CoChat
Sign Up
Cited by 98Information and Cyber SecurityMaritime Navigation and SafetyRisk and Safety Analysis

The DOI matches its Crossref record; 56 of the 56 references it cites were found in a registry or an index; 15 of the 52 sources its claims cite were checked for support.

A BN driven FMEA approach to assess maritime cybersecurity risks

Open access
Park, Changki, Kontovas, Christos, Yang, Zaili, Chang, Chia-Hsun·2023·Ocean & Coastal Management
DOI 10.1016/j.ocecoaman.2023.106480
Open this paper in CoChat — free account

Abstract

Cybersecurity risks present a growing concern in the maritime industry, especially due to the fast development of digitalised technologies, also vis-à-vis autonomous shipping. Research on maritime cybersecurity is receiving increased attention. This paper aims to assess the cybersecurity risks in the maritime sector and improve safety at sea and in coastal areas. First, we identify all the concerned cyber threats in the sector based on literature review and expert opinion. A novel risk assessment framework of maritime cyber threats, which combines Failure Mode and Effects Analysis (FMEA) with a Rule-based Bayesian Network (RBN), is proposed and used to evaluate the risk levels of the identified threats and to better understand the threats that contribute the most to the overall maritime cybersecurity risk. The results can inform stakeholders about the most vulnerable parts in their cyber operations and stimulate the development of risk-based control measures. More specifically, the next step in managing cyber threats is to tackle the threats that are associated with unacceptable risk levels and identify cost-effective measures to manage them. To that extent, our findings provide a list of top threats – that is the areas where efforts should be focused on. As a result, this work can help the whole community to grow its resilience to cyber-attacks and improve the security of shipping operations.

Overview

AI snapshot

Written from the paper’s full text.

TL;DR

This paper identifies maritime cyber threats and assesses their risk using a hybrid Failure Mode and Effects Analysis (FMEA) and rule-based Bayesian network (RBN). It finds that Malware is the highest-risk category, with accessing suspicious email links and unchecked USB use among the top threats.

Key findings

  • Six maritime cyber threat categories were identified: Phishing, Malware, Man-in-the-middle attack, Theft of credentials, Human factor, and Using outdated IT systems; 21 threats were further assessed through Questionnaire 2.
  • The highest-risk category was Malware (risk value 42.27), followed by Phishing (40.24) and Human factor (38.27); the lowest was Using outdated IT systems (29.12).
  • The top three threats were Accessing links from suspicious emails (Ma1, 43.95), Connecting USB or removable media to a computer without virus check (Ma3, 43.56), and Lacking knowledge of cybersecurity (HE1, 41.95); the least important were Forgetting to update software (27.15), Using unpatched operating system (28.93), and Using outdated version firewall and antivirus software (31.4).
  • Sensitivity analysis found Ph2 (Downloading attached files from impersonation emails) had the highest impact on overall risk, with the “very high” overall risk varying from 0.1153 to 0.1983 when Ph2 was set from 0% to 100% “very high”; TC2 had the lowest impact.

Methods

  • A bibliometric and literature review used SCOPUS with the search string “(cybersecurity OR (cyber AND security)) AND (maritime OR shipping))”, identifying 314 documents and a final dataset of n = 159 documents; threats and categories were then validated by maritime experts.
  • Two questionnaires were used: Questionnaire 1 was sent to 100 experts, with 31 complete valid replies (31%) to screen threats; Questionnaire 2 was sent to 100 maritime industry experts, with 44 complete valid replies (44%) to collect degrees of belief for likelihood, consequence, and probability of being undetected. Respondents were mainly from shipping companies (77.27%), and 46.46% had more than 10 years of experience.
  • The FMEA-RBN model used five linguistic terms for each FMEA parameter, 125 IF-THEN rules for threat-level risk, conditional probability tables, Bayesian aggregation, utility functions to produce crisp risk values, and sensitivity analysis in GeNIe; validation checked two axioms about monotonicity and consistency of threat impacts.

Limitations

  • The paper states that the number of responses could have been higher, with response rates around 40%, partly because the questionnaires were complicated; it also notes that expert opinion could be weighted by familiarity and years of experience, and that junior respondents had higher mean cyber threat estimates than senior experts.
  • The paper states that threats and consequences differ between onboard systems, office computers, ports, and companies of different sizes, so a more target-specific approach is needed; it also states that proposed measures are general and further research is required to evaluate and select cost-effective risk-reduction measures.
  • The paper states that full validation would require comprehensive cybersecurity incident data, which was impractical, so validation relied on sensitivity analysis and expert review; the text also makes evident that equal importance was assumed for threats, categories, and experts, and that the data used is confidential.

Model-written summary. Check it against the paper before relying on it.

Integrity signals

Registry

Crossref · 10.1016/j.ocecoaman.2023.106480

Cites

56 of 56 references verified0 citation errors · 0 not checkable

Statistics

Nothing to recompute.

Verification

Claims the paper makes

15 of 52 cited sources checked · 3 supported · 0 flagged · accuracy not yet measured

  • Premisecitation

    Human factors are seen as a main threat to maritime cybersecurity.

    “Human factors are indeed seen as a main threat to maritime cybersecurity (Park et al., 2019;Senarak, 2021;Tusher et al., 2022).”
    Quote in the paperNot a substantial claim1 of 3 sources checked
    • cites Park et al., 2019

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites Senarak, 2021 source

      Section 2.2 identifies the human factor as one of three main factors in port cybersecurity, alongside infrastructure and procedure. The structural-model results link weaknesses in the human factor to hacktivism and cyber terrorism, but not to cyber criminality or cyber espionage. The paper therefore supports human factors as an important port cybersecurity vulnerability, not as the main threat to maritime cybersecurity generally. (LLM, conf=0.86)

      Experimental — accuracy not yet measured
    • cites Tusher et al., 2022 source
  • Premisecitation

    Current maritime cybersecurity risk assessment is conducted using either qualitative analysis or very traditional quantitative risk analysis methods such as Bow-Tie analysis and risk matrices.

