Securing Marine Assets: Edge ML and LoRa Mesh Integration for IoT Anti-Theft Systems

Abstract

This paper presents a maritime Internet of Things anti-theft architecture based on an ESP32 onboard node, local motion analysis, and LoRa mesh communication. The proposed detection pipeline uses a one-dimensional convolutional autoencoder trained on stationary vessel data and applied to sliding windows of X- and Z-axis angular velocity measurements. During deployment, a calibration phase estimates the reconstruction-error threshold from the local motion profile of the moored vessel, reducing the dependence on labelled theft examples. The communication layer combines an Elliptic Curve Cryptography setup phase with symmetric payload encryption for alert packets, while ESP32 hardware security features are used to protect firmware and stored credentials. The mesh network uses controlled flooding. A Godot-based simulation environment was used to generate stationary and towing scenarios under different wave configurations. In the current simulation campaign, towing windows produced a higher mean reconstruction error than stationary windows. The results support the feasibility of the architecture and also show that event-level alert logic is required to aggregate window-level anomaly scores into reliable alarms.

1. Introduction

The maritime industry, particularly the recreational boating sector, represents a vital component of the global “Blue Economy,” contributing significantly to tourism and economic development in coastal regions [1]. In recent years, Europe and North America have witnessed a steady increase in vessel registrations, reflecting a growing interest in maritime leisure activities. However, this growth has been accompanied by a persistent and evolving threat: boat theft. Maritime theft is a recognised but poorly harmonised crime category. The European Crime Prevention Network reports that no centralised EU-wide statistics are available, and only provides suggestions to prevent it [2], whereas the US National Insurance Crime Bureau recorded 4461 watercraft thefts in 2022, including 891 in Florida and 656 in California [3]. These figures illustrate both the relevance of the problem and the difficulty of making direct geographical comparisons. The economic impact extends beyond the value of the assets themselves, encompassing rising insurance premiums, loss of charter revenue, and significant strain on maritime law enforcement resources. This urgency is further amplified by the global transition toward Smart Ports. The digital transformation of harbour infrastructures heavily relies on pervasive sensor networks to optimise logistics and enhance physical security [4,5]. However, the rapid proliferation of maritime IoT devices has exponentially expanded the attack surface for malicious actors [6]. Securing these isolated aquatic nodes against both cyber interception and physical tampering remains one of the most critical bottlenecks in modern maritime digitalisation. Recent advancements in IoT technologies have successfully optimised urban mobility and asset management through the deployment of lightweight, multi-agent communication protocols. Notable examples include the ChirpPark architecture designed for connected vehicles [7,8] and related low-power frameworks for intelligent parking management [9].

Modern maritime security faces a unique set of challenges that distinguish it from terrestrial asset protection. Most recreational docks utilise breakwater infrastructure designed to attenuate wave energy, ensuring the physical stability of moored boats. Paradoxically, these calm waters provide an ideal environment for “silent” thefts. A common modus operandi involves perpetrators using small, low-profile inflatable boats to approach target vessels during nocturnal hours. Once a boat is identified, it is towed manually or with low-power electric motors toward open water, bypassing traditional shore-based surveillance systems that often suffer from blind spots or inadequate night-vision capabilities [10].

Many commercial anti-theft systems rely on the Global System for Mobile Communications (GSM), Wireless Local Area Networks (WLANs), or Global Positioning System (GPS)-based tracking. These technologies are useful near shore, but their reliability decreases when the vessel moves outside cellular or WiFi coverage, when the antenna is obstructed, or when the GPS signal is intentionally jammed. A typical low-speed towing event can therefore remain undetected until the vessel has already left the harbour perimeter. For this reason, an onboard node should be able to detect motion anomalies locally and transmit alerts through a communication channel that does not require continuous access to terrestrial infrastructure.

To address these connectivity gaps, researchers have turned to Low-Power Wide-Area Networks (LPWANs), specifically long-range (LoRa) modulation. LoRa offers an exceptional balance between range and power consumption, making it ideal for battery-powered onboard nodes. When integrated into a mesh topology, these devices can leverage nearby vessels as relays, effectively extending the communication range far beyond the reach of a single gateway [11]. However, existing LoRa-based maritime systems often prioritise environmental monitoring over real-time security. Moreover, the native lack of encryption in many ad hoc LoRa implementations exposes the network to “man-in-the-middle” attacks and packet sniffing, which could allow thieves to disable the system remotely or track the owner’s movements [12].

The integration of artificial intelligence at the network edge offers a transformative approach to asset protection and autonomous operation. By processing sensor data directly on the embedded hardware, Edge Machine Learning models eliminate the severe latency and bandwidth constraints associated with continuous cloud communication. This decentralised paradigm has recently demonstrated highly promising results across various IoT domains, extending from autonomous robotic platforms in precision agriculture [13] and multi-agent protocols for smart cities to complex maritime environments. In the specific context of vessel security, edge models can identify suspicious motion patterns such as the distinct acceleration profile of a boat being towed without requiring a continuous high-bandwidth link to a central server. Previous iterations of these systems relied on supervised classification models trained on static datasets, while effective in controlled environments, these models often suffer from a reality gap when deployed in the field. A static model trained on a specific boat type may fail to adapt to the unique hydrodynamics of a different hull design or the shifting wave patterns caused by local weather conditions, leading to unacceptable rates of false alarms.

This work investigates the system-level integration of adaptive edge anomaly detection, controlled-flooding LoRa alert propagation, maritime motion simulation, and embedded security mechanisms in an anti-theft proof of concept. The individual machine learning, cryptographic, and radio technologies used in the architecture are established; therefore, novelty is not claimed at the level of a new autoencoder, cryptographic primitive, or LoRa forwarding principle. The contribution lies in integrating these components for a maritime anti-theft use case and in evaluating selected parts of the resulting prototype under explicitly limited simulated and field conditions. The specific contributions and their validation status are as follows:

• Adaptive edge anomaly-detection pipeline: We implemented a one-dimensional convolutional autoencoder that processes sliding windows of X- and Z-axis angular velocity on an ESP32-based node. The detector derives its initial reconstruction error baseline from measurements collected after installation on the moored vessel. It was evaluated using simulated stationary and towing data and in a preliminary field campaign involving one vessel and ten controlled towing trials.
• Controlled-flooding LoRa alert propagation: We implemented a controlled flooding using duplicate suppression, a bounded time-to-live value, sequence identifiers, and retransmission jitter. The implementation was evaluated under direct and three-hop conditions using packet-delivery ratio and end-to-end latency.
• Godot-based maritime data-generation environment: We implemented a configurable simulation environment combining rigid-body vessel dynamics and Tessendorf-inspired wave synthesis to generate stationary and towing motion data [14]. Simulated stationary angular velocity was compared with measurements from one physical vessel to identify discrepancies such as sensor noise. This comparison provides a preliminary assessment of the simulation-to-reality gap.

The remainder of this article is structured as follows. Section 2 reviews related work in maritime IoT and edge intelligence. Section 3 details the proposed architecture. Section 4 delves into the new security and ECC protocols. Section 5 describes the upgraded simulation and wave modelling. Section 6 explains the unsupervised autoencoder and the calibration phase. Section 7 analyses experimental results, while Section 8 provides concluding remarks and future directions.

