As cyberattacks become more intelligent, the difficulty increases for traditional intrusion detection systems to detect advanced attacks that deviate from previously stored patterns. To solve this problem, a deep learning-based intrusion detection system model has emerged that analyzes intelligent attack patterns through data learning. However, deep learning models have the disadvantage of having to re-learn each time a new cyberattack method emerges. The time required to learn a large amount of data is not efficient. In this paper, an experiment was conducted using the Leipzig Intrusion Detection Data Set (LID-DS), which is a host-based intrusion detection data set released in 2018. In addition, in order to evaluate and improve the performance of the system, a host-based intrusion detection model consisting of pre-processing, vector-to-image processing, training and testing steps is proposed. In the training and testing steps, a Siamese Convolutional Neural Network (Siamese-CNN) is constructed using the few-shot learning method, which shows excellent performance by learning a small amount of data. Siamese-CNN determines whether the attack type is the same based on the similarity score of each cyberattack sample converted to an image. The accuracy was calculated using the few-shot learning technique. The performance of the Vanilla Convolutional Neural Network (Vanilla-CNN) and Siamese-CNN are compared to confirm the performance of Siamese-CNN. As a result of measuring the accuracy, precision, recall, and F1-score indicators, it was confirmed that the recall of the Siamese-CNN model proposed in this study increased by about 6% compared to the Vanilla-CNN model.

Modern maritime operations rely on diverse network components, increasing cybersecurity risks. While security solutions like Suricata generate extensive network alert logs, ships often operate without dedicated security personnel, requiring general crew members to review and respond to alerts. This challenge is exacerbated when vessels are at sea, delaying threat mitigation due to limited external support. We propose an Adaptive Threat Intelligence and Response Recommendation System (ATIRS), a small language model (SLM)-based framework that automates network alert log summarization and response recommendations to address this. The ATIRS processes real-world Suricata network alert log data and converts unstructured alerts into structured summaries, allowing the response recommendation model to generate contextually relevant and actionable countermeasures. It then suggests appropriate follow-up actions, such as IP blocking or account locking, ensuring timely and effective threat response. Additionally, the ATIRS employs adaptive learning, continuously refining its recommendations based on user feedback and emerging threats. Experimental results from shipboard network data demonstrate that the ATIRS significantly reduces the Mean Time to Respond (MTTR) while alleviating the burden on crew members, allowing for faster and more efficient threat mitigation, even in resource-constrained maritime environments.

Short-horizon collision–risk warning can use instantaneous assessment, forecast-then-assess, or direct prediction from encounter histories. We evaluate the third route with the Anticipatory TRAffic-context Collision–risk Transformer (ATRACT), which estimates the maximum near-future fuzzy Collision Risk Index (CRI) directly from own-ship kinematic and collision-geometry histories without trajectory rollout. Experiments use ten days of Automatic Identification System (AIS) data from the Danish straits, comprising 1.63 million decision windows. Using a vessel-day-track partition and five random initializations, ATRACT attains an area under the receiver operating characteristic curve (ROC-AUC) of $0.814\pm 0.003$, compared with $0.808\pm 0.006$ for the evaluated forecast-then-CRI baseline (VCRF) and 0.729 for instantaneous CRI. Thresholds fixed at a nominal 5% false-alarm rate (FAR) on disjoint calibration tracks yield test FARs of 4.98% and 5.38% for ATRACT and VCRF. Although seed-0 track-bootstrap intervals include zero at every evaluated offset, ATRACT shows 4.4–10.8 percentage points higher mean pre-onset detection across 0.5–4 min over five random initializations; VCRF detects more individual high-risk windows at this operating point. Four direct-risk encoders achieve a narrow ROC-AUC range of 0.813–0.819. These results support direct temporal interaction modeling as a viable route while limiting conclusions to the evaluated forecast-first implementations.