Salty Seagull: A VSAT Honeynet to Follow the Bread Crumb of Attacks in Ship Networks
Georgios Michail Makrakis, Jeroen Pijpker, Remco Hassing, Rob Loves, and Stephen McCombie

TL;DR
This paper introduces Salty Seagull, a specialized honeynet simulating a ship's VSAT system to study cyberattack behaviors in maritime networks, revealing limited attacker engagement over 30 days.
Contribution
The paper presents a novel maritime-specific honeynet that mimics VSAT systems, integrating vulnerabilities to attract and analyze cyber threats in the maritime industry.
Findings
Numerous generic attacks were attempted on the honeynet.
Only one attacker accessed the system with some knowledge of vulnerabilities.
The attacker did not fully exploit the honeynet's potential.
Abstract
Cyber threats against the maritime industry have increased notably in recent years, highlighting the need for innovative cybersecurity approaches. Ships, as critical assets, possess highly specialized and interconnected network infrastructures, where their legacy systems and operational constraints further exacerbate their vulnerability to cyberattacks. To better understand this evolving threat landscape, we propose the use of cyber-deception techniques and in particular honeynets, as a means to gather valuable insights into ongoing attack campaigns targeting the maritime sector. In this paper we present Salty Seagull, a honeynet conceived to simulate a VSAT system for ships. This environment mimics the operations of a functional VSAT system onboard and, at the same time, enables a user to interact with it through a Web dashboard and a CLI environment. Furthermore, based on existing…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