    “The current maritime cybersecurity risk assessment is conducted using either qualitative analysis or very traditional quantitative risk analysis methods such using Bow-Tie analysis (Progoulakis et al., 2021) and risk matrices (Yoo and Park, 2021).”
    Quote in the paperSubstantial claim2 of 2 sources checked
    • cites Progoulakis et al., 2021 source

      Section 5.2 identifies Bow-Tie Analysis as a tool for assessing maritime cyber-physical security risks. But the Research Methodology and Article Structure section describes it as a method from another industry sector that *could be applied* in maritime cybersecurity; the paper does not establish that it is a current, traditional quantitative method used in maritime risk assessment. The risk-matrix citation is to a different source and is not judged here. (LLM, conf=0.86)

      Experimental — accuracy not yet measured
    • cites Yoo and Park, 2021 source

      The Conclusions report using a risk matrix for maritime cybersecurity assessment, supporting the risk-matrix example attributed to Yoo and Park. But the same passage explicitly calls that assessment qualitative, not quantitative. Bow-Tie analysis is attributed to a different citation in the citing sentence. (LLM, conf=0.88)

      Experimental — accuracy not yet measured
  • Premisecitation

    The inference process involving BN can inherently overcome one of the weaknesses of traditional FMEA, which is the assumption that all three FMEA parameters contribute equally towards the risk factor of an event.

    “The inference process involving BN can inherently overcome one of the weaknesses of traditional FMEA which is the assumption that all three FMEA-parameters contribute equally towards the risk factor of an event (Hassan et al., 2022).”
    Quote in the paperSubstantial claim1 of 1 sources checked
    • cites Hassan et al., 2022 source

      Section 2.1.1 (p. 8) identifies the equal-contribution assumption as a weakness of traditional FMEA. But Section 2.4 (p. 11) says the paper addresses it by weighting failure factors using a fuzzy rule base and Grey Relations approach, not BN inference. BN appears in the Introduction (p. 4) only among approaches used in other studies. (LLM, conf=0.89)

      Experimental — accuracy not yet measured
  • Findingown data

    The paper identifies six maritime cyber threat categories: Phishing, Malware, Man-in-the-middle attack, Theft of credential, Human factor, and Using outdated IT systems.

    “Through a literature review, six dimensions to categorise the maritime cyber threats are identified, including 'Phishing', 'Malware', 'Man in the middle attack', 'Thief of credentials', 'Human factor', and 'Using outdated IT systems'; see Table 1 for the threats discussed in the relevant literature.”
    • Also stated in: § Table 2 · plain
      “Based on the literature review and the results of Questionnaire 1, six maritime cyber threat categories are identified, including 'Phishing', 'Malware', 'Man-in-the-middle attack', 'Theft of credential', 'Human factor', and 'Using outdated IT systems'.”
    Quote in the paperSubstantial claim
    • Rests on an assumption: The six identified threat categories cover all concerned cyber threats in the maritime sector.
  • Findingown data

    The results show that 'Malware' is the most important cybersecurity risk category.

    “The results in Section 4 show that 'Malware' is the most important cybersecurity risk category.”
    Quote in the paperSubstantial claim
    • The authors state this as an assumption: Threats and threat categories have equal importance.
  • Probably not a substantial claim. 48
  • It may state two separate claims as one. 49
  • The quote only partly states this claim. 1

  • Probably not a substantial claim. The paper’s conclusions may not depend on it. It may state two separate claims as one.

    Premisecitation

    Malware could lead to ransomware attacks or even Distributed Denial of Service (DDoS).

    “It could lead to ransomware attacks or even Distribute Denial of Service (DDoS) (Jones et al., 2016;Ben Farah et al., 2022).”
    Quote in the paperNot a substantial claim1 of 2 sources checked
    • cites Jones et al., 2016

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites Ben Farah et al., 2022 source

      Section 5.2, In-Port Cyber-Attacks (page not provided), groups malware with ransomware and describes Petya as encrypted malware, supporting the ransomware part. The same section describes DDoS separately as network flooding; it does not say that malware could lead to a DDoS attack. (LLM, conf=0.83)

      Experimental — accuracy not yet measured

  • It may state two separate claims as one.

    Premisecitation

    Sea crews using personal devices such as smartphones, tablets, or private USB devices could cause cybersecurity issues by receiving phishing emails or visiting malicious websites, and thus installing malicious viruses into vessel operational systems.

    “Sea crews using personal devices (e.g., smartphone, tablet, private USB device) could cause cybersecurity issues by receiving phishing emails or visiting malicious websites, and thus installing malicious viruses into vessel operational systems (BIMCO, 2018;Meland et al., 2021;Ben Farah et al., 2022).”
    Quote in the paperNot a substantial claim2 of 3 sources checked
    • cites BIMCO, 2018

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites Meland et al., 2021 source

      Split into 2 atoms — 0 confirmed, 0 partially supported, 0 disputed, 0 misattributed, 2 unverifiable. Expand the claim to see per-atom verdicts.

      Experimental — accuracy not yet measured
    • cites Ben Farah et al., 2022 source

      Split into 2 atoms — 0 confirmed, 2 partially supported, 0 disputed, 0 misattributed, 0 unverifiable. Expand the claim to see per-atom verdicts.

      Experimental — accuracy not yet measured

  • It may state two separate claims as one.

    Premisecitation

    Research addressing maritime cybersecurity risk assessment is still scant and often industry-driven, and falls behind other industries such as aviation, autonomous vehicles, and healthcare.

    “research addressing maritime cybersecurity risk assessment is still scant and often industry-driven from a practical perspective, in any case, falls behind compared to other industries (Caponi and Belmont, 2015), such as aviation (Suciu et al., 2019), autonomous vehicles (Khan et al., 2022), and healthcare (Coventry and Branley, 2018).”
    Quote in the paperSubstantial claim1 of 3 sources checked
    • cites Caponi and Belmont, 2015

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites Suciu et al., 2019 source
    • cites Khan et al., 2022

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Probably not a substantial claim. The paper’s conclusions may not depend on it.

    Premisecitation

    Human factor has been recognised as a critical factor that directly and indirectly causes around 80-90% of shipping safety and security incidents.

