A ship's attack surface is not its network. It is the air around the hull, and until now nothing aboard was recording it.
Every security control a vessel carries protects the wire: the firewall at the satellite terminal, the segmentation between the bridge and the engine room, the endpoint agent on the loading computer. The things that actually reach a ship do not arrive on the wire. They arrive as a GNSS carrier that is not a satellite, as a drone controller on the bridge wing, as an access point announcing the crew network from a cabin, as a satellite terminal that the internet found before the operator did. All of them are radio, and radio is the one plane no product aboard watches.
CAVER RF is a receive-only sensor set and the data plane behind it: the spectrum around the vessel, learned as a baseline, kept as history, scored against a threat feed and against patterns, and drawn on the ship itself. The claim it makes that no radio vendor can make cheaply is the one in the title: the census of what was aboard when the ship left the berth, and the difference from it an hour later.
This paper is the maritime flagship. The same sensor, registry and rules run on a plant floor and on a hospital floor, and an appendix says how; the ship comes first because a ship is the one environment where the question has a clean boundary and a clock: the port call.
A cargo ship's only permanent connection to the world is a satellite terminal on the monkey island, and that terminal is a computer with a web page. A 2019 passive assessment of a US tanker operator found seventeen of them on the operator's fleet from the public internet, using nothing more than a search engine for connected devices: the terminal's management page reachable, served without encryption, on factory passwords, with an address on it that listed the terminal's users without a login, and telnet and FTP open on the same host. The operator did not know. Nobody on the shore side could see the ship.
That is the threat model in one finding: the ship is reachable through a door the operator does not watch, and everything past the door is trusted. Three more doors have the same shape.
None of these appear in a firewall log. All of them appear in the spectrum, and the spectrum is cheap to record.
Fingerprinting a radio is a feature every RF vendor can claim. Knowing that forty emitters left Singapore with the ship and forty-seven are aboard tonight, and naming the seven, is a claim only a platform that keeps years of a vessel's own spectrum history can make cheaply. That is the product.
It works because a ship has a clock the shore does not: the moment the mooring lines come off. CAVER reads that moment from the same observations it already records (the port-call tag on the events stops appearing), and takes a census.
The numbers in this section are from the engineering test voyage the capability was proven on (a container vessel, Singapore to Rotterdam over ten days with six sensors), not from a customer. Your census will be your ship's.
A radio has no name. It has, at best, a hardware address; more often a shape. CAVER resolves every observation onto a device through three layers and says which one it used, because a confidence the operator cannot read is a guess dressed as a fact.
| Layer | What it reads | Confidence | Where it fails |
|---|---|---|---|
| Address and self-identity | A vendor-assigned MAC, an AIS MMSI, a serial the device announces about itself | Definite | A randomized or locally administered MAC is only likely; the resolver marks the difference |
| Signal shape | A hash of the transmission's structure: hop pattern, burst timing, bandwidth, modulation | Likely | Two units of the same product from the same batch can share a shape |
| Physical-layer centroid | The small imperfections of the transmitter itself, held as a vector per band and matched by distance | Possible | Needs several observations to settle; a moved sensor shifts it |
The layers stack. A device seen by its MAC on the bridge and by its shape in the hold is one device with two pieces of evidence; two devices that claim the same identity from different shapes are a merge candidate for a person to decide, never a silent merge. The registry keeps the device, its aliases, its sites and the verdict an operator gives it, and the verdict is what turns a repeat sighting from a notable into a line on a table.
If the vessel's own access points report rogue and neighboring devices, those observations join the same registry as the radio sweeps. Controller logs from the vessel's wireless vendor feed it too, including rogue access point reports, available on request, typically delivered within 30 days of order. Physical-layer fingerprinting and continuous multi-sensor capture are in design-partner deployments, and the centroid layer improves as sightings accumulate.
Every classification carries its reasons. A device typed as a drone controller says so because of its band, its vendor and its control protocol, in that order, and the paper does not claim a classifier accuracy it has not measured on a labeled set. The last section says where that measurement stands.