2. Related Works

The protection of maritime assets presents highly unique structural and environmental challenges driven by severe connectivity limitations and exposure to harsh atmospheric conditions. Traditional surveillance and tracking architectures predominantly rely on Global Positioning System coordinates transmitted via terrestrial telecommunication networks. To systematically contextualise the contributions of our proposed architecture, we review the existing literature across three primary domains: maritime communication networks, applied edge intelligence, and hardware-level cryptography.

2.1. Connectivity and Mesh Topologies in Maritime Environments

Researchers have extensively explored alternative communication frameworks to mitigate the inherent unreliability of standard cellular networks over water bodies. Early approaches attempted to combine satellite uplinks with localised radio frequencies, but these architectures incur prohibitive operational costs, significantly limiting their scalability for widespread recreational vessel deployment [15]. Conversely, docking stations utilising conventional WiFi or Bluetooth protocols lack the fundamental transmission range required to detect or monitor open water theft events.

Several studies, reported in

Table 1. Comparison with representative LoRa studies in maritime and harbour environments. Values are those reported by the cited studies and are not re-evaluated on a common testbed.

Reference	Scenario	Communication Result	Difference from the Present Work
[16]	Danish harbour; simulation and field test	Demonstrated the feasibility of LoRaWAN for low-rate harbour monitoring	Star-topology monitoring; no multi-hop theft-alert experiment
[17]	Lightweight boats; real deployment in the Port of Vigo	PDR above 97% with the most robust setting; range up to 4 km	Direct boat-to-base tracking; no edge anomaly detector or relay path
[18]	Passenger and research vessels; coastal and offshore field trials	More than 110 km in line of sight and more than 20 km in a coastal urban setting	Direct reception through elevated land gateways; no vessel-to-vessel forwarding
[19]	Harbour asset tracking; ns-3 simulation	Successful-reception probability above 85% for 500 nodes in a 2.5 km radius	Periodic asset traffic and simulated star topology
[20]	Fishing vessel and instrumented buoy; field deployment	Buoy-to-vessel communication up to 13 km through a vessel-mounted relay	One relay in the reported tests; cooperative multi-hop operation remains future work
[21]	Maritime buoy network; channel-aware simulation	Multi-hop protocols evaluated through PDR, latency, throughput, and traffic intensity	Rich routing analysis but no physical deployment or onboard theft detector
Present work	Moored-vessel alarm propagation; field test	PDR of 91% at 155.48 ms for the direct link and 88% at 477.62 ms for the three-hop path	Alarm-oriented controlled flooding on a mesh network

, have established that LoRa-based links are practical in ports and coastal waters. The authors of [16] combined a capacity simulation with a field test in a Danish harbour and found LoRaWAN suitable for low-rate harbour monitoring despite reflections and the presence of metallic structures. The [17] later deployed LoRa nodes on lightweight sailboats in the Port of Vigo. Their boat-to-base link reached a packet-delivery ratio above 97% with the most robust configuration, and the reported range study reached 4 km. Finally, the authors of [18] extended this evidence to operational marine routes in the Ligurian Sea. With gateways installed at elevated coastal sites, they reported reception beyond 110 km under line-of-sight conditions and beyond 20 km in a coastal urban setting. These trials demonstrate the potential of LoRa over water, but they rely on direct or multi-gateway reception rather than vessel-to-vessel forwarding.

Harbour-scale simulation studies expose a second issue: capacity depends on node density, reporting interval, and spreading-factor allocation. The work [19] simulated asset tracking in a smart harbour and obtained a probability of successful reception above 85% for 500 nodes distributed within a 2.5 km radius. This result is useful for periodic traffic tracking, whereas theft alarms require short, infrequent messages to survive even when the source has no direct path to the base station.

Recent maritime work has therefore considered relay and mesh extensions. The [20] implemented a vessel-mounted LoRaWAN relay and validated communication with a buoy at distances up to 13 km while the host fishing vessel operated offshore. The current implementation is a single-relay architecture; cooperation among several vessel-mounted relays is identified as future work. The authors of [21] proposed two decentralised multi-hop protocols for buoy networks and evaluated packet delivery, latency, throughput, and traffic intensity under simulated marine channel conditions. Their results support channel-aware multi-hop routing, although physical deployment was outside the scope of that study. The present work addresses a narrower operational case: a short theft alert is propagated inside a harbour by controlled flooding with duplicate suppression, a hop limit, and random forwarding jitter.

Consequently, LoRa modulation has emerged as a highly viable alternative for extensive coastal monitoring. Recent empirical studies evaluating long-range wide-area network architectures in coastal scenarios demonstrate substantial coverage improvements [22]. Furthermore, the development of advanced simulation tools for LoRa networks allows researchers to bridge the gap between theoretical network performance and real-world hardware integration, significantly accelerating the deployment of these technologies [23]. For instance, decentralised mesh deployments in port environments have successfully extended continuous network coverage by utilising vessel-to-vessel data relay. This capability enables critical alerts to propagate even when direct shore connectivity is completely severed. Despite these impressive transmission ranges, the vast majority of current long-range maritime implementations prioritise periodic environmental data collection over real-time theft response.

2.2. Edge Intelligence and Anomaly Detection

The paradigm of edge computing has revolutionised IoT security by relocating critical data processing directly onto the constrained microcontroller elements. To orchestrate the complex logic required by these distributed nodes efficiently, recent research has successfully introduced sophisticated declarative C++ platforms specifically tailored for agent-based edge computing [24]. This architectural evolution provides the necessary foundation for highly autonomous edge operations. In the specific context of maritime anti-theft systems, previous methodologies primarily utilised rudimentary threshold-based alerts or static supervised machine learning models to identify unauthorised towing patterns. However, supervised classifiers are highly constrained by the specific datasets utilised during their initial training phase. They exhibit significant performance degradation when deployed on vessel types or in port environments not represented in the training data, a phenomenon commonly referred to as the reality gap.

Recent advancements in industrial anomaly detection compared in

Table 2. Comparison with representative embedded anomaly-detection studies. Cross-study scores are descriptive only because the datasets, anomaly definitions, and units of analysis differ.

Reference	Model and Target	Embedded Result	Relevance and Limitation
[26]	Autoencoder; machine-vibration anomalies	7.5 KB model on Cortex-M4; accuracy and precision close to 80%	Confirms compact reconstruction-based inference, but not on marine motion
[27]	LSTM autoencoder; urban-noise anomalies	ESP32 inference in about 4 ms; reported accuracies of 99.99% and 99.34%	Same MCU class and unsupervised principle, but different sensors and anomaly distributions
[28]	Isolation forest; submerged industrial pump	On-device training and inference on an ESP32	Demonstrates local adaptation in a harsh, intermittently connected setting; not a convolutional model or a theft task
[29]	Memory-efficient CNN; industrial time series	Two-to-five-fold reduction in peak memory with negligible computational overhead	Addresses deployment efficiency rather than per-vessel calibration
Present work	Calibrated 1D convolutional autoencoder; gyroscope windows from a moored vessel	Field alarms in 5/5 lateral towing trials and 2/5 forward towing trials	Directly addresses towing, but the field campaign is limited to one vessel and ten controlled towing events

, advocate for unsupervised learning paradigms, specifically autoencoders, deployed at the network edge [25]. These sophisticated models compress multidimensional sensor streams into a lower-dimensional latent space and subsequently attempt to reconstruct the original input. Anomalous events, such as the distinct biomechanical forces exerted during an unauthorised towing operation, result in elevated reconstruction errors, while autoencoders are widely adopted in predictive maintenance for industrial machinery [25], their application in dynamically calibrating maritime anti-theft devices to localised wave behaviours remains a highly innovative approach.

