Marine Electronic Devices. Available online: https:\/\/www.nmea.org\/content\/STANDARDS\/OneNet."},{"key":"ref_52","doi-asserted-by":"crossref","unstructured":"Jacq, O., Brosset, D., Kermarrec, Y., and Simonin, J. (2019, January 3\u20134). Cyber attacks real time detection: Towards a cyber situational awareness for naval systems. Proceedings of the 2019 International Conference on Cyber Situational Awareness, Data Analytics Furthermore, Assessment (Cyber SA), Oxford, UK.","DOI":"10.1109\/CyberSA.2019.8899351"}],"container-title":["Information"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/2078-2489\/13\/3\/104\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,10]],"date-time":"2025-10-10T22:25:35Z","timestamp":1760135135000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/2078-2489\/13\/3\/104"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,2,23]]},"references-count":52,"journal-issue":{"issue":"3","published-online":{"date-parts":[[2022,3]]}},"alternative-id":["info13030104"],"URL":"https:\/\/doi.org\/10.3390\/info13030104","relation":{"has-preprint":[{"id-type":"doi","id":"10.20944\/preprints202201.0322.v1","asserted-by":"object"}]},"ISSN":["2078-2489"],"issn-type":[{"value":"2078-2489","type":"electronic"}],"subject":[],"published":{"date-parts":[[2022,2,23]]}}}