    “For shipping safety and security incidents, human factor has been recognised as a critical factor that directly and indirectly causes around 80-90% of accidents (Heij and Knapp, 2018;Chang et al., 2021).”
    Quote in the paperNot a substantial claim1 of 2 sources checked
    • cites Heij and Knapp, 2018 source

      The Introduction states that human factors are commonly agreed to account for 80–90% of the causes of shipping accidents, while noting that the percentage depends on how causes are defined. The cited passages do not extend that estimate to security incidents or distinguish direct from indirect causation. (LLM, conf=0.84)

      Experimental — accuracy not yet measured
    • cites Chang et al., 2021

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Probably not a substantial claim. The paper’s conclusions may not depend on it.

    Premisecitation

    Malware is the key choice of threat to carry out malicious intent to breach maritime cybersecurity.

    “Alcaide and Llave (2020) argued that malware is the key choice of threat to carry out malicious intent to breach maritime cybersecurity.”
    Quote in the paperNot a substantial claim1 of 1 sources checked
    • cites Alcaide and Llave, 2020 source

      Section 1.1 (page not provided) says many cybersecurity experts believe malware is a key weapon for breaching cybersecurity, but it frames this as those experts’ view about cyberspace generally, not a categorical conclusion about maritime cybersecurity. Section 3.1 discusses malware among attacks relevant to the paper’s maritime context without ranking it as the key threat. (LLM, conf=0.83)

      Experimental — accuracy not yet measured

  • Probably not a substantial claim. The paper’s conclusions may not depend on it.

    Premisecitation

    Malware is one of the major types of cyberattack in the maritime industry.

    “Mraković and Vojinović (2019) stated that malware is one of the major types of cyberattack in the maritime industry”
    Quote in the paperNot a substantial claim1 of 1 sources checked
    • cites Mraković and Vojinović, 2019 source

  • It may state two separate claims as one.

    Premisecitation

    Without an up-to-date IT system, hackers can attack vessels or companies through viruses or malware, which is difficult to be detected and defended by traditional antivirus software.

    “Without an up-to-date IT system, hackers can attack vessels or companies through viruses or malware, which is difficult to be detected and defended by traditional antivirus software (Sen, 2016;Park et al., 2019;Ben Farah et al., 2022;Tusher et al., 2022).”
    Quote in the paperNot a substantial claim1 of 3 sources checked
    • cites Sen, 2016 source
    • cites Park et al., 2019

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites Ben Farah et al., 2022 source

      Section 5.2, In-Port Cyber-Attacks (page not supplied), describes malware attacks on a vessel and a shipping company and says the absence of antivirus protection facilitated one attack. Section 3, Literature Review (page not supplied), associates obsolete software with higher risk of a DoS attack. Neither passage says that traditional antivirus software has difficulty detecting or defending against malware. (LLM, conf=0.86)

      Experimental — accuracy not yet measured

  • Probably not a substantial claim.

    Premisecitation

    When lacking historical failure data, the three FMEA parameters are often defined by linguistic terms to better describe and model subjective assessments.

    “When lacking historical failure data, the three parameters are often defined by linguistic terms in order to better describe and model subjective assessments (Yang et al., 2008;Alyami et al., 2019).”
    Quote in the paperSubstantial claim1 of 2 sources checked
    • cites Yang et al., 2008 source
    • cites Alyami et al., 2019 source

      The Introduction links missing or uncertain failure data to uncertainty-modelling methods, and the Literature review identifies three traditional FMEA attributes. The sensitivity-analysis section says linguistic variables describe risk parameters, but the paper’s container-port model uses four parameters rather than establishing that the three traditional attributes are often defined in linguistic terms when historical data are lacking. No page numbers are available in our copy. (LLM, conf=0.84)

      Experimental — accuracy not yet measured

  • Probably not a substantial claim. The paper’s conclusions may not depend on it.

    Premisecitation

    Many studies have suggested that training and educating seafarers and staff is an effective method to improve maritime cybersecurity.

    “Many studies have suggested that training and educating seafarers and staff is an effective method to improve maritime cybersecurity (Jones et al., 2016;Bolbot et al., 2020;Kanwal et al., 2022).”
    Quote in the paperNot a substantial claim2 of 3 sources checked
    • cites Jones et al., 2016

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites Bolbot et al., 2020 source

      The Additional information section (page not specified) lists training as a control barrier for cyberattacks on ship systems. It does not say that studies have shown training and education of seafarers and staff to be effective, so that stronger part of the claim is unsupported by this paper. (LLM, conf=0.82)

      Experimental — accuracy not yet measured
    • cites Kanwal et al., 2022 source

  • Probably not a substantial claim. The paper’s conclusions may not depend on it.

    Findingnone given

    Each identified maritime cyber threat category consists of several threats.

    “Each threat category consists of several threats.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim. The paper’s conclusions may not depend on it. It may state two separate claims as one.

    Findingown data

    The relevant papers were authored by 425 authors (average 3.4 coauthors), and most are co-authored works, with only 19 single-authored papers.

    “The relevant papers have been authored by 425 authors (an average of 3.4 coauthors), and most are co-authored works (with only 19 papers being single-authored ones).”
    Quote in the paperNot a substantial claim

  • It may state two separate claims as one.

    Findingown data

    A SCOPUS bibliometric search using the string '(cybersecurity OR (cyber AND security)) AND (maritime OR shipping))' identified 314 documents, and after careful analysis the dataset was n = 159 documents.

    “314 have been identified and after a careful analysis of the documents we arrived at a dataset of n = 159 documents”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim. The paper’s conclusions may not depend on it.

    Findingown data

    The earliest paper in the bibliometric dataset was published in 2006.

    “The earliest paper has been published in 2006; the scientific production has been very intensive in the last 4 years highlighting the growing importance and relevance of our work.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim. The paper may give no reason why it holds.

    Findingnone given

    There are very few studies in the literature focusing on quantitative security risk analysis.

    “There are very few studies in the literature focusing on quantitative security risk analysis.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim. The paper’s conclusions may not depend on it. It may state two separate claims as one.

    Findingown data

    Of the 159 documents in the bibliometric dataset, 75 are journal papers and the rest are conference proceedings papers.