A vibration-based autoencoder deployed on a Cortex-M4 occupied 7.5 KB and achieved accuracy and precision close to 80% on the reported machine dataset [26]. A LSTM autoencoder was instead used to detect point and collective anomalies in urban-noise streams; after quantisation, the models were deployed on an ESP32 and required approximately 4 ms per inference, with reported accuracies of 99.99% and 99.34% in the two sensor-specific experiments [27]. A different approach trained and executed an isolation forest on an ESP32 placed inside an underwater industrial pump [28]. This experiment is particularly relevant to inaccessible nodes because the complete pipeline, including adaptation to local data, runs on the device. Memory-oriented optimisation based on depthwise convolution and rescheduling has also reduced the peak memory required by CNN-based time-series anomaly detection by a factor of two to five on constrained industrial devices [29].

These results cannot be used as direct numerical baselines for the present detector. They concern urban sound, machinery vibration, or industrial process signals, use different anomaly definitions, and do not evaluate unauthorised towing. Their relevance is architectural: they show that reconstruction-based or one-class detection can be executed without a continuous cloud connection. The unresolved issue for a moored vessel is environmental variability. Normal motion depends on hull geometry, mooring configuration, local traffic, and sea state. The proposed calibration stage therefore learns a baseline for the individual boat after installation rather than applying one fixed threshold to every vessel.

2.3. Security and Cryptography in Edge Devices

LoRa modulation and LoRaWAN security should be distinguished. LoRa defines the physical radio link, whereas LoRaWAN adds network procedures and AES-based protection. Even with those mechanisms, implementation and key-management choices remain important. Replay, message-modification, delivery-report falsification, plaintext-recovery, and battery-exhaustion attacks were demonstrated in a controlled LoRaWAN environment in [30]. These results motivate explicit sequence checking, authenticated encryption, and careful key lifecycle management rather than reliance on radio obscurity.

Maritime authentication studies have mainly focused on protecting communication among network entities. An ECC-based, resource-conscious authentication scheme for an integrated space–air–ground–sea maritime network is presented in [31]. A lightweight authentication protocol for a 6G-IoT maritime transport architecture is instead analysed under a formal adversarial model in [32]. These schemes provide useful protocol-level references, but they do not remove the risk that a physically accessible end node exposes credentials through debug access or unprotected storage. Hardware-assisted security research addresses this second boundary through processor-supported roots of trust, protected execution, secure boot, and cryptographic acceleration [33].

The proposed design combines these two layers: ECDH is used during key establishment, alert payloads are protected with authenticated symmetric encryption, and the ESP32 security features are used to restrict firmware and credential extraction. This is a security-by-design contribution, not a claim of completed security certification.

The native lack of cryptographic enforcement within fundamental long-range physical modulation is a widely documented vulnerability. Threat actors can easily intercept unencrypted telemetry data to identify vulnerable vessels or orchestrate sophisticated replay attacks. To address these vulnerabilities, researchers have proposed various lightweight authentication schemes designed specifically for constrained IoT devices [34]. Specifically, ECC has gained significant traction due to its ability to provide robust public-key encryption with minimal computational overhead compared to traditional Rivest–Shamir–Adleman algorithms.

Nevertheless, purely software-based cryptographic enhancements fail to address the critical physical vulnerabilities inherent to widely dispersed maritime nodes. If an attacker gains physical access to a docked vessel, they can potentially extract symmetric encryption keys directly from the unprotected flash memory of the embedded hardware, compromising the entire mesh network. The pressing need for hardware-assisted security, utilising mechanisms such as encrypted memory allocation combined with ECC for secure public key exchanges, represents a significant research gap. Our proposed architecture systematically resolves this by securing all sensitive credentials at the silicon level.

2.4. Positioning of the Present Work

The comparison reveals a practical gap between the three research streams. Maritime LoRa studies have measured range, coverage, or relay performance but do not perform adaptive motion-anomaly detection on the vessel. Embedded anomaly-detection studies demonstrate feasible MCU inference but do not model vessel-specific wave and mooring conditions. Maritime authentication protocols protect message exchange, whereas the physical exposure of an unattended onboard node requires an additional hardware-protection layer. The contribution of the present work lies in joining these functions in one prototype and evaluating the detection and communication paths that carry a theft event from the gyroscope to the harbour base station.

3. Proposed Architecture

The proposed anti-theft framework is a decentralised, multi-tier IoT architecture. Local processing allows anomaly assessment to continue when cloud connectivity is unavailable, while the LoRa communication layer is intended to relay an alert towards a harbour gateway. By distributing computational workloads directly to the network edge and leveraging a resilient mesh topology, the system guarantees continuous monitoring and immediate alert generation even in the complete absence of terrestrial cellular infrastructure. The architecture comprises a personal mobile device, an embedded onboard node, a harbour docking station, and a cloud backend.

3.1. System Components

The structural foundation of the system relies on the seamless interaction between user-facing applications and edge computing hardware. The primary components shown in Figure 1 are defined as follows:

• Personal Mobile Device: Utilising a custom companion application, the user’s smartphone acts as the primary interface for system configuration. It utilises Bluetooth Low Energy to perform the initial cryptographic handshake and the secure configuration of the onboard hardware. Furthermore, the mobile application continuously broadcasts a localised beacon signal to support a proximity detection functionality. When the onboard node detects this specific beacon, it accurately infers the presence of the legitimate owner and automatically disarms the security protocols to prevent false-positive alarms.
• Embedded Boat Node: The core processing unit installed within the vessel is built around the ESP32 microcontroller, selected for its dual-core processing capabilities and robust hardware-level security features. The microcontroller interfaces directly with a sensor board to continuously sample spatial orientation and biomechanical forces. This node functions as an autonomous finite state machine, transitioning dynamically between armed, disarmed, and alert states based on the outputs of the localised artificial intelligence model.
• Harbour Dock Station: Deployed centrally within the port infrastructure, the dock station serves as the primary gateway bridging the decentralised LoRa mesh network with the standard internet protocol backbone. It receives, decrypts, and filters incoming alert packets, subsequently forwarding critical telemetry to the cloud backend for permanent logging and user notification.

The software architecture is designed to enforce hierarchical access control, clearly distinguishing between the prerogatives of the vessel owner and harbour security personnel. The user profile maintains full authority over the boat node, with the ability to register or remove devices, manually toggle the alarm status, and consult real-time telemetry during an emergency. Conversely, the dock keeper is provided with a collective monitoring interface to supervise the security status of all vessels moored within their jurisdiction. For security and privacy reasons, harbour personnel can trigger remote alerts for disarmed vessels but cannot interfere with the owner’s private security configurations. The backend serves as a trusted third party (TTP), not only coordinating data flow but also maintaining a historical log of time-stamped alarm events and packet-delivery status to support subsequent incident analysis. The proposed prototype is intended to detect anomalous vessel motion and disseminate an early warning. It does not estimate the vessel trajectory and is not intended to replace a GNSS-based tracking system.

3.2. LoRa Alert-Propagation Architecture

To overcome the severe geographical limitations of coastal communication, the onboard nodes organise into an ad hoc LoRa mesh network, which is simulated using the LWN simulator [23,35], while standard long-range wide-area network architectures excel with star topologies, scaling them in dense-port environments introduces significant collision overhead and packet loss due to uncoordinated trasmission collisions [36]. To mitigate these congestion issues and extend the effective operational range, decentralised mesh routing protocols have become essential. We opted for controlled flooding, which has been used by well-known decentralized mesh networks like Meshtastic and others that have demonstrated the capability of this routing technique in off-grid environments such as our case study.