Not every finding should page the master at three in the morning. CAVER RF grades what it sees on a ladder, and each rung is a rule you can read, enable and tune.
| Rung | What fires it | Severity | Example rule |
|---|---|---|---|
| Feed hit | An emitter fingerprint on the threat feed: a known jammer, IMSI catcher, drone controller or rogue access point signature. One hit is the alarm. | Critical | known_malicious_fingerprint_match |
| Pattern | A shape the ship should never see: the GNSS floor risen against the sensor's own baseline, two bands saturated at once, a second radio announcing an existing network name, a strong cellular cell with no shore in range, a drone controller in the last hour. | High | gnss_interference, broadband_jammer, evil_twin_ssid, cellular_emitter_at_sea, drone_controller_aboard |
| Census | Devices present now that were not on the departure census; a non-ship emitter heard in a restricted zone. | Medium to high | new_emitters_since_last_port, restricted_zone_emitter |
| Score | Evidence that adds to a device's risk without paging on its own: a vendor on the watchlist, a locally administered address, a device seen in more than one zone. | Medium | watchlisted_vendor_oui |
Every rule is firing-tested against the reference voyage before it ships, the way every other detection in CAVER is: a positive record fires, a negative one does not, and the test reads the rule from the shipped content rather than a copy of it.
Alarm severity on the ladder is carried onto the notable, so the master is paged on the rung that fired and not on a generic score. A drone that broadcasts Remote ID is decoded: the operator-assigned ID, position and altitude arrive as a record beside the drone-controller emitter, so "a drone controller on the bridge wing" becomes "this drone, here." A dedicated Remote ID receiver can forward every captured broadcast to the vessel's CAVER, available on request, typically delivered within 30 days of order.
A sensor that stops is a finding. The doctor reports a stalled RF pipeline, and a protected-band interference alarm is judged against that band's own history.
A bridge officer does not read a table of zones. They read the ship. The Cargo-Ship Layout board draws the vessel in plan view, stern left, bow right, port up, and colors each sensor zone by what it holds: emitters per zone with the highest severity as the border, then band occupancy per zone. A zone with a watchlisted device reads as a bordered zone before anyone reads a number.
Ships are not one shape, the way cars are not. The drawing comes from a library of prebuilt designs: bulk carrier, container ship with its bridge forward of the engine casing, general cargo, tanker with pump room and manifold and tanks port and starboard, gas carrier, ro-ro and car carrier with their vehicle decks and ramps, reefer, heavy-lift, offshore supply. The board carries a vessel-type selector, and a zone the design does not know is drawn beside the hull rather than dropped, because a sensor that reports is a sensor the watch needs to see.
Two or more sensors that hear the same emitter produce a fix, drawn as rays on the deck plan, with first contact marked on the first sighting. Coherent-array receivers can feed bearings into the same fix engine, tightening a zone-level answer toward a position for non-personal emitters; that is available to design partners.
The Maritime edition is the vessel layer on top of CAVER RF. It decodes AIS from a marine VHF receiver, keeps the vessel inventory and track history, draws the deck, and carries the SATCOM and GNSS rules and the USCG evidence report. It is a license-gated edition.
The satellite terminal is the one shipboard system the internet can reach, and the ship's own firewall, flow and intrusion-detection feeds already say what touches it. CAVER's maritime pack adds the rules that read them, keyed on a short table the operator fills once: the terminal addresses and a label for each.
On the radio side the terminal is a Ku or Ka band emitter the sweep already sees. A second terminal-shaped emitter aboard, or the terminal transmitting outside its schedule, is a pattern rule of its own. The assessment that found seventeen terminals from the shore could not see any of this; the ship can.
Of every maritime RF threat, interference with satellite positioning is the one with public incident data and regulator attention, so it is the one this paper puts a measured chain behind rather than a claim.
The same rule, unchanged, protects a plant's timing reference and a hospital's clocks; the appendix says so. A band-level interference sweep covers bands beyond GNSS with the same six-hour baseline method, available to design partners.
Two guarantees are built into the sensor rather than promised in a policy, and they go on this page because a buyer should be able to point to them.
It has no transmitter to enable. It cannot jam, cannot inject, cannot decode a protected payload without the vessel's own key, and cannot be turned into any of those by a configuration change, because the hardware is a receiver. The OT network sensor is passive in both install modes, and a receiver-only RF sensor keeps this capability on the defensive side of the line.
Personal-device bands, wearables and medical radios are captured in an interference-only mode: counted so a jammer on those bands is still seen, and held in a secured, access-controlled area of the lake. The census and every rule in this paper run on identity-mode observations only, and the boards show the personal bands as a count on a strip, not a list. Where a flag state's privacy law says less, less is retained; the retention is a setting, not a rebuild.
Fingerprinting and localization together could follow a person through a hull and across visits. That data is held in a secured, access-controlled area of the lake, personal bands are localized by sensor zone, and a medical radio is a signal to protect. Where an on-site consented authorization reveals a medical-band identity, the authorization is itself audited. The same arrangement holds in the hospital version.
