Fingerprinting Maritime NMEA2000 Networks

Fingerprinting Maritime NMEA2000 Networks

Speakers: Constantine Macris TheDini, CISO at Dispel & PhD Candidate at URI; Anissa Elias, Software Research Engineer at Wright Solutions & PhD Candidate at URI

Conference: DEF CON

YouTube: https://www.youtube.com/watch?v=LbIAmMXCjZ0

Overview

In this DEF CON presentation, Constantine Macris (TheDini) and Anissa Elias introduce a novel method for deterministically fingerprinting NMEA 2000 networks, a critical bus protocol for maritime electronics. The talk addresses a significant gap in maritime cybersecurity: the lack of publicly available research and tools to establish a baseline for "normal" network behavior on vessels. Given the unauthenticated nature of NMEA 2000, understanding and identifying deviations from expected operations is paramount for detecting potential cyberattacks or system malfunctions.

The speakers, both PhD candidates at the University of Rhode Island with backgrounds in maritime and cybersecurity, highlight the high cost and proprietary nature of NMEA 2000 equipment, which has historically hindered open-source research. Their work, supported by the Office of Naval Research, builds upon previous efforts like the OpenBridge project to make maritime industrial control protocols more accessible for study. By developing a systematic approach to collect, analyze, and baseline NMEA 2000 traffic, Macris and Elias provide a foundational tool for enhancing the security posture of modern vessels against an evolving threat landscape.

This research is particularly relevant for ship operators, cybersecurity professionals, and regulatory bodies seeking to improve the resilience of maritime navigation, propulsion, and communication systems. The ability to accurately fingerprint a vessel's NMEA 2000 network allows for the detection of anomalous devices, unexpected message types, or unusual traffic frequencies, offering an early warning system against both accidental misconfigurations and malicious intrusions that could have severe consequences for safety and operations at sea.

Background

▶ Watch: Introduction and Speaker Backgrounds (0:00)

The National Marine Electronics Association (NMEA) 2000 standard defines a serial data network for connecting marine electronic equipment. It is the backbone for communication between various sensors and displays on modern vessels, handling critical data such as GPS position, depth, speed, engine parameters, wind data, and rudder angle. This protocol is built upon the Controller Area Network (CAN) bus, specifically using the ISO 11783 standard, which is itself compatible with the SAE J1939 standard used in heavy-duty vehicles. The speakers emphasize this compatibility, noting that one could conceivably use a marine GPS head unit in an excavator, highlighting the underlying commonality and, by extension, shared vulnerabilities.

A fundamental challenge with NMEA 2000, inherited from its CAN bus foundation, is its lack of inherent authentication or encryption. All devices on the bus can "talk and listen," and messages are prioritized through CAN arbitration, where the message with the lowest identifier (and thus highest priority) wins access to the bus. This design, while efficient for its original purpose of real-time control in noisy environments, leaves the network vulnerable to various attacks, including message injection, spoofing, and denial-of-service by simply flooding the bus. Malicious actors could potentially manipulate critical sensor data, issue false commands, or disrupt essential navigation and engine control systems, leading to hazardous situations or costly operational failures.

The high cost of NMEA 2000 hardware—sensors and head units often costing hundreds to thousands of dollars—has historically limited academic and open-source research. This financial barrier, coupled with the proprietary nature of much of the protocol's documentation (requiring NMEA membership to access full specifications, and even then, not all Parameter Group Numbers (PGNs) are publicly documented by manufacturers), has created a knowledge gap. Consequently, there's a scarcity of publicly available datasets and methods to establish baselines for normal NMEA 2000 network behavior. The speakers previously tackled the accessibility issue with their OpenBridge project at DEF CON 29, aiming to create cheaper, more attainable learning platforms for maritime industrial control protocols. This current research on deterministic fingerprinting directly addresses the subsequent problem: how to define and detect "normal" versus "abnormal" behavior on these vulnerable networks.

Key Findings

▶ Watch: NMEA 2000 Protocol Basics and Vulnerabilities (3:45)

The central contribution of this research is the development of a deterministic fingerprinting method for NMEA 2000 networks. This method allows for the establishment of a comprehensive baseline of a vessel's electronic systems, enabling the detection of anomalies that could indicate a cyberattack, device malfunction, or unauthorized system modification. The key findings and contributions can be summarized as follows:

1. Systematic Data Collection and Analysis Pipeline: The researchers established a robust architecture for collecting raw CAN frames from NMEA 2000 networks using a logic analyzer (specifically, a Saleae device). They then developed a software stack, which they intend to release as a public library, to parse these raw frames into meaningful NMEA 2000 messages, extracting crucial information like Parameter Group Numbers (PGNs) and Source Addresses (SAs). This pipeline transforms raw bus data into structured, analyzable information.

