An Innovation-Based Approach to Detect Stealthy Disturbance Attacks in Maritime Monitoring

TL;DR

This paper presents a statistical detection suite for maritime systems that identifies stealthy cyber-physical disturbances by analyzing Kalman filter innovations, enhancing maritime cyber-resilience.

Contribution

It introduces a lightweight, statistically grounded anomaly detection method operating on Kalman filter innovations to identify sophisticated stealthy attacks in maritime navigation.

Findings

The SDS detects colored spoofing attacks that evade traditional checks.

Analysis shows how adversaries can craft FIR Gaussian disturbances to bypass classical chi-square tests.

Evaluation demonstrates SDS's effectiveness in exposing stealthy cyber-physical threats in maritime scenarios.

Abstract

Modern maritime navigation and control systems rely on digital sensing, estimation, and communication pipelines that fuse GNSS, radar, inertial, and AIS data through approaches such as Kalman-filter-based estimators. While these technologies are essential for safety and efficiency, their growing interconnection also exposes vessels to faults and cyber-physical anomalies. This paper introduces a Statistical Detection Suite (SDS) to detect malicious stealthy disturbances. Specifically, the SDS operates directly on the innovations of Kalman filters, providing a lightweight yet statistically grounded layer of anomaly monitoring within maritime estimation frameworks. The SDS jointly evaluates whitened innovations through four complementary checks: (i) bias, (ii) covariance consistency via the normalized innovation squared (NIS), (iii) Gaussianity, and (iv) temporal independence via portmanteau statistics. The analysis further examines how an adversary can craft stealthy finite-impulse-response (FIR) Gaussian disturbances that can evade classical chi-square checks, formulating an optimization-based design that balances stealth and trajectory impact. An evaluation in maritime navigation scenarios illustrates how the SDS exposes colored spoofing attacks that bypass traditional methods, highlighting the role of innovation-based monitoring in strengthening maritime resilience against cyber-physical threats.