Recent Developments in Intrusion Detection for the Internet of Underwater Things: A Systematic Review

Muhammad Haziq ^* 

1. School of Engineering, Edith Cowan University, 270 Joondalup Drive, Joondalup, 6027, WA, Australia

* Correspondence: Muhammad Haziq 

Academic Editor: Yousef Farhaoui

Special Issue: Recent Advances in Cyber Security

Received: April 04, 2026 | Accepted: October 13, 2026 | Published: October 21, 2026

Recent Prog Sci Eng 2026, Volume 2, Issue 4, doi:10.21926/rpse.2604022

Recommended citation: Haziq M. Recent Developments in Intrusion Detection for the Internet of Underwater Things: A Systematic Review. Recent Prog Sci Eng 2026; 2(4): 022; doi:10.21926/rpse.2604022.

© 2026 by the authors. This is an open access article distributed under the conditions of the Creative Commons by Attribution License, which permits unrestricted use, distribution, and reproduction in any medium or format, provided the original work is correctly cited.

1. Introduction

More than 70% of the Earth’s surface is covered by water, and most of these water bodies are unexplored. IoUT supports the smart ocean in facilitating the exploration of these vast sub-sea environments [1,2]. IoUT extends the Internet of Things to the underwater environment. This advanced technology has enabled the underwater environment to have intelligent network connectivity using underwater sensing and communication devices in the ocean. Sensors, autonomous underwater vehicles (AUVs), and surface gateways are interconnected to gather, analyse, and transmit data, creating an Underwater Wireless Sensor Network (UWSN) as shown in Figure 1. The field is growing in importance as UWSNs are adopted for environmental monitoring, military operations, and underwater exploration. However, as the IoUT network expands, the frequency of malicious threats increases, which disrupts underwater operations. These threats can jeopardise data integrity and manipulate underwater nodes. The importance of secure IoUT has considerably grown in recent times because of the advanced attacks directed toward underwater networks [3,4,5].

Figure 1 IoUT architecture illustrating node classes, typical link rates and ranges per tier, the protocol layers, and their impact on IDS performance. In-situ detection at the sensor tier provides real-time mitigation for PHY/MAC threats but suffers from high false-alarm rates due to harsh channel dynamics and limited node compute capabilities. Conversely, the shore tier allows complex ML-based detection over application payloads with high accuracy, but incurs significant detection latency. Because gateways are the central aggregation points, a compromised gateway lets an adversary control what the shore tier sees of the subsea deployment.

Intrusion detection involves techniques for monitoring and safeguarding UWSNs against unauthorised access [6]. IDS are important for protecting IoUT ecosystems through detecting and mitigating cyber threats such as eavesdropping, spoofing, denial-of-service (DoS) attacks, Sybil attacks, and data tampering. Intrusion detection in IoUT is critical for network security and preventing malicious activities. However, the network and security design remain complex due to the severely challenging environment, such as limited bandwidth, power constraints, noise, Doppler effect, and high latency. IDS designed for terrestrial IoT are inadequate to adapt to the dynamic channel variations. Unlike terrestrial IoT, which uses radio frequency (RF) communication, IoUT uses an acoustic signal due to the substantial attenuation of RF signals in water. The acoustic signal is preferred due to its non-line-of-sight and long-range communication.

To support reliable data transmission, various architectures and protocols have been adopted for UWSNs to counter the varying channel dynamics. Centralised, distributed, and hybrid architectures have been developed for data collection and intrusion detection. Anomaly-based and trust-based systems and cross-layer protocols have also been adapted to improve intrusion detection. Recent work [7,8] suggests that energy-efficient and lightweight protocols provide better efficiency and security. IoUT networks nevertheless face limitations arising from the underwater environment, which reduce the effectiveness of localisation methods and thereby increase security risks [9].

Another major challenge is resource limitation. UWSNs rely on sensor nodes deployed in remote underwater locations, where replacing or recharging batteries is difficult. As a result, these nodes often operate with limited power, memory, and processing capability, making it difficult to deploy complex security mechanisms. For this reason, existing security protocols are not well-suited for UWSNs [8]. Moreover, the dynamic nature of the underwater acoustic channels causes packet loss and interference. Hence, maintaining a stable topology is also difficult. Combined with environmental factors, node mobility can increase false positives in intrusion detection, which means security mechanisms must be able to adapt to changing network conditions [7].

