Towards Capability Development: A Layered Analysis of AIS Replay and Ghost Ship Attacks

Abstract

The Automatic Identification System (AIS) is a fundamental component of modern Maritime Situational Awareness (MSA) systems, supporting navigation safety, vessel traffic management, and maritime surveillance. However, the absence of authentication, integrity protection, and message verification makes AIS vulnerable to a range of spoofing attacks capable of manipulating the maritime operational picture. Although existing research has proposed various techniques for detecting AIS spoofing, comparatively little attention has been given to understanding how different spoofing mechanisms influence operational behaviour and the capabilities required to detect and respond to them. To address this gap, the paper introduces a focused taxonomy that distinguishes replay and ghost ship attacks, while accounting for hybrid scenarios that combine characteristics of both mechanisms. A layered threat analysis characterises their observable manifestations across the physical, network infrastructure, AIS protocol, AIS message validation, and operational behaviour layers and identifies the distinct operational capabilities required to detect, distinguish, and respond to these attacks. Building upon this analysis, the paper proposes a structured capability-driven cyber range exercise design approach that systematically translates these capabilities into learning objectives and differentiated training scenarios. Furthermore, the work contributes guidelines for evaluating participants’ performance in alignment with the proposed operational capabilities and learning objectives. Overall, the work provides a structured analytical framework for understanding AIS replay and ghost ship attacks, and their combination, and a practical approach for developing capability-driven maritime cybersecurity training aligned with their operational characteristics.