Secure Maritime Communication Systems Using ML-Based Intrusion Detection and Prevention

Abstract

Secure IoT networks connecting ships, port facilities, and offshore structures are essential for safe shipping operations in navigation, cargo handling, propulsion, and real-time communications. These wireless networks are vital for safe navigation; they are increasingly vulnerable to cyber attacks such as spoofing, denial-of-service, malware and intrusions that can severely disrupt operations. Existing security approaches are ineffective in these dynamic environments where threats and attack patterns are constantly evolving and require real-time detection beyond mere signatures.

In this study, we present a holistic machine learning (ML) approach to an intrusion detection and prevention system (IDPS) for maritime IoT networks. We use the UNSW-NB15 dataset of more than two million network connections with 49 features per packet and realistic transmission speeds of 5-10 MB/s. This benchmark dataset captures normal traffic alongside nine attack categories: fuzzers, analysis probes, backdoors, DoS floods, exploits, generic intrusions, reconnaissance scans, shellcode injections, and worms.

This research work describes the design and development of an Intrusion Detection and Prevention System (IDPS) capable of performing classification of network traffic using machine learning algorithms – Random Forest (RF), K-Nearest Neighbors (KNN), and a new algorithm called RF-KNN hybrid ensemble. It incorporates meticulous data preprocessing steps (z-score normalization), feature selection techniques (CFS, Information Gain, ReliefF, Genetic Algorithm) as well as rigorous testing and validation of the developed models. As far as performance is concerned, RF has proven its superiority in achieving the best scores of accuracy, precision, recall, and F1 measure in both binary and multiclass classification settings.The proposed architecture offers more than intrusion detection and incorporates the lightweight cryptography-based prevention mechanism that gets deployed following the detection of a threat in order to block its progression. The accuracy of the prediction made by the proposed architecture exceeds 91.8%, demonstrating an impressive balance between precision and recall measures. The developed system can serve as a valuable tool to address the existing shortcomings of IoT security.