3.3. Controlled Flooding

While standard flooding ensures high reliability, it introduces severe scalability issues in dense IoT deployments, such as broadcast storms and bandwidth waste. To guarantee network reliability while preserving channel availability, we implemented a controlled flooding mechanism incorporating specific mitigation strategies:

• Duplicate Suppression: To prevent infinite packet loops, every node maintains a temporal cache. Incoming alerts are checked against the cached messages to find any matching sequences and device identifiers. If a match is found, the packet is immediately discarded as a duplicate.
• Time-To-Live Limitation: To strictly bound the propagation of an alert and avoid congesting the network, each packet includes a 1-byte TTL that dictates the number of hops a packet can make.
• Jitter-Based Collision Avoidance: In a dense harbor scenario, multiple boats could receive alert signals simultaneously. To prevent destructive behavior from simultaneous relays, nodes generate a random delay time before retransmission. If the node hears the same packet being relayed by a neighbor before the delay expires, it cancels its own transmission.
• Latency Considerations: Multi-hop routing inherently introduces end-to-end latency. However, while a worst-case scenario such as a linear chain of vessels may maximize a hop-induced delay, actual harbors typically form highly interconnected mesh networks.

The current workflow of the network is as follows: when an alert is generated, the originating node assigns a unique identifier composed of its device identifier and sequence number to the packet. The packet is then transmitted to neighboring nodes. Upon reception, it verifies whether the packet has already been processed by consulting its local cache. If the packet is identified as a duplicate, it is discarded. Otherwise, the node saves the packet identifier and sequence in the cache, decrements the TTL field, and schedules a retransmission after a randomly selected Jitter interval. During this waiting period, the node continuously monitors the channel for the same packet being transmitted by another neighbor. If such transmission is detected, the pending retransmission is cancelled, since the packet has already been propagated. This process is repeated at each subsequent hop until the TTL reaches zero.

4. Security Protocol and Hardware Cryptography

Earlier prototypes used a simpler symmetric-key setup. This approach is lightweight, but it creates a practical weakness if the same long-term key is reused across multiple nodes or stored in unprotected flash memory. The revised design separates the setup phase from packet encryption: the mobile device and the boat node establish shared key material during provisioning, while the ESP32 security features are used to limit extraction or unauthorised replacement of firmware and stored credentials.

4.1. ECC Handshake

To establish a secure communication channel without exposing sensitive credentials, the initial configuration between the mobile application and the onboard node utilises ECC [37]. During the primary setup phase, both the smartphone and the ESP32 microcontroller generate independent private and public key pairs using the highly secure secp256r1 curve.

Let $d_A$ and $d_B$ represent the randomly generated private keys for the mobile device and the onboard node, respectively. Their corresponding public keys, $Q_A$ and $Q_B$, are computed via scalar multiplication with the elliptic curve base point G, such that $Q_A=d_A\times G$ and $Q_B=d_B\times G$. Over the Bluetooth Low Energy connection, the devices exchange only their public keys. Utilising the elliptic curve Diffie–Hellman key agreement protocol, both entities independently derive an identical shared secret S:

$$S=d_A\times Q_B=d_A\times (d_B\times G)=d_B\times (d_A\times G)=d_B\times Q_A$$

(1)

This mathematically guarantees that the shared secret is established securely, even if a malicious actor completely intercepts the Bluetooth communication channel, as deriving the private keys from the intercepted public keys requires solving the computationally infeasible elliptic curve discrete logarithm problem.

4.2. Payload Encryption via Advanced Encryption Standard

The derived shared secret S is subsequently passed through a cryptographic key derivation function to generate symmetric session keys for network communication. To minimise computational latency while ensuring both data confidentiality and integrity over the long-range network, the actual alert payloads are encrypted utilizing the Advanced Encryption Standard operating in Galois/Counter Mode (AES-GCM). Unlike Counter Mode (CTR), which provides only confidentiality, AES-GCM is an authenticated encryption scheme that leverages a cryptographic nonce and an incrementing counter to generate a unique keystream for encrypting the plaintext payload P. It uses a universal hash function over a binary Galois field to compute an authentication tag T. The ciphertext C and the authentication tag T are produced as follows.

$$(C,T)=\mathrm{AES-GCM}(K_{sym},\mathrm{Nonce},P,\mathrm{AAD})$$

(2)

This approach ensures that each payload is uniquely bound to a nonce for every encryption performed with the same symmetric key. Consequently, identical payloads encrypted multiple times produce different ciphertexts and authentication tags. Any modification of either the encrypted payload or the associated authentication tag is detected during decryption, causing the packet to be rejected.

The encrypted alert data is transmitted across the mesh network using a compact 35-byte packet structure designed for high reliability in constrained bandwidth scenarios. As illustrated in Figure 2, the packet consists of a 4-byte device identifier of the origin node, a 4-byte device identifier of the transmitting node, a 4-byte sequence used for cryptographic purposes and to reject duplicates, a 1-byte TTL, an 8-byte payload, and a 12-byte authentication tag. The TTL field limits the maximum number of forwarding hops, preventing uncontrolled packet propagation within the mesh network. The encrypted payload contains the protected telemetry data, while the AES-GCM authentication tag provides integrity verification and ensures that modified or forged packets are detected and discarded by receiving nodes. Last but not least, 2 bytes are used for CRC purposes.

4.3. Silicon-Level Protection and eFuse Memory

The integration of silicon-level protections resolves a vulnerability of distributed IoT nodes. Traditional software-level obfuscation is increasingly vulnerable to sophisticated side-channel attacks and direct memory dumping techniques [38]. If a vessel is boarded, an attacker might attempt to interface directly with the serial debugging ports of the ESP32 to dump the unprotected flash memory and extract the symmetric session keys. Consequently, integrating hardware roots of trust, such as physical unclonable functions or electronically blown fuse matrices, has become an imperative standard for secure remote IoT deployments.

To mitigate this issue, we utilise the embedded eFuse technology native to the ESP32 architecture [39]. During the factory programming phase, all critical network credentials, the uniquely generated private keys, and the bootloader signatures are written directly into a bank of microscopic electronic fuses. Once written, these specific eFuses are permanently blown via an irreversible hardware voltage spike. This physically locks the memory region, ensuring that the keys can be read internally by the cryptographic hardware accelerator for encryption tasks, but it can not be extracted, read via software, or accessed through external debugging interfaces. Furthermore, this silicon-level lock prevents malicious firmware flashing, ensuring the integrity of the anti-theft logic remains uncompromised throughout the lifecycle of the device.

4.4. Initial Setup and Proximity Detection

In addition to the advanced cryptographic protections, the system incorporates operational proximity logic based on the Bluetooth Low Energy (BLE) protocol. The initial configuration of the boat node is performed through a two-way handshake involving specific messages: REQUEST CONNECTION and CONFIRM REQUEST. Once trust is established, a 67-byte setup message is transmitted, containing the necessary data for system initialisation.

The configuration details are encapsulated within a specifically structured 67-byte frame, as shown in Figure 3. This setup message is critical for synchronising the onboard node with the user’s geographical and security parameters. The packet includes a 4-byte device identifier, followed by 16 bytes dedicated to the initial latitude and longitude coordinates. To establish the secure communication mesh, the frame carries 33 bytes representing the public key of the user. Furthermore, an 8-byte timestamp is included for temporal synchronisation, along with the 6-byte media access control address of the personal device. During the same initialisation phase, the boat node transmits its own public key to the user, allowing ECDH key agreement and derivation of a shared secret. This comprehensive exchange ensures that the boat node is fully provisioned with the metadata required to operate autonomously within the harbour environment.