These weaknesses can be exploited by attackers to disrupt communication or gain unauthorised access to sensitive data [10,11]. Jamming attacks can interrupt acoustic signal transmission and cause data loss, while spoofing and Sybil attacks can manipulate sensor readings by introducing false identities into the network [3,12].

To address these constraints, IoUT network designs have moved toward adaptive solutions. Recently, machine learning (ML) has been explored to improve intrusion detection in such environments [2,13,14,15]. Techniques such as federated learning, hybrid AI-rule-based models, and bio-inspired algorithms have been developed to improve the detection efficiency with less computational overhead. Blockchain-based methods and cross-layer security architectures have also shown resilience against complex and multi-stage attacks [16,17,18].

However, despite these developments, intrusion detection for IoUT is very difficult because of the limited availability of the underwater intrusion detection datasets, detection delay, limited available power, and the dynamic nature of the underwater acoustic channel. Hence, these issues highlight the need for robust IDS that are capable of detecting anomalies in underwater communication. Incorporating ML for anomaly detection and response offers innovative technologies for protecting UWSNs to enhance security effectiveness from advanced intrusions and attacks. Regular test and response updates are required to mitigate the impact of emerging threats and cyber-attacks in UWSNs, ensuring proactive defence against potential intrusions. Efficient resource management is vital for the sustainability of UWSN for a better network lifetime.

1.1 Relation to Existing Reviews

While existing studies examine the broader landscape of IoUT and UWSNs, intrusion detection has not been the subject of a dedicated review. Jahanbakht et al. [15] survey IoUT alongside marine data analytics but treat security only briefly. Mohsan et al. [1,4] give broad accounts of enabling technologies, applications, and open problems. Most of these focus on the attack level: Ahmad et al. [8] classify attacks on UWSNs, Ahmed et al. [19] pair attacks with mitigation techniques, and Adam et al. [3] and Jiang et al. [5] cover security schemes and reliability across the IoUT stack. Yisa et al. [12] address security challenges in general rather than intrusion detection, and predate most of the ML and FL work discussed here.

Table 1 outlines how this review differs from the existing studies. The contributions of this paper are as follows:

• Describes how the underwater channel dynamics affect the capabilities of an IDS.
• Presents an attack taxonomy covering the physical, data link, network, transport, and application layers, as well as cross-layer attacks, insider threats, and advanced persistent threats, together with a threat model that links each attack to the layer it acts on, the vulnerability it exploits, and the countermeasures reported against it.
• Sets out the databases, publication window, and selection criteria used, so the search can be repeated.
• Compares all reviewed methods across a consistent set of criteria, covering dataset, attack type, metrics, energy cost, latency, complexity, communication overhead, network scale, test environment, and validation strategy.
• Examines the datasets used in this literature, and what class imbalance and validation practice mean for the accuracy figures reported.
• Sets out specific research questions for future work.

Table 1 Comparison of this review with existing IoUT, UWSN, and maritime security reviews. Y = covered in depth; P = partially covered; N = not covered. FL = federated learning; XAI = explainable AI.

The remainder of this paper is organised as follows. Section 2 sets out the review methodology. Section 3 describes the background, architecture, and challenges faced by IoUT, clarifies the terminology used across the field, and differentiates IoUT from terrestrial IoT. Section 4 models the underwater acoustic channel and derives from it the requirements that any IoUT IDS must satisfy. Section 5 describes the types of intrusion reported for IoUT applications. Section 6 compares intrusion detection approaches and methods and gives their formal description. Section 7 examines the data available for training and evaluating these methods, and Section 8 covers deployment constraints, experimental infrastructure, and the standards that apply. Section 9 sets out future directions and Section 10 the lessons learned. The paper ends with a conclusion in Section 11.

2. Review Methodology

This review follows a search and screening protocol based on the Preferred Reporting Items for Systematic Reviews and Meta-Analyses (PRISMA) statement. The protocol was used during the screening stage and covers the review questions, the databases searched, the search strings, the publication window, and the inclusion and exclusion criteria. The purpose is to make the selection of studies visible, so that a reader can understand and repeat the search.

2.1 Review Questions

The review is guided by four questions:

RQ1. How do the properties of the underwater acoustic channel affect the capabilities of an IDS, compared with a terrestrial IoT network?

RQ2. Which intrusions have been reported against IoUT and UWSN deployments, and which layers are affected by the attack?

RQ3. Which detection methods have been proposed, and on which technologies do they rely?

RQ4. How are these methods evaluated, and can the reported results be compared across studies?