    “of which half of them (i.e., 75 documents) are journal papers and the rest papers published in conference proceedings.”
    Quote in the paperNot a substantial claim

  • It may state two separate claims as one.

    Findingown data

    Annual scientific production on maritime cybersecurity increased after 2016, with 21 documents in 2018, 23 in 2019, 34 in 2020, 39 in 2021 and 19 until the first half of 2022.

    “there has been an increased engagement with the topic after 2016; with 21 documents published in 2018, 23 in 2019, 34 in 2020, 39 in 2021 and 19 until the first half of 2022.”
    Quote in the paperNot a substantial claim

  • It may state two separate claims as one.

    Findingown data

    Threat category 'Malware' has highest risk value 42.27, followed by 'Phishing' 40.24, 'Human factor' 38.27; least important is 'Using outdated IT' 29.12.

    “The results show that the threat category of 'Malware' has the highest risk value (risk value 42.27), followed by 'Phishing' (risk value: 40.24), and 'Human factor' (risk value: 38.27); whereas the least important threat category is that of 'Using outdated IT' (risk value: 29.12).”
    Quote in the paperSubstantial claim
    • The authors state this as an assumption: Threats and threat categories have equal importance.

  • It may state two separate claims as one.

    Findingown data

    Top three threats: Ma1 43.95, Ma3 43.56, HE1 41.95; least three: Forgetting to update software 27.15, Using unpatched OS 28.93, Using outdated firewall 31.4.

    “Overall, the top three threats include 'Accessing links from suspicious emails' (Ma1, risk value: 43.95), 'Connecting USB or removable media to a computer without virus check' (Ma3, risk value: 43.56), and 'Lacking knowledge of cybersecurity (i.e., facing a new situation and do not know how to deal with it)' (risk value: 41.95); whereas the least three important threats that contribute to maritime”
    Quote in the paperSubstantial claim
    • The authors state this as an assumption: Threats and threat categories have equal importance.

  • It may state two separate claims as one.

    Findingown data

    In this study, 'Malware' is the most critical maritime cyber threat category, followed by 'Phishing' and 'Human factor'.

    “The results of the analysis show that 'Malware' is the most critical threat category, followed by 'Phishing' and 'Human factor'.”
    Quote in the paperSubstantial claim

  • It may state two separate claims as one.

    Findingown data

    In this study, 'Accessing links from suspicious emails', 'Connecting USB or removable media to a computer without virus check', and 'Downloading attached files from unknown emails' are the top three maritime cyber threats.

    “This research shows that 'Accessing links from suspicious emails' is the threat with the highest associated risk, followed by 'Connecting USB or removable media to a computer without virus check', and 'Downloading attached files from unknown emails'.”
    • Also stated in: § 5.1. Practical implications of the findings · plain
      “'Accessing links from suspicious emails (Ma1)', 'Downloading attached files from unknown emails (Ma2)' and 'Connecting USB or removable media to a computer without virus check (Ma3)' have been identified as top threats in this study.”
    Quote in the paperSubstantial claim

  • It may state two separate claims as one.

    Findingown data

    The value of likelihood of Ma1 is around 3.06, with 17% VH, 28% H, 20% A, 17% L, 19% VL.

    “The results show that the value of likelihood of Ma1 is around 3.06, with 17% of Very High (VH), 28% of High (H), 20% of Average (A), 17% of Low (L), and 19% of Very Low (VL).”
    Quote in the paperNot a substantial claim

  • It may state two separate claims as one.

    Findingown data

    There are eight threats with values above 40; top three are Ma1, Ma3, HE1.

    “There are eight threats that have values above 40; the top three threats are 'Accessing links from suspicious emails (Ma1)', 'Connecting USB or removable media to a computer without virus check (Ma3)', and 'Lacking knowledge of cybersecurity (i.e., facing a new situation and do not know how to deal with it) (HE1)'.”
    Quote in the paperSubstantial claim
    • The authors state this as an assumption: Threats and threat categories have equal importance.

  • It may state two separate claims as one.

    Findingown data

    The third most concerned threat is 'Connecting USB or removable media to computer without virus check', which belongs to the 'Malware' category.

    “The third most concerned threat is 'Connecting USB or removable media to computer without virus check', which belongs to the 'Malware' category.”
    Quote in the paperNot a substantial claim

  • It may state two separate claims as one.

    Findingown data

    Based on experts' opinion, the top two threats are 'Lacking knowledge of cybersecurity (i.e., facing a new situation and do not know how to deal with it)' and 'Employees do not follow company's cybersecurity process due to poor cybersecurity awareness'; both belong to the 'Human factor' category.

    “Based on the experts' opinion, the top two threats are identified as 'Lacking knowledge of cybersecurity (i.e., facing a new situation and do not know how to deal with it)' and 'Employees do not follow company's cybersecurity process due to poor cybersecurity awareness'; both belong to the 'Human factor' category.”
    Quote in the paperSubstantial claim

  • It may state two separate claims as one. The quote only partly states this claim.

    Findingown data

    Fig. 4 shows that not providing personal/commercial information to suspicious websites (MITM2) would significantly decrease overall risk to 'very low', and accessing links from impersonation emails (PH1) will largely increase overall risk.

    “Fig. 4 shows two critical situations influencing the overall risk of maritime cybersecurity: (a) 'Not providing personal/commercial information to suspicious websites as opposed to providing personal/commercial information to suspicious websites (e.g., illegal software/music/ movie download websites)' would significantly decrease the overall risk to a 'very low' level (see the green part of MITM2)”
    Quote in the paperSubstantial claim

  • It may state two separate claims as one.

    Findingown data

    The fourth and fifth most concerned threats also belong to 'Malware' and are 'Accessing links from suspicious emails' and 'Connecting your infected USB or removable media to connect computers/navigation systems'.

    “The fourth and fifth also belong to this category and are 'Accessing links from suspicious emails' and 'Connecting your infected USB or removable media to connect computers/navigation systems', respectively.”
    Quote in the paperNot a substantial claim

  • It may state two separate claims as one.

    Findingown data

    Risk values: Ma1 43.95, Ma2 41.84, Ma3 43.56, Ma4 40.87.