To reduce false alarms, we used a proximity detection mechanism that takes advantage of BLE technology to detect the user’s mobile device. Once in range, the device is broadcasting its unique UUID. The onboard microcontroller detects this specific signal and generates a one-time-use nonce that is sent over BLE to the user’s mobile device. This nonce is then signed with the previously established shared secret and sent back to the microcontroller that verifies the signed nonce. If the signature is validated, the microcontroller suspends anomaly detection routines.

5. Environment Simulation and Wave Modelling

A fundamental challenge in developing highly accurate anomaly detection systems for maritime security is the extreme scarcity of labelled datasets representing actual theft events under diverse meteorological conditions. Gathering physical data for every conceivable boat geometry, weight distribution, and sea state is practically impossible and prohibitively expensive. To bridge this critical data gap, we engineered a generalised physics simulation framework capable of synthesising high-fidelity biomechanical sensor data, extending the baseline architecture provided by [40].

5.1. Generalized Hydrodynamic Framework

Previous iterations of this research relied on highly specific, rigidly defined three-dimensional boat models. This approach severely limited the generalisation capabilities of the resultant artificial intelligence models. In this updated architecture, we transition to a generalised hydrodynamic simulation environment, shown in Figure 4, utilising the open-source Godot engine [41]. This approach effectively creates a digital twin of the vessel, a virtual modelling paradigm increasingly utilised to advance scalable, adaptive, and highly responsive robotic systems [42]. The new framework abstracts the vessel into a highly customisable rigid body entity. This allows researchers to dynamically adjust mass, frontal area, and centre of gravity to simulate a vast array of recreational vessels, ranging from lightweight rubber dinghies to heavy multi-deck yachts [43].

The core physical interactions are governed by four primary simulated forces acting upon the rigid body:

• Wave Displacement Force: The local vertical displacement of the water mesh is sampled at multiple boundary points along the hull of the simulated vessel. By analysing the temporal derivative of these spatial coordinates, the engine accurately applies localised drag and pull effects dictated by the ascending or descending phases of the underlying ocean waves.
• Dynamic Buoyancy: A continuous upward force vector is calculated dynamically based on the submerged volumetric profile of the vessel at any given simulation frame, ensuring highly realistic floating mechanics.
• Friction and Drag: To simulate the precise biomechanical resistance encountered during an unauthorised towing event, the engine applies friction forces proportional to the linear velocity and the configurable frontal area of the vessel.
• Towing Torque: During a simulated theft scenario, an external directional force is applied to the front cleat of the vessel, generating a realistic torque that directly influences the onboard gyroscope sensors.

5.2. Tessendorf Ocean Synthesis

To generate realistic ocean surface displacement, the simulation engine implements a mathematical wave model heavily inspired by the seminal research of Tessendorf [14]. Simple sine waves or standard Gerstner waves are insufficient to replicate the chaotic nature of harbour waters. Instead, our system utilises statistical wave models combined with the Fast Fourier Transform.

The surface height field is generated by calculating the Fast Fourier Transform representation of the ocean surface. The vertical wave height $h(\mathbf{x},t)$ at a specific horizontal position $\mathbf{x}=(x,z)$ and time t is expressed as the summation of numerous sinusoidal waves with complex, time-dependent amplitudes:

$$h(\mathbf{x},t)=\sum _{\mathbf{k}}\tilde{h}(\mathbf{k},t)e^{i\mathbf{k}·\mathbf{x}}$$

(3)

where $\mathbf{k}$ represents the two-dimensional wave vector governing the direction and frequency of the simulated swell. As depicted in the simulation configuration parameters, the system offloads the intensive calculation of these displacement textures directly to the Graphics Processing Unit. This ensures a stable operational frequency exceeding thirty updates per second. The simulation environment, as shown in Figure 5, permits fine-grained control over critical meteorological parameters, including wind speed, fetch length, swell intensity, and spread, allowing the generation of highly diverse synthetic datasets representing conditions from calm harbour nights to severe storms.

The simulation environment provides a sophisticated graphical user interface to fine-tune the physical behaviour of the water surface. As shown in Figure 5, by increasing the wind speed parameter to 20 m per second and utilising overlapping wave cascades, the engine generates a complex surface displacement field characterised by clashing currents and increased whitecap formation. This high-energy state provides a rigorous testing ground for the unsupervised model, ensuring that the system can distinguish between legitimate environmental turbulence and the specific kinematic signature of an unauthorised towing event, even when the vessel is subjected to significant external hydrodynamic stress. As illustrated in Figure 6, the system allows for the precise configuration of wave cascades, wind speed, and fetch length. For the specific purpose of this research, we selected a set of engine-specific parameters to instantiate a calm-water baseline scenario representative only of the conditions considered in the present simulation campaign or environments protected by breakwater infrastructure. These settings are crucial for the initial calibration phase, as they represent the baseline environmental noise that the autoencoder must learn to reconstruct with high fidelity.

To evaluate the resilience of the anomaly detection model under extreme conditions, the simulation environment was utilised to synthesise rough sea scenarios where multiple wave currents converge.

6. Edge ML and Anomaly Detection

The transition from supervised classification to unsupervised anomaly detection represents a major paradigm shift in our proposed security architecture. Supervised models fundamentally require labelled examples of both normal and anomalous data. However, predicting the exact biomechanical signature of every possible theft configuration is impossible. Consequently, static models deployed in dynamic environments suffer from a severe reality gap, resulting in unacceptable false positive rates.

6.1. X and Z Angular Velocity Components as Input Features

To capture the dynamic behaviour of the vessel, the onboard sensors continuously sample data at a frequency of 5 Hz. The present prototype uses angular-velocity measurements as its only model inputs. Accelerometer data were not included because the available field campaign did not provide a sufficiently representative acceleration dataset for characterising wave-induced translational motion and sensor noise. Relying only on the cleaner simulated acceleration signals could have underestimated the simulation-to-reality gap. Therefore, the exclusion of accelerometer data should be interpreted as a limitation of the current experimental scope rather than as evidence that acceleration is intrinsically less informative than angular velocity. While gyroscope values are also subject to noise, they are more self-contained (or independent).

The Figure 7 show a reference of simulated boat axis inside the simulation. The data in Figure 8 were collected under various environmental conditions. The measurement includes both stationary phases, with calm or rough seas, and instances with an anomalous drag force applied to the boat. Since the Y axis runs along the longest part of the hull, it consistently bounces and oscillates. In contrast, the X and Z axes have much cleaner and more stable statistical distributions. This makes them more reliable and better suited as input features. An ablation study was carried out in order to empirically verify the exclusion of the angular velocity in the Y-axis, this involving a comparison between the anomaly detection model trained on the complete spatial dataset ($v_x,v_y,v_z$) and one trained on the reduced dataset ($v_x,v_z$). The findings from the low-intensity towing situations show that the bi-axial model attains a better event coverage of 67.2%, as opposed to 55.9% for the tri-axial model. The inclusion of the highly variable third axis effectively reduces the reconstruction error and thus masks the anomaly. The explanation of the coverage metrics can be found in Section 6.9.