2.2 Data Sources and Search Strings

Six databases were searched: IEEE Xplore, the ACM Digital Library, ScienceDirect, SpringerLink, MDPI, and Wiley Online Library. Scopus was not searched separately, because it largely indexes the same publishers. Google Scholar was used only to follow citations, not as a primary source. The search targeted titles, abstracts, and keywords, and combined three terms:

• underwater
• security and detection
• detection techniques

The string used to retrieve the articles was:

(“underwater” OR “IoUT” OR “Internet of Underwater Things” OR “underwater wireless sensor network” OR “UWSN” OR “underwater acoustic network”) AND (“intrusion detection” OR “IDS” OR “anomaly detection” OR “attack detection” OR “security” OR “trust”) AND (“machine learning” OR “deep learning” OR “federated learning” OR “reinforcement learning” OR “blockchain” OR “clustering” OR “routing”)

The third group restricts the results to studies that name a detection or defence technique. The publication window was January 2004 to December 2025. Studies from 2004 onward were included because they laid the foundational work on underwater acoustic network security. Earlier work on underwater acoustics that does not address security was outside the scope.

2.3 Inclusion and Exclusion Criteria

Table 2 lists the criteria applied at the screening stage. An article had to satisfy every inclusion criterion and none of the exclusion criteria to be included.

Table 2 Inclusion and exclusion criteria applied during screening.

2.4 Screening Procedure and Outcome

Screening was carried out in four stages, following the PRISMA guidelines of identification, screening, eligibility, and inclusion. Articles were collected from the six databases, and titles and abstracts were then screened against the criteria in Table 2. Studies passing this stage were read in full and assessed for eligibility.

The search returned 1,482 records. After 456 duplicates were removed, 1,026 records were screened on title and abstract, of which 914 were excluded. 112 full texts were assessed, and 44 were excluded, the most frequent reasons being no security component and no underwater component. A further 8 records were added through citation chasing. The final set contains 76 studies. Figure 2 shows the flow of records through the four stages.

Figure 2 Flow of records through identification, screening, eligibility, and inclusion, following the PRISMA structure.

The retained set is dominated by recent work: of the 76 studies included in this review, 47 were published between 2020 and 2025 and 29 before 2020, with 59 journal articles and 17 conference papers. The older records are retained mainly for foundational material on the underwater channel and on early attack descriptions, which later work builds on rather than replaces.

2.5 Data Extraction

For each study, the following items were extracted where possible:

• the type of detection system
• the attack types addressed and the protocol layer targeted
• the dataset used, evaluation metrics, and its validation strategy
• energy cost, detection latency, and computational overhead

Items that a study does not report are recorded as not reported rather than estimated or inferred, which is presented later in Section 6.

2.6 Limitations of This Review

Three limitations should be noted. First, all screening and extraction was done by one person, so no independent check was applied. The criteria in Table 2 were used to determine the eligibility of a study, but the possibility of selection bias cannot be excluded. Second, restricting the search to English-language publications may have excluded relevant work published in other languages or released only as preprints or technical reports. Third, because the reviewed studies report different metrics on different datasets, their results could not be aggregated into a single quantitative comparison. Section 6 compares them against a fixed set of criteria instead.

3. Background

The advancement of IoT networks has revolutionised the monitoring, data acquisition, and control of numerous systems, automated entire industries, and helped us develop smart cities. By connecting a large number of devices, operational efficiency and real-time responsiveness have been improved, which allows effective data-driven decision-making.

Extending this connectivity concept to underwater leads to IoUT [20], which aims to connect underwater nodes for improved marine monitoring, data collection, and control. Unlike IoT networks that rely on terrestrial communication networks, IoUT systems operate in underwater environments. Factors such as long multipaths, limited bandwidth, low data rate, and significant attenuation make the underwater channel one of the most complex and challenging communication environments and necessitate specialised approaches.

The integration of IoT with underwater communication nodes, such as Underwater Wireless Sensor Networks (UWSN) and underwater Autonomous Vehicles (AUVs), is very challenging, and the IoT networks developed for the terrestrial communication cannot be directly applied to underwater systems [21], whereby they require further adjustments since they do not incorporate channel propagation characteristics, such as long multipaths and high Doppler spread, in addition to the capacity of propagation channels and the availability of limited resources.