    “For example, our calculations, using the utility function, arrive at a value of 43.95 for 'Accessing links from suspicious emails (Ma1)'; the value of 'Downloading attached files from unknown emails (Ma2) is 41.84, for 'Connecting USB or removable media to a computer without virus check' (Ma3) is 43.56, for 'Connecting your infected USB or removable media to connect computers/navigation systems (M”
    Quote in the paperNot a substantial claim
    • The authors state this as an assumption: Threats and threat categories have equal importance.

  • It may state two separate claims as one.

    Findingown data

    The value of consequence of Ma1 is around 3.56, with 27% CA, 25% CR, 29% MO, 12% MA, 6% N.

    “Whereas the value of consequence is around 3.56, with 27% of Catastrophic (CA), 25% of Critical (CR), 29% of Moderate (MO), 12% of Marginal (MA), and 6% of Negligible (N).”
    Quote in the paperNot a substantial claim

  • It may state two separate claims as one.

    Findingown data

    In Fig. 3, Ph2 value varies between 0.1153 and 0.1983; setting Ph2 to 100% 'very high' increases 'very high' overall risk to 0.1983, setting to 0% decreases to 0.1153.

    “In Fig. 3, the value of Ph2 varies between 0.1153 and 0.1983, implying the 'very high' of the overall risk will increase to 0.1983 when setting Ph2 to 100% 'very high' (keeping the other threats the same); whereas the 'very high' of the overall risk will decrease to 0.1153 when setting Ph2 to 0% 'very high'.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim. It may be too vague to check against evidence. The paper may give no reason why it holds. It may state two separate claims as one.

    Interpretationnone given

    Traditional risk assessment methods are not able to deal with the high uncertainty risk data in maritime cybersecurity, so a more advanced technique should be employed.

    “However, traditional risk assessment methods are not able to deal with the high uncertainty risk data in maritime cybersecurity; a more advanced technique should therefore be employed.”
    Quote in the paperNot a substantial claim
    • Rests on an assumption: Cybersecurity risks suffer from high uncertainty in data.

  • It may state two separate claims as one.

    Premisecitation

    Shipping companies were over-reliant on outdated technology and were using outdated versions of antivirus software, which are major threats.

    “Sen (2016), Jones et al. (2016) and BIMCO (2018) analysed the vulnerability of maritime cybersecurity and found that shipping companies were over-reliant on outdated technology and were using outdated version of antivirus software, which are major threats.”
    Quote in the paperNot a substantial claim0 of 3 sources checked
    • cites Sen, 2016 source
    • cites Jones et al., 2016

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites BIMCO, 2018

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Probably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds.

    Interpretationnone given

    The methodology can account for the difference in the experience and expertise of the experts by setting different weights.

    “In addition, the methodology can account for the difference in the experience and expertise of the experts; this could be done by setting different weights.”
    Quote in the paperNot a substantial claim

  • It may state two separate claims as one.

    Interpretationreasoning

    The FMEA-RBN methodology can incorporate both objective and subjective data, which is important when historical data is often unavailable or not reliable given the small number of occurred accidents.

    “A key advantage of the model is its ability to incorporate both objective and subjective data; this is important when historical data is often unavailable or not reliable given the small number of the occurred accidents.”
    Quote in the paperSubstantial claim
    • Rests on an assumption: Historical data on maritime cybersecurity is often unavailable or not reliable given the small number of occurred accidents.

  • Probably not a substantial claim. The paper’s conclusions may not depend on it. It may state two separate claims as one.

    Premisecitation

    A survey by IHS Markit and BIMCO showed that 65 responders of the total 300 stakeholders in the maritime sector have experienced cyber threats, and 25% of them answered that they have been attacked by theft of credentials.

    “A survey conducted by IHS Markit and BIMCO showed that 65 responders of the total 300 stakeholders in the maritime sector have experienced cyber threats, and 25% of them answered that they have been attacked by theft of credentials (Markit, 2016).”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites Markit, 2016

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Probably not a substantial claim. The paper’s conclusions may not depend on it.

    Premisecitation

    Many cyberattack accidents have been reported involving common cyber threats such as phishing, malware, ransomware, DDoS, and man-in-the-middle attack.

    “Indeed, many cyberattack accidents have been reported involving common cyber threats such as phishing, malware, ransomware, DDoS (Distributed Denial of Service), and man-in-the-middle attack (Ren et al., 2017;Lezzi et al., 2018).”
    Quote in the paperNot a substantial claim0 of 2 sources checked
    • cites Ren et al., 2017

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites Lezzi et al., 2018 source

  • Probably not a substantial claim. The paper’s conclusions may not depend on it. It may state two separate claims as one.

    Premisecitation

    IMO and BIMCO have listed malware as a severe threat to maritime cybersecurity because malware could access and damage operation systems of vessels or steal sensitive data from shipping companies.

    “In the maritime sector, IMO (2017a) and BIMCO (2018) have also listed malware as a severe threat to maritime cybersecurity given that malware could access and damage the operation systems of vessels or steal sensitive data from shipping companies.”
    Quote in the paperNot a substantial claim0 of 2 sources checked
    • cites IMO, 2017a

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites BIMCO, 2018

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • It may state two separate claims as one.

    Interpretationreasoning

    Some ships and shipping companies are still using outdated IT and OT systems that are prone to cyberattacks.

    “Besides, many current ships were built way before the industry started considering cybersecurity as a major issue.Therefore, some ships and shipping companies are still using outdated IT and OT systems that are prone to cyberattacks.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim. The paper’s conclusions may not depend on it.

    Premisecitation

    According to the 2018 IHS Markit survey, theft of credentials significantly increased from 2% in 2017 to 28% in 2018.

    “According to the 2018 IHS Markit's survey, theft of credentials significantly increased from 2% in 2017 to 28% in 2018 (Markit, 2018).”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites Markit, 2018

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • It may state two separate claims as one.

    Study design and conductown data

    All experts agree with the rationale for the framework, as well as its elements and structure.

    “All experts agree with the rationale for the framework, as well as its elements and structure.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim. The paper’s conclusions may not depend on it.

    Study design and conductnone given

    All respondents had some experience related to cybersecurity issues.