6.2. Model’s Input Space

Once the two channels X and Z as shown in Figure 8, have been taken, it is necessary to define how these are passed to the model. Since it is necessary to analyse anomalous variations in a short period of time (application of a pulse), it was chosen to pass two buffers to the model, into which the measurements of X and Z are inserted in temporal order as represented in Figure 9. In fact, the buffer behaves like a sliding window.

6.3. One-Dimensional Convolutional Autoencoder

To achieve robust, generalised theft detection, we propose the implementation of an unsupervised autoencoder deployed directly on the embedded onboard hardware. An autoencoder is an artificial neural network trained to compress high-dimensional input data into a constrained latent space representation and subsequently reconstruct the original input from this compressed state. The deployment of complex neural architectures directly onto resource-constrained microcontrollers falls under the rapidly emerging paradigm of Tiny Machine Learning. This decentralised approach drastically reduces communication latency, preserves data privacy, and minimises power consumption compared to traditional cloud-reliant inference models [44,45]. In the context of maritime anomaly detection, executing the learning algorithms directly on the ESP32 ensures that the vessel remains fully protected even during prolonged periods of network isolation. Given the sequential nature of the X- and Z-axis gyroscope readings, our architecture utilises a one-dimensional convolutional neural network [46]. Convolutional layers are exceptionally proficient at extracting localised temporal features and underlying frequency patterns from continuous sensor streams, far outperforming standard dense architectures.

The proposed network structure, described in

Table 3. Architectural summary, detailing layer sequence, output dimensions, and trainable parameters.

Layer (Type)	Output Shape	Param #
InputLayer	(10, 2)	0
GaussianNoise ($\sigma =0.15$)	(10, 2)	0
Conv1D (16 filters, kernel 3)	(10, 16)	112
MaxPooling1D (pool_size 2)	(5, 16)	0
Dropout (rate 0.2)	(5, 16)	0
Conv1D (8 filters, kernel 3)	(5, 8)	392
UpSampling1D (size 2)	(10, 8)	0
Conv1D (16 filters, kernel 3)	(10, 16)	400
Dropout (rate 0.2)	(10, 16)	0
Conv1D (2 filters, kernel 3)	(10, 2)	98
Total trainable parameters		1002
Model size (memory)		≈3.91 KB

and Figure 10, consists of an encoder phase and a decoder phase. The encoder utilises consecutive one-dimensional convolutional layers followed by max pooling operations. The max pooling layers systematically reduce the spatial dimensions of the feature maps, effectively compressing the time series data into a dense latent representation. The decoder mirrors this architecture, utilising upsampling operations followed by convolutional layers to reconstruct the temporal sequence back to its original dimensionality.

6.4. Reality Gap

The main issue with this project concerns the accuracy of the data obtained during the simulation. It is neither computationally nor practically possible to replicate every physical detail in a simulated environment, for example, the inherent electrical noise of the sensors or the different surface conditions and weights of various vessels. After carrying out real-world experiments, which will be examined in more detail in Section 7, we took stationary measurements from a physical boat that had similar characteristics, particularly with regard to its weight and hull shape, in order to compare the data gathered in both environments.

Figure 11 shows that the simulated data does not have the distinctive high-frequency noise that is characteristic of physical inertial sensors, even though the normalized values are within about the same range. In order to reduce this discrepancy and deal with the resulting covariate shift, Gaussian noise was deliberately added to the training dataset. This data augmentation technique improves the model’s ability to generalize, thus making it remain robust and reliable when used in real-world situations (the resulting means and standard deviations are reported in

Table 4. Statistical comparison of the angular velocities in the various datasets, pointing out the greater variance and environmental noise that are present in measurements taken by physical sensors. Notably, the data from the simulated boat has more measurements close to zero. This difference is due to both the fact that the simulation does not include real-world environmental noise and the difference in dimensions when compared to the actual vessel.

Dataset	Mean	Std. Dev.	5th Percentile	95th Percentile
X-Axis Angular Velocity (gx_dps)
Synthetic data	−0.0016	0.0385	−0.0715	0.0721
Real data	−0.0492	0.8934	−1.5350	1.3070
Z-Axis Angular Velocity (gz_dps)
Synthetic data	−0.0046	0.0457	−0.0838	0.0772
Real data	−0.0175	0.2168	−0.3950	0.3470

).

6.5. Model Training Parameter

In order to ensure full reproducibility, the exact configurations and hyperparameters employed during the training process are given in

Table 5. Detailed hyperparameters, dataset configurations, and architectural parameters of the proposed autoencoder.

Category	Parameter	Value
Input	Shape	(10, 2) 10 timesteps, 2 channels (Vel_X, Vel_Z)
	Preprocessing	zero-padding (‘same’)
Dataset	Split	80% train, 20% test (sequential, shuffle = False)
Training	Optimizer	Adam (initial LR = 0.005, min LR = $1\times {10}^{-6}$)
	Scheduler	ReduceLROnPlateau (factor = 0.5, patience = 5)
	Batch Size/Epochs	16/100
	Threshold	98th percentile of training MSE
Deployment	TF Lite Optimization	DEFAULT
	Export Format	C-byte array header (.h file)

. Before windowing, the raw gyroscope data (on the X and Z axes) were normalized. The dataset was split sequentially (80% for training and 20% for testing) without any shuffling in order to strictly maintain the temporal integrity of the time series. The model was compiled using the Adam optimizer with an initial learning rate of 0.005 and with the mean squared error (MSE) loss function, with ReLU activation. The following MSE mathematical formulation was used:

$$\mathrm{MSE}={\displaystyle \frac{1}{N}}{\displaystyle \sum _{i=1}^N}{(X_i-{\widehat{X}}_i)}^2$$

(4)

In order to reduce the reality gap, a Gaussian noise layer with a standard deviation of 0.15 was added directly to the input, together with Dropout layers (at a rate of 0.2) inside the network. To ensure optimal convergence, a ReduceLROnPlateau learning rate scheduler was used, reducing the learning rate by half if the loss remained stable for five consecutive epochs and lowering it down to a minimum value of ${10}^{-6}$. After 100 epochs having been completed with a batch size of 16, the anomaly detection threshold was determined statistically as the 98th percentile of the training MSE distribution. The model was then optimised using TensorFlow Lite and exported in the form of a C-byte array header file, including the scaler means and the threshold, in order to meet the ESP32 microcontroller’s strict memory limitations.

Figure 12 illustrates the convergence behavior during the training phase. The MSE value stabilizes around epoch 50 at approximately 20. To refine the model further, the learning rate scheduler reduces the learning rate, allowing for a more precise optimization. Since overfitting on the training data is a primary concern in such scenarios, the implementation of Dropout layers was necessary to effectively regularize the training process.

6.6. Calibration Procedure and Operational Recalibration Policy

The implemented calibration procedure consists of two stages. First, the inertial sensors undergo a 20 s static calibration while the device is placed on solid ground. This stage estimates the sensor offsets and compensates for systematic acquisition errors. The resulting offsets are stored on the device. This calibration is repeated only after sensor replacement, physical remounting, or a modification of the sensor orientation.

After the device is installed on the vessel, a second 20 s onboard calibration is performed while the boat is moored. At the sampling frequency of 5 Hz, this phase collects 100 measurements of the autoencoder reconstruction error. These observations initialise the adaptive reference value under the resting motion conditions of the vessel. Initial commissioning therefore requires two 20 s acquisition stages: one on solid ground and one after installation on the vessel.