A ship's link is expensive, intermittent and shared with everything else aboard, so the design assumes it is mostly absent.
When a census or a jamming alarm has to stand up to an investigator, it files to the Evidence Locker: sealed, signed and checkable offline. RF activity also feeds the same behavior models as the rest of the platform, scoped per vessel.
None of the frameworks below certify a product, and this paper claims no certification. What each asks for is a capability, and the table says which shipped capability answers it, in the style the OT content uses for its own mappings.
| Framework | What it asks for | What CAVER RF answers with |
|---|---|---|
| IMO MSC-FAL.1/Circ.3 (Guidelines on maritime cyber risk management), under the ISM Code | Identify, protect, detect, respond and recover across the vessel's cyber risk, in the safety management system | Detection of the radio plane the SMS never covered; the census and the alarm ladder as the detect function; notables with an evidence chain as the respond input |
| IACS UR E26 (cyber resilience of ships) and E27 (systems and equipment), for new builds | Inventory, network segmentation, detection of unauthorized access and equipment, response and recovery | The emitter registry as the wireless inventory; the restricted-zone and evil-twin rules as unauthorized-equipment detection; the SATCOM rules for the one internet-facing system |
| 33 CFR Part 101, the USCG maritime transportation system cybersecurity rule (effective 2025-07-16; cybersecurity officer, assessment and plan due 2027-07-16 for US-flagged vessels) | Reportable cyber incidents, a cybersecurity assessment, a cybersecurity plan, training, and measures for detection | The RF baseline and census as assessment evidence; the notable stream as the detection measure; incident records with the sensor, the rise and the peak for the report to the National Response Center; and a signed USCG MTS cyber rule evidence report |
| NIST SP 800-82, Guide to Operational Technology (OT) Security. Rev 3 is the citable baseline; Rev 4 went to public draft on September 21, 2026 and adds maritime vessels as a named sector (Sec. 2.5.4) | Anomalies and events (DE.AE), continuous monitoring (DE.CM), asset management (ID.AM) for OT. The Rev 4 draft describes this sector in terms the radio plane already carries: satellite, HF, VHF and UHF for communication at sea; AIS, ECDIS and GPS/GNSS for navigation; GMDSS, distress radio beacons and NAVTEX for emergencies; and a network topology and attack surface that change with the vessel's operational phase | Baselines per sensor and band; 24x7 passive monitoring; radios as assets beside the controllers they serve. Against the Rev 4 draft specifically: the emitter registry is an inventory of exactly the systems Sec. 2.5.4 names, and a baseline that is per sensor rather than per site is what survives a topology that changes between at sea, in port and dry dock |
| HIPAA (the medical appendix only) | Protection of health information carried by medical radios | Interference-only capture on medical bands: the payload is not decoded, and the data is held in a secured, access-controlled area of the lake |
The USCG and NIST SP 800-82 rows are also available as signed CAVER compliance reports, as are IEC 62443, NIST CSF 2.0, NIST 800-53 and the NCSC OT secure connectivity guidance, with unevidenced controls shown as unevidenced.
Where a framework asks for a control the platform does not carry (crew training, a written plan, a designated officer), the paper says so rather than stretching a detection to fit.
The vessel is the flagship because it has the cleanest boundary. The sensor, the registry, the resolver, the rules and the boards are shared; each domain adds a zone map, a vendor list and its own detections on top.
One product, not a different tool for every environment.
CAVER runs on Kubernetes, a virtual machine, an isolated network, or a single box. License activation does not need an internet connection, and a lapsed license gives you a 14-day grace period rather than shutting off mid-incident.
This is your risk decision. Both are real products. Neither is a discouraged version of the other.
SAML 2.0 and OpenID Connect are both configured in the product: paste or fetch your identity provider's SAML metadata, or point at your OIDC issuer for discovery, then map the attributes or claims to roles. Test against the live provider before you can turn it on: enable is refused without a successful test in the last 24 hours. A saved change or a disable takes effect on the next request, no restart, and local login stays reachable so an identity-provider outage cannot lock your operators out. An OIDC client secret is sealed in the product's credential vault, never stored in the clear.
SCIM provisioning is configured the same way: an operator mints a bearer token for the identity provider, shown once and stored only as a hash, revoked on the very next request rather than the next restart. Group membership from SAML, OIDC, or SCIM maps to roles by the same rule.
Depth is not evenly available, and a paper that hides that costs more than it wins.
If a capability you need is on this list, that is a product conversation rather than a purchase, and it should start by saying so.