    “Second, although all respondents have some experience related to cybersecurity issues, one might argue that higher confidence should be placed on more experienced experts.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim. It may state two separate claims as one.

    Interpretationnone given

    The main novelties in risk modelling are new definitions and descriptions of the three cybersecurity risk parameters and their linguistic terms, and a new conditional probability distribution to model the conditional relationship between the risk parameters and cybersecurity levels.

    “The main novelties in terms of risk modelling are a) new definitions and descriptions of the three cybersecurity risk parameters and the linguistic terms used to define each of them and b) new conditional probability distribution to model the conditional relationship between the risk parameters and cybersecurity levels.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim.

    Premisecitation

    A robust model should satisfy Axiom 1 and Axiom 2.

    “If the model is robust, it should at least satisfy the following two axioms (Jones et al., 2010).”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites Jones et al., 2010 source

  • Probably not a substantial claim. The paper’s conclusions may not depend on it. It may state two separate claims as one.

    Study design and conductown data

    A total of 48 replies were collected, of which 44 were complete (valid response rate 44%).

    “A total of 48 replies were collected, of which 44 replies were complete (valid response rate 44%).”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim.

    Study design and conductnone given

    Questionnaire 2 was sent to 100 maritime industry experts who have rich experience in the maritime industry and are familiar with cybersecurity.

    “In total, we have sent Questionnaire 2 to 100 maritime industry experts, who have rich experience in the maritime industry and are familiar with the topic of cyber-security.”
    Quote in the paperSubstantial claim

  • It may state two separate claims as one.

    Interpretationreasoning

    The top threats identified in this study-accessing links from suspicious emails, downloading attached files from unknown emails, and connecting USB or removable media to a computer without virus check-could be well prevented by software.

    “These could be well prevented by software.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim. The paper’s conclusions may not depend on it.

    Study design and conductown data

    The measures proposed in this research are not discussed against specific cyber threats.

    “Although these measures are not discussed against specific cyber threats, they can be widely applied to address various threats.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim. The paper’s conclusions may not depend on it. It may state two separate claims as one.

    Study design and conductown data

    77.27% of respondents work in a shipping company, 9% in port industry, 13.63% academic researchers; 46.46% have more than 10 years experience.

    “The respondents' background is summarised in Table 8; 77.27% of them work in a shipping company, followed by 9% in the port industry and 13.63% academic researchers in the maritime field.In addition, 46.46% of them have more than 10 years of experience.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim. The paper’s conclusions may not depend on it. It may state two separate claims as one.

    Study design and conductnone given

    A sensitivity analysis was used to validate the proposed Bayesian network model and to investigate the impact of a single threat on the entire model.

    “Furthermore, a sensitivity analysis is used to validate the proposed BN model and investigate the impact of a single threat on the entire model.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim. The paper may give no reason why it holds.

    Premisecitation

    Given the variation of the probability distributions of each cyber threat, its influence magnitude on the risk values should keep consistency.

    “Given the variation of the probability distributions of each cyber threat, its influence magnitude on the risk values should keep consistency.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites Jones et al., 2010 source

  • Probably not a substantial claim. The paper’s conclusions may not depend on it.

    Premisecitation

    Shipping companies are required to develop cybersecurity management systems to urge cybersecurity awareness.

    “Furthermore, shipping companies are required to develop cybersecurity management systems to urge cybersecurity awareness (IMO, 2017b).”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites IMO, 2017b

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • It may state two separate claims as one.

    Study design and conductown data

    The impact levels of the threats are in good harmony with their importance, proving the model against Axiom 2.

    “In a similar way, the impact levels of the threats are also in good harmony with their importance.It proves the model against Axiom 2.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim. The paper’s conclusions may not depend on it.

    Interpretationreasoning

    Human errors in cybersecurity can be reduced by software.

    “To address human errors in cybersecurity, software can help reduce threats.”
    Quote in the paperNot a substantial claim

  • It may state two separate claims as one.

    Interpretationreasoning

    By controlling these threats, we can significantly reduce the overall risk because of their high impact and sensitivity.

    “By controlling these threats, we can significantly reduce the overall risk because of their high impact and sensitivity.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim.

    Premisenone given

    Using DoB considers respondents' uncertainty when answering questions.

    “The reason for using the DoB is that it considers respondents' uncertainty when answering questions.”
    Quote in the paperSubstantial claim

  • It may state two separate claims as one.

    Interpretationreasoning

    Anti-virus software can stop malicious programmes from being downloaded and from being executed.

    “This can stop malicious programmes from being downloaded, and also from being executed.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim. The paper’s conclusions may not depend on it.

    Premisecitation

    Sensitivity analysis can help check whether a model is reliable.

    “It can help in checking whether the model is reliable.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites Ren et al., 2008 source

  • Probably not a substantial claim. The paper’s conclusions may not depend on it. It may state two separate claims as one.

    Premisecitation

    BIMCO (2018) argued that the maritime industry lacks a cyber awareness culture and governance, and this could increase its vulnerability and cause more cyberattack incidents.

    “BIMCO (2018) argued that the maritime industry lacks a cyber awareness culture and governance, and this could increase its vulnerability and, thus, cause more cyberattack incidents.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites BIMCO (2018)

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Probably not a substantial claim. It may be too vague to check against evidence. It may state two separate claims as one.

    Interpretationnone given

    The proposed Bayesian network model for maritime cybersecurity risk analysis is new and generic and can be further expanded to include more threats and/or categories.

    “The proposed BN model is new and generic and hence can be further expanded to include more threats and/or categories (such as political risks, terrorism, piracy attacks, etc.).”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim.

    Premisecitation

    An increase/decrease in the probabilities of each cyber threat should generate a relative increase/decrease to the risk.

    “An increase/decrease in the probabilities of each cyber threat should generate a relative increase/decrease to the risk.”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites Jones et al., 2010 source

  • Probably not a substantial claim.

    Premisenone given

    If the derivative is large for a parameter, a small change in it may lead to a large change in the posteriors of the targets.

    “If the derivative is large for a parameter, a small change in it may lead to a large change in the posteriors of the targets.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim. It may be too vague to check against evidence. The paper’s conclusions may not depend on it. It may state two separate claims as one.