1. Creation of a Comprehensive NMEA 2000 Database: To support the fingerprinting process, a multi-table database was designed. This database includes:

• A Device Inventory to identify all known devices on the network, often populated using specific PGNs like PGN 12699 (Product Information).
• A PGN Traffic table that records the frequency of each PGN sent by each unique device, providing behavioral insights.
• A general PGN Database to make sense of observed PGNs, addressing the challenge of proprietary and undocumented PGNs by providing a publicly searchable resource.

1. Deterministic Fingerprinting Equation: A mathematical representation was formulated to define the "fingerprint" of an NMEA 2000 network. This fingerprint is a combination of the network's topological behavior (what devices are present) and its behavioral knowledge (what PGNs each device sends and at what frequency). The equation incorporates the set of known devices (D), the set of PGNs known to be sent by each device (P_D), and the expected average frequency (freq_avg(P,D)) at which each device sends specific PGNs.

1. Anomaly Detection Capabilities: The developed method can detect several types of anomalies against the established baseline:

• New PGN and Device Combinations: Identifying when a known device starts sending a PGN it wasn't previously observed to send.
• New PGNs Found: Detecting any PGN appearing on the bus that was not part of the baseline, regardless of the sender.
• Unknown Devices: Flagging any device whose Source Address is not recognized in the device inventory. This is critical as an unknown device could be a rogue sensor or an attacker's tool.
• Frequency Alerts: Notifying when the transmission frequency of a known PGN from a known device deviates significantly from its baselined average (e.g., exceeding an 85% difference as shown in the demo).

These findings collectively provide a robust, open-source-oriented framework for baselining and monitoring NMEA 2000 networks, moving beyond the current state of limited visibility and reactive responses to potential security incidents.

Technical Deep Dive

▶ Watch: Our NMEA 2000 Test Environment Setup (6:00)

The core of the NMEA 2000 fingerprinting method lies in its structured approach to data acquisition, parsing, and analytical processing. The overall system architecture comprises a physical test environment, a data acquisition interface, and a sophisticated software analysis stack.

The physical system used for research involved a typical NMEA 2000 bus, powered by 12 volts and terminated with two resistors. Connected devices included a wind sensor, weather station, AirMar unit, a Maratron head unit, and a Garmin chart plotter. This setup, while representing a real-world maritime network, was meticulously controlled to generate reliable baseline data.

Data Acquisition is performed using an interface device, specifically a Saleae logic analyzer. This device passively listens to the CAN high and CAN low wires of the NMEA 2000 bus, capturing raw electrical signals. These signals represent the dominant and recessive bits that form the underlying CAN frames. The choice of a logic analyzer allows for detailed, bit-level capture, which is crucial for future analog analysis, as discussed in the "Next Steps."

The software analysis stack is where the magic happens, transforming raw CAN data into actionable intelligence. This stack, intended to be published as a library on GitHub under the OpenBridge project, performs several critical functions:

1. CAN Frame to Binary Conversion: Raw CAN frames, which are typically presented in hexadecimal format, are first converted into binary representations. This is the first step towards dissecting the frame's structure.

1. PGN Extraction: The NMEA 2000 protocol uses an extended CAN header to derive the Parameter Group Number (PGN), which uniquely identifies the type of message being transmitted (e.g., GPS position, engine RPM, depth). The speakers detailed the extraction process:

• The CAN header (29-bit extended identifier) is taken from the raw frame.
• This header is converted to binary.
• Specific bits within this binary header are then extracted to form the PGN. These include:
• The Reserve bit (R)
• The Data Page bit (DP)
• The PDU Format (PF) field bit (referred to as "PDU field bit" by the speaker)
• The PDU Specific (PS) field bit (referred to as "PDU specific bit" by the speaker)
• These bits are concatenated, and if the PS value is above 240, a "bit flip" operation is performed (this specific detail is crucial for correct PGN derivation in NMEA 2000).
• The resulting binary sequence is then converted to a decimal PGN.

1. Source Address (SA) Extraction: Alongside the PGN, the Source Address (SA) is extracted from the CAN frame. The SA is an 8-bit identifier that uniquely identifies the device on the network that sent the message. This is a simpler extraction than the PGN but equally vital for attributing messages to specific devices.