The adaptive reference value is updated using an exponentially weighted moving average (EWMA):

$$T_t=\alpha ·{\mathrm{MSE}}_t+(1-\alpha )·T_{t-1},$$

(5)

where ${\mathrm{MSE}}_t$ is the reconstruction error of the current window and $T_t$ is the updated reference value. During the onboard initialisation, $\alpha$ is set to 0.03. After 100 samples, the residual contribution of the initial value is

$${(1-0.03)}^{100}=0.0476,$$

(6)

meaning that approximately 95.2% of the resulting estimate is determined by the measurements collected during the onboard calibration.

During continuous monitoring, $\alpha$ is reduced to 0.001. At a sampling frequency of 5 Hz, this corresponds to an approximate EWMA time constant of

$$\tau \simeq {\displaystyle \frac{1}{\alpha f_s}}={\displaystyle \frac{1}{0.001\times 5}}=200\mathrm{s}.$$

(7)

Approximately 95% of the response to a persistent gradual change is reached after about 599 s, or approximately 10 min. These values describe the analytical adaptation rate of the implemented estimator and not an experimentally demonstrated response to every possible environmental change.

The EWMA update is suspended whenever the reconstruction error exceeds the alarm threshold or the system enters the alert state. This prevents an ongoing towing event from being immediately incorporated into the resting baseline. Nevertheless, this mechanism does not guarantee correct adaptation following an abrupt environmental change. For example, a severe storm may produce reconstruction errors that exceed the current threshold and temporarily activate the alert logic.

The intended recalibration policy is therefore event-triggered rather than based on a fixed time interval. The static sensor-offset calibration must be repeated after sensor replacement, physical remounting, or a change in sensor orientation. The onboard environmental baseline must be reinitialised after moving the vessel to a different marina, changing its mooring configuration, or observing a persistent displacement of the resting reconstruction-error distribution, including after a severe weather event. Long-term threshold stability and the frequency of these recalibration events remain to be quantified through multi-vessel and multi-season deployments.

6.7. Anomaly Scoring and Detection Logic

The model processes data through a continuous sliding window mechanism to ensure seamless temporal monitoring. At each sampling interval, a window of size k (where $k=10$) containing samples $x_i,x_{i+1},\dots ,x_{i+n}$ is passed to the autoencoder. In the subsequent iteration, the window advances by a single element, processing samples $x_{i+1},x_{i+2},\dots ,x_{i+k-1}$. This overlapping approach allows the system to capture fine-grained transitions in motion patterns that a discrete windowing method might overlook. Following calibration, the system transitions into active monitoring mode. For every new sequence of gyroscope data X, the autoencoder generates a reconstruction $\widehat{X}$. The system calculates the reconstruction error using the where N represents the length of the input sequence. Because the network was trained solely on normal resting data, it accurately reconstructs wave-induced oscillations, resulting in a very low MSE. However, if a thief attempts to tow the vessel, the sudden, continuous directional acceleration introduces a novel kinematic pattern. The autoencoder, having never observed this specific temporal signature, fails to reconstruct it accurately, causing the MSE to spike dramatically. When this error mathematically exceeds a dynamically calculated threshold derived from the calibration phase, the node immediately registers a definitive anomaly and initiates the LoRa mesh alert protocol.

To avoid false alarms, we employ a persistence logic. Upon the initial detection of an anomaly, we wait for a complete window refresh,

$$\mathrm{from} X_i,\dots ,X_{i+k} \mathrm{to} X_{i+k+1},\dots ,X_{i+2k}.$$

The alarm will be set off if the model identifies an anomaly for at least half of the window. This method is especially beneficial in this situation because of the sparse way in which the model detects anomalies, making it more effective than assessing a continuous sequence.

6.8. Model Test on Different Environments

Every simulation restarts after 10 s, and the device has the sampling rate of 5 Hz. The randomness is applied on wind angulation and speed, thief relative position and thief angulation and speed.

As shown in Figure 13, the first figure shows the case of an anomalous towing situation, where the MSE clearly exceeds the 98th percentile limit. The second figure represents the stationary phase, marked by an MSE that stays well below the alert level, while there are occasional false positives. To avoid false alerts, it is possible to apply a persistent rule on the device.

6.9. Data Redundancy and Chosen Metrics

Sliding windows naturally create some redundancy, since a single towing event can be caught multiple times across the sequence (K times, based on the window size). Relying on traditional, point-wise metrics like accuracy here can be misleading, as long stretches of stationary data heavily skew the balance. To get around this, we focused on a more practical, event-centric coverage view: a data point counts as ’detected’ as long as it falls inside at least one flagged window. On an individual window level, the model picks up 68% of the anomalous or mixed frames recall) while keeping the false-positive rate down to 5% which specifically represents purely stationary windows triggering a false alarm yielding a solid F1-score of 0.78. A 68% detection rate on a single-window basis might sound modest at first glance, but it works exceptionally well in the field. Because any real towing event stretches across dozens of back-to-back windows, this built-in overlap gives the system plenty of margin for its persistence logic to sound the alarm reliably without flooding the user with false alerts.

6.10. Detection Limitation Under Low-Dynamics Forward Towing

The gyroscope-only detector observes rotational motion rather than direct translational displacement. Consequently, a vessel towed slowly and approximately along its longitudinal axis may exhibit only weak angular disturbances, particularly under calm-water conditions. This limitation was observed during the preliminary field campaign: the detector generated an alarm in all five lateral-towing trials but in only two of the five forward-towing trials. The current prototype should therefore not be interpreted as providing guaranteed detection for every towing geometry. Additional sensing modalities may improve sensitivity to low-dynamics longitudinal motion, but they were not experimentally evaluated in the present study.

7. Experiments and Validation

To test our system in the real world (Figure 14), we deployed the experimental setup in the busy harbor of Riposto, which is located in Sicily (Italy), in the surrounding of Catania. We utilized a physical vessel that corresponded in type and hull shape to our simulated model and characteristics described in

Table 6. Physical characteristics of both vessels.

Parameters	Real Boat	Simulated Boat
Size	8.93 × 2.99 m	18 × 7 m
Weight	5.4 t	10 t
Type	Motorcraft	Daycruiser

.

Testing began immediately while the boat was still securely moored, which gave us the perfect opportunity to run our initial system calibrations.

We observed the kinematic behavior of the boat in three different conditions: resting naturally (our baseline), being towed from the side (the standard anomaly) and being towed straight forward (our worst-case anomaly). The data that we collected during these phases were instrumental in the validation of the framework we had simulated. Interestingly, the raw data did cause a few false alarms initially during the resting phase, but the persistence logic that we introduced in Section 6.7 filtered out these natural wave variations and kept the system perfectly quiet when it needed to be.

To safely perform the actual towing maneuvers without endangering nearby boats, we relocated to a wider area. Using a smaller support vessel, we conducted a total of 10 active towing tests: 5 lateral and 5 forward. Because our model is highly sensitive to sudden signal peaks, it flawlessly caught all five lateral towing attempts. Forward towing is naturally harder to spot, but the system still managed to trigger the alarm in two out of the five attempts thanks to the subtle “flattening” effect that a steady forward pull leaves on the sensor readings.

Figure 15 shows the difference in behavior between the anomalous cases and the stationary baseline; furthermore, an increase in the frontal towing MSE due to the aforementioned reasons is clearly visible. It is important to note that, due to our persistence logic, which requires confirming anomalies across multiple consecutive windows to avoid false triggers, the actual alarm is raised approximately 20 s after the first anomalous measurement is received. While this introduces a minor delay, it is an intentional trade-off that ensures high operational stability without compromising safety.