    Interpretationnone given

    Sea crew and company staff might attempt to operate navigational or company's IT systems in convenient ways, which might cause more cyber vulnerability and a higher likelihood to be cyberattacked.

    “Sea crew and company staff might attempt to operate navigational or company's IT systems in convenient ways, which might cause more cyber vulnerability and a higher likelihood to be cyberattacked.”
    Quote in the paperNot a substantial claim

  • It may state two separate claims as one.

    Interpretationown data

    The lowest cyber threat category is 'Using outdated IT systems' with a value very close to U_R3 (27), indicating respondents do not think this is an important factor contributing to maritime cybersecurity risk.

    “On the other side, the lowest cyber threat category is 'Using outdated IT systems' with a value very close to U R3 (27), which refers to that the respondents do not think this is an important factor that contributes to the maritime cybersecurity risk.”
    Quote in the paperNot a substantial claim
    • The authors state this as an assumption: Threats and threat categories have equal importance.

  • It may state two separate claims as one.

    Interpretationown data

    The top values are just in the middle between U_R3 (27) and U_R4 (64), indicating most respondents feel cyber threats do not significantly impact the maritime industry.

    “However, the top values are just in the middle between U R3 (27) and U R4 (64), which indicates that most of the respondents feel that cyber threats do not significantly impact the maritime industry.”
    Quote in the paperNot a substantial claim
    • The authors state this as an assumption: Threats and threat categories have equal importance.

  • Probably not a substantial claim. The paper’s conclusions may not depend on it.

    Interpretationreasoning

    The low response rate was probably because the questionnaires, especially the second one, were complicated and not easy to answer.

    “The response rate to our questionnaires was around 40%; this is probably because the questionnaires (especially the second one) are complicated and not easy to be answered.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim. The paper’s conclusions may not depend on it. It may state two separate claims as one.

    Interpretationown data

    The likelihood of the three cyber threats is the lowest among the three parameters, implying most respondents believe their companies have updated IT to the latest version to protect from cyberattacks.

    “By checking the aggregated data, we found that the likelihood of the three cyber threats is the lowest among the three parameters, which implies that most of the respondents believe that their companies have updated the IT to the latest version to protest the damage from the cyberattacks.”
    Quote in the paperNot a substantial claim

  • It may state two separate claims as one.

    Study design and conductown data

    The impact of every change to the target node 'risk' is consistently increased, which is in line with Axiom 1.

    “The impact of every change to the target node 'risk' is consistently increased, which is in line with Axiom 1.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim. The paper’s conclusions may not depend on it. It may state two separate claims as one.

    Premisecitation

    FMEA is a common method for investigating the importance of potential failure modes and is widely used for safety and reliability analysis in products and processes.

    “FMEA is a common method for investigating the importance of potential failure modes and is widely used for safety and reliability analysis in products and processes (Yang et al., 2008;Wan et al., 2019a).”
    Quote in the paperNot a substantial claim0 of 2 sources checked
    • cites Yang et al., 2008 source
    • cites Wan et al., 2019a

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Probably not a substantial claim.

    Study design and conductreasoning

    Due to lack of comprehensive data, validation is performed through a sensitivity analysis in line with Jones et al. (2010).

    “Due to lack of comprehensive data, our validation is performed through a sensitivity analysis in line with Jones et al. (2010).”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites Jones et al., 2010 source

  • It may state two separate claims as one.

    Interpretationown data

    The top two cyber threats belong to 'Malware', which has been identified as the top cyberrisk category and illustrates the importance of addressing this area.

    “The top two cyber threats belong to the category of 'Malware', which has been identified as the top cyberrisk category and illustrates the importance of addressing this area.”
    Quote in the paperSubstantial claim
    • The authors state this as an assumption: Threats and threat categories have equal importance.

  • Probably not a substantial claim.

    Interpretationnone given

    The measures proposed in this research can be widely applied to address various maritime cyber threats.

    “Although these measures are not discussed against specific cyber threats, they can be widely applied to address various threats.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim. The paper may give no reason why it holds. It may state two separate claims as one.

    Interpretationnone given

    The top three cyber threats can all be controlled through increased cybersecurity awareness, which could be gained through regular training and education.

    “However, these top three cyber threats can all be controlled through increased cybersecurity awareness, which could be gained through regular training and education.”
    Quote in the paperNot a substantial claim
    • The authors state this as an assumption: Threats and threat categories have equal importance.

  • It may state two separate claims as one.

    Study design and conductown data

    In total, 100 copies of Questionnaire 1 were sent out; 38 replies were received, of which 31 were complete (valid response rate: 31%) and used to prioritise the importance of the assessed threats.

    “In total, 100 copies of Questionnaire 1 were sent out to shipping companies, seafarers, port authorities, IMO experts, and academics.38 replies have been received, of which 31 were complete (valid response rate: 31%) and have been used to prioritise the importance of the assessed threats.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim. It may be too vague to check against evidence. It may state two separate claims as one.

    Study design and conductnone given

    The results of this research were tested to be reliable and insightful.

    “Although the results are tested to be reliable and insightful, a higher number of responses could lead to new perspectives.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim. The paper’s conclusions may not depend on it.

    Premisecitation

    BIMCO recommends that an anti-virus programme be installed on all work-related computers on board to reduce the possibility of cyberattacks.

    “This is supported by the recommendation of BIMCO (2018) that an anti-virus programme should be installed on all work-related computers on board to reduce the possibility of cyberattacks.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites BIMCO (2018)

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Probably not a substantial claim.

    Study design and conductnone given

    The threats and categories identified from the literature are first validated and initially evaluated by domain maritime experts to make sure they are comprehensive and representative.

    “The threats and the categories identified from the literature are first validated and initially evaluated by domain maritime experts to make sure that they are comprehensive and representative.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim. It may be too vague to check against evidence. The paper’s conclusions may not depend on it. It may state two separate claims as one.

    Premisecitation

    Seafarers should be trained to deal with cyber incidents manually to protect the system and reduce damage to equipment.

    “They suggested that seafarers should be trained to deal with cyber incidents manually to protect the system and to reduce damage to equipment.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim. The paper may give no reason why it holds.