Early developments in underwater communication focused on point-to-point acoustic communication modems for short-range communication, primarily for defence. However, the surge in development of underwater sensor network has made interconnection between underwater nodes increasingly essential. With rises in offshore explorations, environmental monitoring and pollution control, underwater sensor networks, and remote broadcasting, the need for effective and reliable IoUT systems has become more critical than ever. The improvements in signal processing and power-efficient electronics have allowed for more robust data acquisition. Moreover, advances in underwater and cross-boundary communication make it possible to connect IoUT with terrestrial IoT networks, which expands coverage and reduces delay, and moves closer to the idea of the Internet of Everything (IoE) [22].

Despite the advancement of IoUT, the system faces significant hurdles. Underwater communication relies primarily on acoustic signals, which are susceptible to noise and interference caused by the channel’s physicochemical properties, such as temperature gradients, salinity, and ocean currents. These challenges make UWSNs vulnerable to a range of attacks, making IoUT a distinct research area and demanding specialised security protocols, which are critical in identifying and mitigating unauthorised access and malicious activities. Moreover, due to the severe energy constraints in the deployment of underwater nodes, where devices are often battery-powered, it is difficult and costly to replace or recharge them. Therefore, energy-efficient tailored intrusion detection strategies are essential for ensuring the integrity and resilience of underwater networks [12].

This section is divided into multiple subsections. It first describes the terminology used across the field, then discusses the architecture of IoUT, and finally outlines the applications of IoUT systems and the challenges they face.

3.1 Terminology: Underwater IoT, IoUT, and UWSN

Three terms appear in this literature and are often used as if they meant the same thing. They do not, and the difference matters for what an IDS is expected to protect.

Underwater IoT, or underwater Internet of Things, is the informal term for the idea of extending IoT connectivity below the surface.

Internet of Underwater Things (IoUT) is the established name of the concept, introduced by Domingo [20]. It refers to the whole system: underwater sensor nodes, autonomous underwater vehicles, surface buoys and gateways, the acoustic, optical, and radio links between them, the surface and shore infrastructure that these connect to, and the applications and data services built on top. IoUT is therefore a network-of-networks that spans the underwater, surface, and terrestrial domains.

Underwater Wireless Sensor Network (UWSN) refers to the set of underwater nodes and the acoustic links among them, together with the routing, medium access, and localisation protocols that operate over those links. A UWSN can exist on its own, without being connected to any wider infrastructure. Every IoUT deployment contains at least one UWSN, but not every UWSN is part of an IoUT deployment.

A UWSN attack surface is confined to the underwater nodes, their acoustic links, and the protocols running over them, which is where jamming, Sybil, wormhole, sinkhole, and selective forwarding attacks operate. The IoUT attack surface additionally includes the surface gateway, the backhaul link to shore, the cloud/edge services that process the collected data, and the application interfaces exposed to users. Attacks such as application-layer abuse, credential compromise at the gateway, and tampering with the collected data once it reaches shore belong to the IoUT attack surface but not to the UWSN one.

In this paper, IoUT is used when referring to the complete system and its security, and UWSN is used when the discussion is confined to the underwater nodes and their acoustic links. Where a cited study uses one of these terms in a different sense, the usage of that study is noted. The term Underwater IoT is not used further.

3.2 Architecture

IoT interconnects devices worldwide, and IoUT extends this paradigm to underwater environments. Therefore, there are many similarities between them, such as the functionality and the architecture. However, the deployment and maintenance of an IoUT network is more complex than its counterpart. To address these gaps, we will discuss the basic architecture of IoUT and explain how it is different from IoT.

The architecture may include various underwater and surface nodes, including AUVs, sensory devices, remotely operated vehicles (ROVs), buoys, ships, and other similar nodes. In an IoUT network, nodes are interconnected with each other through the network layer, which allows information exchange.

IoUT infrastructure consists of three major communication components:

• Sensory nodes, which integrate with sensors, hydrophones, cameras, signal detectors, and storage devices.
• Data distribution nodes, including modems, relays, and repeaters.
• Sink Nodes, which are normally referred to as above-water nodes, such as offshore anchors and buoys.

In a small UWSN, a network of sensory nodes is deployed to measure underwater physical and chemical parameters. These nodes are interconnected and transmit the collected data to a local base node. However, since they are confined to a certain region and have a small transmission range, it is difficult to achieve comprehensive monitoring of the underwater environment. Therefore, multiple UWSNs are interconnected to form the IoUT, enabling real-time data acquisition and analysis on a global scale.

