Ship Cybersecurity Risk Scoring by Zone for Real-Time Anomaly Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for assessing ship cybersecurity risks are inadequate due to the unique maritime environment, leading to difficulties in maintaining availability, excessive network traffic, and subjective human criteria, which can result in false alarms and physical damage.
Innovation Solution
A method for measuring ship cybersecurity state through data collection, zone-specific CBS management, data indexing, and risk scoring, using cyber threat and maritime intelligence, and applying machine learning to detect anomalies in real-time.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If agents are installed on end-points to collect risk data, then risk scoring capability is improved, but ship availability is violated and system complexity increases
Solution Approach 1:
The patent extracts the risk data collection function from endpoint agents and relocates it to external servers. The server receives risk data from multiple sources including but not limited to endpoint information, network traffic data, and threat intelligence feeds, processes this data externally, and returns risk scores to the ship's systems without requiring persistent agent installation on critical endpoints.
Solution Approach 2:
The patent introduces an intermediary server architecture that mediates between risk data sources and the ship's internal systems. This server acts as a buffer, collecting and processing risk information from various external and internal sources, then providing synthesized risk assessments to the ship without requiring direct endpoint modification or installation.
2Measurement precision
If network monitoring is performed to analyze past behavior, then cyber threat detection is improved, but excessive network traffic is generated
Solution Approach 1:
The patent applies partial monitoring by selectively collecting only the most relevant risk data elements rather than comprehensive network traffic analysis. The system prioritizes collecting threat intelligence from external sources and high-value internal data points, processing only the portion of data necessary for effective risk assessment while minimizing overall network traffic generation.
3Adaptability or versatility
If subjective human criteria are used for risk assessment, then flexibility in assessment is improved, but false alarms increase and measurement precision deteriorates
Solution Approach 1:
The patent implements feedback mechanisms where risk assessment results are continuously refined based on actual outcomes and new threat intelligence. The system learns from past assessments and adjustments, automatically updating risk models and criteria to reduce false alarms while maintaining the flexibility to adapt to new threat scenarios through structured feedback loops rather than purely subjective judgment.
Data Source
Figure 1~2
Figure 3~4
Figure 5
AI summary
The present invention provide a method for measuring a cybersecurity state of a ship and a method for evaluating a cybersecurity risk and detecting an abnormal sign of a ship, wherein risk data collected through various paths is indexed and scored according to various criteria, such as a risk occurrence degree, areas are divided according to importance, such as a cabin, a bridge room, and an engine room of the ship, and a quantified risk scoring for CBS for each area is provided.