SERDUX-MARCIM: agent-based simulation of cyberattack propagation in maritime critical infrastructure (0.0.1)

SERDUX-MARCIM simulates the propagation of a cyberattack over the computational network of an organization in the maritime sector, at the strategic level of decision-making. It is the instantiation of ABM-MARCIM, the agent-based model of the MARCIM framework for the modeling and simulation of maritime cyberdefense.

Every computational asset of the target organization – servers, endpoints, routers, gateways, vessel systems, radars – is an agent that occupies one of six states at each time step: Susceptible, Exposed, Resistant, Degraded, Unavailable or Destroyed, the initials of which give the model its name. The states Degraded, Unavailable and Destroyed are associated with the D5 cyberattack effects (disrupt, degrade, deny, destroy, deceive) as a function of the degree and the duration of the attack. Thirteen transitions between states are admissible.

Unlike a conventional agent-based model, the local update function is not an individual behavioral rule. It is a system of six ordinary differential equations with eight time-dependent transition rates – propagation, cyberattack (degraded), cyberattack (unavailable), cyberattack (destroyed), recovery, sanitation, loss of resistance, and unavailability by other causes. The values of those rates derive from the capabilities of the target organization, the capabilities of the attacker, and the degree and duration of the cyberattack, computed through a cyber risk approach aligned with the OWASP Risk Rating Methodology, the ISACA categorization of security controls and the IMO Guidelines on Maritime Cyber Risk Management.

At every step the system is integrated numerically in Python using the RK45 method of Dormand and Prince, and the resulting aggregate distribution of agents across states is projected onto the individual agents by an allocation algorithm, formulated as a problem of distributing elements among states over the graph of admissible transitions and solved by breadth-first search. The algorithm doubles as a consistency check on every simulation step.

The model is implemented in NetLogo with background routines in Python (numpy, scipy, sympy, pandas, matplotlib). The interface lets the experimenter configure the size and initial state distribution of the network, the average number of connections per node, the capabilities and security controls of the target, the attacker factors and vulnerability factors, and the degree, duration and initial propagation rate of the cyberattack. Outputs include the network status by state, the level of active and inactive services, the value of every transition rate over time, the assessment of cyber risk severity, likelihood and impact, and a node-level graph of the target network.

The model has been validated against the 2017 NotPetya cyberattack on Maersk, which it reproduces with an accuracy of 97.37 per cent, assessed for stability by the steady-state and Lyapunov exponent methods, compared against the SEIRS and MalSEIRS models, and evaluated by expert judgement in hybrid tabletop exercises with strategic-level maritime stakeholders from sixteen countries. Three preset buttons (SIM 1, SIM 2, SIM 3) reproduce the three simulations of the Maersk case.

Verification of the agent layer shows that the model is deterministic at the level of the population and stochastic at the level of the individual: replications of an identical scenario produce coincident aggregate trajectories while up to three quarters of the agents occupy different states, so the agent layer contributes a distribution of individual histories that the aggregate representation cannot express.

Release Notes

This software is a NetLogo implementation of “SERDUX-MARCIM: Maritime cyberattack simulation using compartmental models in epidemiology and agent-based modeling” (Diego Cabuya et al., 2024), a model for simulating, modeling, and analyzing the propagation of cyberattacks in maritime infrastructures.

Its purpose is to serve as a simulation tool for the SERDUX-MARCIM model, allowing the experimenter to analyze and forecast the propagation of a cyberattack in a maritime infrastructure through different scenarios and configurations, parameterizing the specific characteristics of the network, the capabilities of the target and attacker, the characteristics of the cyberattack, and the specific parameters of the mathematical model.

Associated Publications

Cabuya-Padilla, D., Díaz-López, D., Martínez-Páez, J., Hernández, L. & Castaneda-Marroquin, C. (2025). SERDUX-MARCIM: Maritime Cyberattack simulation using Dynamic Modeling, Compartmental Models in Epidemiology and Agent-based Modeling. International Journal of Information Security, 24, 122. https://doi.org/10.1007/s10207-025-00985-6

Cabuya-Padilla, D., Díaz-López, D. & Castaneda-Marroquin, C. (2025). Hybrid Tabletop Exercise (TTX) based on a Mathematical Simulation-based Model for the Maritime Sector. JNIC 2025, 406-413.