    Study design and conductnone given

    For each parameter, the sum of the DoB of the five-level items should be 100%.

    “For each parameter, the sum of the DoB of the five-level items should be 100%.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim. The paper’s conclusions may not depend on it.

    Premisecitation

    The number of maritime cyber incidents increased notably due to lack of software maintenance and patching.

    “It also reports that the number of maritime cyber incidents increased notably due to lack of software maintenance and patching.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites BIMCO (2018)

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Probably not a substantial claim. It may be too vague to check against evidence.

    Premisenone given

    The BN-based model requires validation to check whether the model is robust and to ensure the reliability of the results.

    “The BN-based model requires validation to check whether the model is robust and to ensure the reliability of the results.”
    Quote in the paperNot a substantial claim
79 of 79

  • The paper relies on this without support.

    Not all cyber threats are detected and reported.

    “Considering not all cyber threats are detected and reported, this paper applies the concept of FMEA with three parameters (i.e., likelihood of failure, consequence of failure and probability of the failure being undetected) as the initial step of maritime cyber risk assessment.”

  • The paper relies on this without support.

    Historical data on maritime cybersecurity is often unavailable or not reliable given the small number of occurred accidents.

    “this is important when historical data is often unavailable or not reliable given the small number of the occurred accidents.”

  • The paper relies on this without support.

    Subjective data obtained through expert judgement reflects stakeholders' experience and best practices.

    “The use of subjective data obtained through expert judgement also ensures that the results reflect the stakeholders experience and best practices.”

  • The paper relies on this without support.

    Cybersecurity risks suffer from high uncertainty in data.

    “However, security risks in general, and cybersecurity risks, in particular, suffer from high uncertainty in data.”

  • The paper relies on this without support.

    The six identified threat categories cover all concerned cyber threats in the maritime sector.

    “First, we identify all the concerned cyber threats in the sector based on literature review and expert opinion.”

  • The authors state this as an assumption.

    Threats and threat categories have equal importance.

    “At the same time, we assume equal importance for threats and threat categories.”

  • The paper relies on this without support.

    Threats related to onboard systems are not always the same as those related to office computers, and there are differences in network design and systems used in administration offices and ports.

    “Furthermore, threats related to onboard systems are not always the same as those related to office computers; there are also differences in the network design and systems used in administration offices and those, say, in ports.”

  • The paper relies on this without support.

    The consequences of an attack on a small shipping company are not the same as those of a similar attack on a large company, an international organisation or a governmental office.

    “Similarly, the consequences of an attack on a small shipping company are not the same as those of a similar attack on a large company, an international organisation or a governmental office.”

  • The paper relies on this without support.

    It is unavoidable to encounter various viruses and malicious programmes with the development of advanced technologies applied in the maritime industry.

    “It is unavoidable to encounter various viruses and malicious programmes with the development of advanced technologies applied in the maritime industry.”
9 of 9

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • FMEA has been integrated with Bayesian networks for cybersecurity risk assessment in complex operational environments, illustrating its capacity to structure cyber threats as failure scenarios and quantitatively prioritize their associated risks.

    “Beyond manufacturing, FMEA has been integrated with Bayesian networks for cybersecurity risk assessment in complex operational environments, illustrating its capacity to structure cyber threats as failure scenarios and quantitatively prioritize their associated risks (Park et al., 2023).”

    From An FMEA-Based Framework for Operational Technology Security Risk Prioritization in Manufacturing (2026) · cites this paper as Park et al., 2023

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

Each contradiction between two passages listed here was confirmed by an independent check.

  • Marginal-probability equation omits the fifth risk level

    Minor

    The model defines five risk levels, but the stated range for the result index in the marginal-probability equation ends at four.

  • Conclusion names the wrong third-highest-risk threat

    Minor

    The results rank lacking knowledge of cybersecurity third at 41.95, ahead of downloading attached files from unknown emails at 41.84. The conclusion instead names downloading attached files as the third-highest-risk threat.

2 of 2

Citations

Cites

Flagged first, then by citations

Research works printed but not linked: 5

  1. 2016, vol. 2
  2. Caponi, 2015, Maritime cybersecurity: a growing threat goes unanswered, Intellect. Property Technol. Law J., 27, 16
  3. Chang, 2021, vol. 207
  4. 2017, MSC, 428
  5. Imran, 2011, Advance secure login, Int. J. Sci. Res. Publ., 1, 1

Cited by

Sorted by citations

Related

Metadata

Authors
Park, C., Kontovas, C., Yang, Z., & Chang, C.-H.
Affiliations
Liverpool John Moores University (GB)
Corresponding author
Chang, Chia-Hsun
ORCID
Venue
Ocean & Coastal Management
Publisher
Elsevier BV
Published
2023-03
Volume
235
Pages
106480
ISSN
0964-5691 (ISSN-L)
DOI
10.1016/j.ocecoaman.2023.106480
OpenAlex
W4320339933
Semantic Scholar
ce02fa0c3be1f4ecb18dc726d1754194eba66b60
Cited by
98
References
56
Citations by year
2026: 26 · 2025: 26 · 2024: 29 · 2023: 17
FWCI
18.02
Type
journal article
Language
en
Open access
Licence
Locations
  • Ocean & Coastal Management (publishedVersion, cc-by)
  • Liverpool John Moores University (submittedVersion)
Funders
  • International Association of Maritime Universities
  • Horizon 2020 Framework Programme (864724, EU‐H2020)
Topics
  • Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
  • Physical Sciences › Engineering › Ocean Engineering › Maritime Navigation and Safety
  • Physical Sciences › Engineering › Safety, Risk, Reliability and Quality › Risk and Safety Analysis
Keywords
maritime cybersecurity, failure mode and effects analysis, autonomous shipping, cyber resilience

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

A language model drew the claims from the paper on 2026-11-07, under version 3 of the claim definition (model deepseek-v4.1-flash, prompt extract-v3).

A second model labelled each claim on 2026-11-07 (model jev-1.13-20260917, definition revision gold-guideline-v0.2).

Cited sources are checked with a language model’s help (gpt-6-sol).

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review