IoUT networks rely on acoustic signals for long-range communications; nevertheless, hybrid communication links have been proposed [23]. This hybrid approach combines magnetic induction (MI), optical and acoustic communication technologies to mitigate high signal attenuation.

Since an underwater channel is highly dispersive, these channel dynamics distort and disperse the signal, which creates major challenges for IoUT whilst relying on limited energy resources. Multiple energy-efficient IoUT network topologies have been proposed, which can be divided into three categories: aggregation methods, routing protocols, and scheduling algorithms [21]. Aggregation methods focus on data reduction to minimise the overhead. Routing protocols can be divided into tree, cluster, and chain-based routing approaches, each balancing energy efficiency, coverage, and reliability. Finally, scheduling algorithms optimise the resource allocation through priority-based scheduling and sleeping techniques. To mitigate channel interference and improve scalability, a multi-cluster-based network topology has been proposed. This multi-cluster topology was originally introduced for UWSNs [24] and later adapted for IoUT networks. In this scheme, the network is divided into multiple clusters; each cluster includes a cluster head supported by several relay nodes. The relay nodes connect sensor nodes to the cluster head, which performs routing and coordinates data transmission.

To further improve link reliability in energy-constrained underwater deployments, hop-count optimisation has also been proposed. The key idea is to increase the number of relay nodes for long-range communication, thereby reducing the hop distance between neighbouring nodes and improving link robustness. This optimisation considers the available power budget, bandwidth constraints, and transmission range to determine an appropriate number of relay nodes.

To ensure reliable operation and adapt to the dynamic channel, the IoUT network requires careful consideration. As shown in Figure 3, the main design considerations include:

• Overcoming dynamic channel variations.
• Maintaining network compatibility.
• Selecting an appropriate communication technology.
• Determining the network topology and deployment arrangement.
• Leveraging channel state information (CSI) and selecting an appropriate packet size.
• Mitigating channel dynamics (e.g., Doppler effects and time-varying multipath).
• Limited bandwidth in IoUT.
• Interfacing with existing IoT systems using predefined IoT protocols.
• Security threats and adversarial attacks.

Figure 3 Challenges in IoUT design, each mapped to the measurable parameter that expresses it and to the consequence it imposes on an IDS.

3.3 Application of IoUT

IoUT networks facilitate the monitoring of the physical and chemical properties of the underwater environment, such as salinity, temperature, pressure, light conditions, pH, turbidity, water quality, pollutants, and oxygen levels. These parameters help us to understand oceanographic processes and marine ecosystems and provide data to predict the impact of environmental changes on marine life.

IoUT’s development is driven by the growing recognition that underwater environments hold vast resources and critical data that can significantly impact numerous fields, including environmental science, climate change research, maritime security, and offshore energy production [25]. On a continuous and global scale, monitoring of parameters such as temperature, salinity, pollution levels, and ocean currents can provide insights into marine ecosystems and enable early detection of environmental irregularities. In addition, reliable monitoring and maintenance of pipelines, undersea cables, and oil rigs depend heavily on the robustness of the IoUT network. Figure 4 summarises the application of IoUT.

Figure 4 Applications of IoUT.

3.4 Challenges Faced in Designing IoUT Networks

The propagation characteristics of the underwater channel, and the limits they place on bandwidth, delay, and energy, are derived quantitatively in Section 4 and are not restated here. This subsection covers the remaining design challenges, which arise from the physical deployment rather than from the channel.

Underwater IoUT nodes normally operate under extremely high pressure. Moreover, the unintended growth and accumulation of algae, combined with the effect of corrosive saltwater, can degrade node performance, and deployment at remote locations further complicates routine maintenance and battery replacement [26].

Therefore, self-management is another significant challenge to the IoUT network. Self-management refers to the ability of a node to configure, heal, optimise, or protect itself from the harsh underwater environment and ensure reliable communication for long periods [20].

The energy cost of long-range communication is given by eq. (15), and dominates the total detection energy in eq. (16). Moreover, because replacing batteries underwater is difficult, IoUT applications require long node operation to avoid expensive replacement [27,28].

The multi-cluster approach provides good performance by optimising IoUT operations, which reduces power consumption and provides network reliability and stability [24]. The design of a clustering approach must account for various underwater environmental factors, including communication distance, the positions and depths of nodes or vehicles, residual energy levels, traffic load, and signal quality. However, if the clusters are not managed properly, this strategy can increase the overall energy consumption and compromise network performance since the improper cluster head selection can deteriorate the energy efficiency of an IoUT network [29].

