LSTM Autoencoder Ensemble for NMEA 2000 Intrusion Detection on Vessel Networks

NMEA 2000 is the CAN-based bus that connects navigation, propulsion and safety equipment on boats, yet it has no authentication, so any device can claim any source address. The speaker argues that automotive-style intrusion detection misses quiet, physics-based attacks such as GPS drift, because those stay within normal thresholds. Real vessel captures are rare and labeled attack data is scarce, so the team built a low-cost hardware capture board and a simulated digital twin that emits labeled traffic.

The detector is an ensemble of four LSTM autoencoders, each watching a different facet: message timing, payload statistics, message frequency, and per-device behavior. Each model learns to reconstruct windows of normal traffic, and an alert fires when at least two of the four report high reconstruction error. Thresholds are set automatically at the 99th percentile of validation error, so tuning needs no attack labels. On a 24-hour capture of roughly 9.16 million messages, the ensemble reached an F1 near 0.96 under temporal cross-validation, with about 39 milliseconds of inference latency per window.

The approach also transferred to automotive CAN data. Next steps include fingerprinting the electrical signal of each device, hardening the bus, and collecting data from more vessels and network layouts. The digital twin is planned for public release so others can build their own scenarios, and the audience was encouraged to help find boats willing to share captures.