1. Database Management: The extracted PGNs and SAs populate a multi-table database:

• Device Inventory Database: This table stores information about known devices on the network. Initial population can occur through specific NMEA 2000 messages like PGN 12699 (Product Information), which provides details such as the manufacturer, model, and software version of a device. Each unique Source Address is linked to a device entry.
• PGN Traffic Database: This is a crucial table for behavioral analysis. It records every unique PGN-device combination observed and calculates the average frequency at which each device sends a particular PGN. For example, if both Device 1 and Device 2 send PGN 1, these are treated as two distinct behavioral entries: (PGN 1, Device 1) and (PGN 1, Device 2), each with its own frequency.
• PGN Database: This table provides descriptive information for all observed PGNs. This addresses the challenge of proprietary PGNs, which are not publicly documented by NMEA, allowing users to look up the meaning of a PGN based on their own observations or community contributions.

The pinnacle of the technical deep dive is the deterministic fingerprinting equation. The speakers define the fingerprint F of a network as:

F = { (D, P_D, freq_avg(P,D)) | D ∈ Devices, P ∈ P_D }

Where:

• Devices is the set of all known devices on the network.
• P_D is the set of all unique PGNs sent by a specific device D.
• freq_avg(P,D) is the average frequency (e.g., messages per minute) at which device D sends PGN P.

This equation mathematically formalizes the network's baseline. When monitoring the network, incoming traffic is continuously compared against this F. Any deviation triggers an alert based on four criteria:

1. Unknown Device: A Source Address D' is observed where D' ∉ Devices.
2. New PGN: A PGN P' is observed where P' ∉ P_D for the transmitting device D.
3. New PGN-Device Combination: A PGN P' is observed from device D where (P', D) was not part of the baseline.
4. Frequency Anomaly: The current measured frequency of P from D (freq_current(P,D)) deviates significantly from freq_avg(P,D). The demo specifically highlighted alerts for deviations above 85%.

This rigorous process allows for a granular and deterministic identification of changes in the NMEA 2000 network's composition or behavior, providing a robust foundation for anomaly detection.

Demo / Proof of Concept

▶ Watch: The Core Problem: Defining Network Normalcy (6:40)

The presentation included a demonstration of the developed dashboard, which visually represents the NMEA 2000 network's state and highlights detected anomalies. While not a live demo during the talk, a pre-recorded video showcased the dashboard's capabilities in identifying deviations from an established baseline.

The dashboard's interface was designed to provide clear, actionable insights into the network's health. Key components displayed included:

1. System Map: A visual representation of the physical network, illustrating the connected devices. The speakers humorously noted that this map was initially generated by ChatGPT, inviting attendees to compare its accuracy with their actual test setup at the Maritime Hacking Village. This map helps users quickly grasp the network topology.

1. Device Inventory: A list of all known and authorized devices on the network, identified by their Source Addresses and associated product information (e.g., from PGN 12699). In the demo, only three known devices were initially present.

1. PGN Frequency: This section displayed the average transmission frequency of each unique PGN sent by specific devices. This provides a behavioral baseline for each device's communication patterns.

1. PGN Monitoring: A comprehensive log of every PGN observed during a network run, allowing users to review all traffic.

The demo then simulated a "new run" where anomalies were introduced. The dashboard effectively highlighted these deviations, presenting a summary of "bad things that came up when using our fingerprint." These alerts were categorized for clarity:

• Total of New PGN and Device Combinations: Indicated when a known device started transmitting a PGN it had not previously sent in the baseline.
• All New PGNs Found: Listed any PGN that appeared on the bus for the first time, regardless of the sender.
• Frequency Alerts: Showcased instances where the current measured frequency of a PGN from a specific device significantly differed from its baselined average. The demo specifically highlighted anomalies where the percentage difference was above 85%, indicating a substantial change in a device's transmission rate.
• Unknown Devices: Crucially, the dashboard flagged any device with a Source Address not present in the baseline device inventory. This is a critical indicator of an unauthorized or rogue device being connected to the network. For new devices, it also detailed what PGNs they were sending and if those PGNs had been seen from other known devices previously.

The dashboard's intuitive design and clear categorization of alerts underscore the practical applicability of the deterministic fingerprinting method. It provides operators with a powerful tool to immediately identify and investigate suspicious activities or malfunctions on their NMEA 2000 networks, moving from a reactive to a proactive security posture.

Defensive Implications

▶ Watch: System Architecture and Data Collection Approach (7:40)

The deterministic fingerprinting method for NMEA 2000 networks presented by Macris and Elias offers significant defensive implications for maritime cybersecurity. By providing a concrete way to establish and monitor "normal" network behavior, it empowers defenders to detect anomalies that could signal a wide range of threats, from accidental misconfigurations to sophisticated cyberattacks.

Firstly, the ability to baseline an NMEA 2000 network is a fundamental step towards effective anomaly detection. Without a clear understanding of what constitutes normal traffic, identifying malicious or erroneous activity is exceedingly difficult. This method allows ship operators and IT/OT security teams to create a unique digital fingerprint for each vessel's specific electronic configuration. This baseline can then be continuously monitored, either in-line for real-time analysis or in batch mode for offline review, providing flexibility for different operational contexts.

