No abstract

Cyber threats against ship systems are not new, but evolving. For the U.S. Navy, the operational and warfighting capabilities are controlled by automated shipboard systems. These systems are closely interconnected and controlled utilizing vendor-developed or -provided commercial-off-theshelf software and hardware. This architectural feature, along with the current Department of Defense acquisition strategy, exposes the systems to various potential cyberattacks due to insider threats. This research reviews potential insider threats against ship systems and simulates possible insider threat scenarios using system and device access data from both normal and malicious users. A regression-based model is used to validate the hypothesis that normal user behaviors are substantially different than malicious user behaviors. By observing and identifying different characteristics and unusual behaviors, the research concludes that recognizing and monitoring emerging patterns can help identify potential insider threats.