7.1. Prototype Performance

The hardware was chosen using high-performance, low-power components. The core of the system is the Arduino Nano ESP32, selected for its ability to handle complex calculus and wireless communication in parallel due to its dual-core architecture. Considering all the components and the library, the peak RAM usage is 40 KB. Based on empirical testing, the arena size was set to 4 KB. The average inference time is around 9.17 μs (with 0.9 μs of standard deviation). The estimated energy consumption is calculated based on the inference time:

$$C={\displaystyle \frac{50\mathrm{mA}\times 9.17\times {10}^{-6}\mathrm{s}}{3600\mathrm{s}/\mathrm{h}}}\approx 1.27\times {10}^{-7}\mathrm{mAh}$$

(8)

“50 mA” stands for the average microcontroller absorption.

7.2. Mesh Network Propagation and Performance

To evaluate the propagation performance of the proposed LoRa mesh network, a network field test was conducted, with the network nodes being positioned at approximately the distances described in

Table 7. Distances between the base station and boats in the real experiment, conducted in the Harbour of Riposto, Sicily, Italy.

Origin	Destination	Distance
Base Station	Boat in Normal Status 1	540 m
Boat in Normal Status 1	Boat in Normal Status 2	820 m
Boat in Normal Status 1	Boat in Alarm	2.38 Km
Boat in Normal Status 2	Boat in Alarm	2.11 Km
Base Station	Boat in Alarm	2.69 Km

:

The test was conducted by having the nodes distributed as shown in Figure 16 and synchronised with an NTP server. Two representative conditions were identified during the test. The best ones were instances where the stolen device was able to communicate with the base station, resulting in a single-hop communication over the test distance. The communication was therefore completed without requiring any intermediate forwarding operation, and we were able to collect the data in

Table 8. Metric of an end-to-end communication between two nodes.

Metric	Mean ± Std	Min	Max
RSSI (dBm)	−92.07 ± 2.36	−97.00	−88.00
SNR (dB)	6.03 ± 1.21	3.81	8.73
Latency (ms)	155.48 ± 10.89	122.59	193.53
PDR	91%
Total Messages sent	468

. On the other hand, the worst-case scenarios were the ones that had the stolen device unreachable by the base station and required propagating the message through the other nodes, thus resulting in a communication path consisting of three hops, as shown in

Table 9. Metric of a communication with three hops.

Metric	Mean ± Std	Min	Max
RSSI (dBm)	−69.55 ± 2.16	−77.00	−65.00
SNR (dB)	10.62 ± 0.95	8.63	12.59
Latency (ms)	477.62 ± 53.47	319.43	622.85
PDR	88%
Total Messages Sent	475

.

As shown in Table 8, the direct single-hop communication has an average latency of 155.478 ms over a distance of 2.69 km and a packet-delivery ratio of 91%. Although the signal strength metrics indicate a relatively distant connection. the link remains stable.

Table 9 details the performance of a worst-case three-hop routing path. The most significant impact of multi-hop propagation is observed in the end to end latency, which increases to 477.62. This increase is an expected consequence of the cumulative processing. Despite the extended path, the network maintains a PDR of 88%.

The results obtained during the field test demonstrate that the proposed network is capable of alarm-message propagation under both direct and multi-hop communication. In particular, the best case, where the alarm node can directly communicate with the base, represents the intended operating condition of the proposed system. The primary objective of the LoRa mesh network is not to be a long-range communication system between vessels, but rather a means to promptly disseminate a theft alert from a vessel to the monitoring infrastructure or to the competent authorities once the event is detected. In the target deployment scenario, this communication is expected to occur over significantly shorter distances, such as within the harbour, where the relevant coverage area is typically limited to a few hundred metres. The long-range supported communication should only be seen as a fallback, providing additional robustness in the unlikely case that the perpetrators can exit the harbour.

8. Conclusions and Future Outlook

This research has presented a significant technological advancement in the field of maritime security through the development of an intelligent, decentralised, and hardware-hardened anti-theft system. The primary objective was to overcome the inherent limitations of traditional surveillance systems, which frequently fail in offshore environments due to signal attenuation, global positioning system jamming, or the lack of cellular infrastructure. By integrating edge-based artificial intelligence with a resilient LoRa mesh topology, this work establishes a robust framework for the protection of high-value maritime assets.

A pivotal contribution of this study is the paradigm shift from rigid supervised classification to an adaptive, unsupervised anomaly detection methodology. The implementation of a one-dimensional convolutional autoencoder allows the system to bypass the limitations of the “reality gap” that typically plagues simulated machine learning models. Through the newly introduced initial calibration phase, each onboard node is capable of learning the unique “kinematic signature” of the specific vessel and its local environment. In the preliminary single-vessel field campaign, the detector identified all five lateral-towing events and two of the five forward-towing events. These results demonstrate sensitivity to lateral towing while also confirming a remaining limitation under low-dynamics forward towing. Given the limited number of trials, the reported values should be interpreted as preliminary feasibility results rather than as an estimate of general deployment performance.

The ESP32 implementation showed that the autoencoder can be executed locally within the memory and timing constraints of the selected hardware. The calibration and EWMA-based threshold-update mechanisms allow the detection baseline to be adapted to measurements collected after installation.

From a cybersecurity perspective, this work has addressed the critical physical vulnerabilities of widely dispersed IoT devices. The transition to ECC for public key exchanges ensures that even if an attacker intercepts the communication channel, the session keys remain mathematically secure. More importantly, the integration of silicon-level protection via ESP32 eFuse technology ensures that critical cryptographic credentials are physically inaccessible to tampering.

The controlled-flooding communication layer uses duplicate suppression, a bounded TTL, sequence identifiers, and retransmission jitter. The preliminary network experiment showed alarm propagation in direct and three-hop conditions. However, penetration testing, side-channel analysis, deliberate replay and jamming experiments, and measurements of the cryptographic energy and timing overhead were outside the scope of the current campaign. The direct configuration achieved a packet-delivery ratio of 91% with an average latency of 155.48 ms, whereas the three-hop configuration achieved a packet-delivery ratio of 88% with an average latency of 477.62 ms.

Beyond the technical results, this system contributes to the stability of the global “Blue Economy” by reducing the economic burden of vessel theft and improving the efficiency of harbour security operations. The use of a generalised Godot-based simulation environment, leveraging Tessendorf ocean synthesis, has proven to be an effective tool for generating high-fidelity synthetic datasets, enabling rapid prototyping without the immediate need for expensive physical sea trials.

Future research will prioritise the transition from simulated environments to extensive, multi-month empirical deployments in diverse Mediterranean harbours. These trials will be essential for validating the long-term stability of the autoencoder’s reconstruction thresholds under extreme seasonal weather shifts. Additional feature ablation experiments and the possible integration of accelerometer measurements will also be investigated for low-dynamics forward towing. From a cybersecurity perspective, an extensive threat analysis and security evaluation will also be conducted, covering additional attack scenarios such as LoRa physical-layer jamming, malicious relay behaviour, and further attempts at cryptographic key compromise. This evaluation will allow a more comprehensive assessment of the overall security. Furthermore, we intend to explore the integration of decentralised blockchain protocols for decentralised key management, potentially eliminating the need for a centralised backend for initial device provisioning. Finally, the fusion of the current inertial data with Computer Vision inputs from shore-based cameras could create a holistic maritime security ecosystem, further reducing the probability of undetected theft.