The detection of unknown devices is a critical defensive capability. In an unauthenticated environment like NMEA 2000, connecting an unauthorized device—whether a rogue sensor, a maintenance tool used improperly, or a malicious implant—can have severe consequences. The fingerprinting system immediately flags such additions, enabling rapid investigation and remediation before potential damage occurs. Similarly, new PGNs or new PGN-device combinations can indicate unauthorized software updates, device malfunctions, or attempts by an attacker to inject novel commands or data onto the bus. For instance, an unexpected PGN related to rudder control or engine commands could signal an attempt to interfere with vessel operation.

Frequency anomalies, such as an 85% deviation from baselined transmission rates, are also vital indicators. A device suddenly sending messages much more or less frequently could point to a denial-of-service attack (flooding the bus), a device being compromised and commanded to transmit excessively, or a hardware failure. Detecting these shifts allows for proactive intervention, preventing potential disruption of critical navigation or propulsion data.

The speakers also touched upon future defensive implications. Their next steps include analog data analysis, which would involve examining the electrical characteristics of the CAN bus signals (zeros and ones). Changes in these electrical characteristics could indicate the presence of physically compromised devices or sophisticated signal injection attacks that might not be detectable solely by parsing digital PGNs. This moves towards a more comprehensive physical layer security.

Ultimately, the long-term vision is to move from detection to protection. This involves developing methods to inline prevent bad packets or information from reaching the bus. This could manifest as an intelligent gateway or a dedicated security appliance that filters or blocks anomalous traffic based on the established fingerprint. The challenge, as acknowledged, is to introduce such protective measures into a "public forum" bus architecture without disrupting legitimate communications. The idea of enabling out-of-band communication and encryption for NMEA 2000 is also a forward-looking defensive strategy, aiming to address the protocol's inherent lack of security features.

For fleet operators, this research presents a powerful tool. By standardizing the fingerprinting process, they could compare networks between ostensibly identical vessels, quickly identifying discrepancies that might indicate unauthorized modifications, outdated software, or early signs of compromise across their fleet. This capability supports a more consistent and robust cybersecurity posture across multiple assets.

Key Takeaways

• NMEA 2000 is a critical, unauthenticated maritime protocol: Based on the CAN bus, it lacks inherent authentication and encryption, making vessels vulnerable to various cyber threats targeting navigation, propulsion, and communication systems.
• Lack of open-source research and data: High equipment costs and proprietary documentation have historically hindered academic research and the development of open-source tools for NMEA 2000 cybersecurity.
• Deterministic fingerprinting is a foundational security measure: The presented method establishes a baseline of "normal" network behavior by cataloging devices, their transmitted PGNs, and the frequency of those transmissions.
• Comprehensive anomaly detection capabilities: The system can detect unknown devices, new PGNs, novel PGN-device combinations, and significant frequency deviations (e.g., over 85% change), providing early warnings of potential issues.
• Practical implementation with a dashboard: A user-friendly dashboard visualizes the network state and highlights anomalies, enabling operators to quickly identify and respond to suspicious activities.
• Future work aims for advanced protection: Next steps include analyzing analog data for deeper physical layer security and developing inline prevention mechanisms to actively block malicious traffic and explore out-of-band encryption for enhanced security.

About the Speaker(s)

Constantine Macris (TheDini) is a PhD candidate at the University of Rhode Island (URI), where he is part of the cyber physical systems lab. He brings a unique blend of maritime operational experience and cybersecurity expertise, having served as a commercial mariner for seven years in New York City after graduating from the United States Merchant Marine Academy. During his time at the Academy (2002-2006), he was involved with the cyber team and participated in the NSA cyber defense exercise. Following his maritime career, he worked in defense contracting, managing classified information systems. Currently, Macris serves as the Chief Information Security Officer (CISO) at Dispel, a company specializing in secure remote access for industrial control systems. He is also a reservist with the United States Navy, serving as an IP officer with US Forces Korea.

Anissa Elias is a software research engineer at Wright Solutions, a maritime security company, and also a PhD candidate at the University of Rhode Island's cipher center, alongside Constantine Macris. Both are pursuing their PhDs under the guidance of Professor Yanson, and their research on NMEA 2000 fingerprinting is supported by a grant from the Office of Naval Research (ONR). Elias's role in the project primarily focused on developing the software analysis stack, including the library for parsing CAN frames into readable NMEA 2000 messages and the dashboard for visualizing the network's fingerprint and anomalies.