Fingerprinting Maritime NMEA2000 Networks

NMEA 2000 Protocol Architecture in Maritime OT

Modern commercial and recreational vessels rely on NMEA 2000 (built upon the ISO 11783 CAN bus standard and SAE J1939) to interconnect critical navigation instruments, GPS receivers, radar units, wind sensors, and multifunction displays.

Lack of Baselines in Maritime CAN Networks

Despite widespread adoption, understanding normal versus abnormal traffic patterns on NMEA 2000 networks is challenging due to the scarcity of open-source datasets and baseline behavioral models.

Developing Deterministic Sensor Fingerprints

Using a five-node hardware testbed, researchers captured baseline communication datasets across Parameter Group Numbers (PGNs) and derived deterministic timing and payload fingerprints for each sensor on the bus.

Validating Anomaly Detection Under Attack

Subjecting the testbed to message spoofing, fuzzing, and denial-of-service attacks demonstrated that deterministic fingerprints accurately identify rogue nodes and manipulated data frames in real time.