As IoUT deployments become increasingly widespread and complex, the need for precise node localisation and efficient resource allocation grows more critical [30]. Ensuring that underwater devices know their positions to one another not only supports reliable data routing but also optimises energy consumption—a key concern in resource-constrained underwater settings.

4. The Underwater Acoustic Channel and IDS Design Requirements

This section models the underwater acoustic channel quantitatively and derives the design requirements an IDS must satisfy.

4.1 Absorption and Path Loss

The acoustic channel has geometric spreading and chemical absorption, which lead to energy loss. The absorption coefficient α(f), in dB/km for frequency f in kHz, is given by Thorp’s empirical formula [31]:

\[ \alpha(f)=\frac{0.11f^2}{1+f^2}+\frac{44f^2}{4100+f^2}+2.75\times10^{-4}f^2+0.003. \tag{1} \]

The first two terms account for the relaxation of boric acid and magnesium sulphate respectively, the third for viscous absorption, and the fourth is a low-frequency residual. In eq. (1) α increases monotonically with frequency.

Total path loss over a distance l follows the Urick model [32]:

\[ A(l,f)=l^ka(f)^l,\quad\quad a(f)=10^{\alpha(f)/10}, \tag{2} \]

or in decibels,

\[ 10\log{A(l,f)}=k\cdot10\log{l}+l\cdot\alpha(f), \tag{3} \]

where k is the spreading factor, taken as k = 1 for cylindrical spreading, k = 2 for spherical spreading, and k = 1.5 as a practical value for shallow-water deployment. The second term in eq. (3) has no terrestrial equivalent: the absorption loss in decibels grows linearly with distance, and its rate α(f) rises steeply with frequency.

4.2 Ambient Noise

Ambient noise is modelled as the sum of four independent noise sources [33]:

• turbulence
• distant shipping
• surface agitation from wind and waves
• thermal noise

With power spectral densities in dB re μPa per Hz and f in kHz,

\[ 10\log{N_t(f)}=17-30\log{f}, \tag{4} \]

\[ 10\log N_s(f)=40+20(s-0.5)+26\log f-60\log(f+0.03), \tag{5} \]

\[ 10\log N_w(f)=50+7.5w^{1/2}+20\log f-40\log(f+0.4), \tag{6} \]

\[ 10\log N_{th}(f)=-15+20\log f, \tag{7} \]

where s ∈ [0,1] is a shipping activity factor and w is wind speed in m/s. The total is

\[ N(f)=N_t(f)+N_s(f)+N_w(f)+N_{th}(f). \tag{8} \]

Across the 100 Hz to 100 kHz range, the total exhibits an approximate 18 dB/decade roll-off. Both s and w depend on the environment and change over time, so a detector that assumes a fixed noise floor will report false alarms.

4.3 Propagation Delay, Sound Speed, and Doppler

Sound speed in seawater depends on temperature T in °C, salinity S in ppt, and depth D in metres. The Mackenzie equation [34] gives

\[ \begin{aligned} c= &1448.96+4.591\ T-5.304\times10^{-2}T^2+2.374\times10^{-4}T^3\\ +&1.340\left(S-35\right)+1.630\times10^{-2}D+1.675\times10^{-7}D^2\\ -&1.025\times10^{-2}T(S-35)-7.139\times10^{-13}TD^3. \end{aligned} \tag{9} \]

This yields c ≈ 1500 m/s, so the one-way propagation delay

\[ \tau=\frac{l}{c} \tag{10} \]

is about 0.67 s per kilometre, against 3.3 µs per kilometre for radio. Underwater propagation delay is therefore about five orders of magnitude larger, and is not negligible against protocol timing. It also varies with temperature: by eq. (9), a change of a few degrees shifts c by several metres per second. Several detectors use time-of-flight or round-trip-time as their anomaly signal, and these values drift with the environment alone, which can cause false detections.

The low speed of sound makes the Doppler variation large. For a relative node with velocity v, the Doppler scaling factor is

\[ a=\frac{v}{c}. \tag{11} \]

A drift of 1.5 m/s gives a ≈ 10^-3, compared with a ≈ 5 × 10^-9 for a terrestrial radio link. In an underwater channel, Doppler variation does not only produce a frequency offset; it also compresses or dilates the waveform itself, which requires resampling at the receiver.

With a maximum multipath delay spread τ_max and Doppler spread B_d, the coherence bandwidth and coherence time are

\[ B_c\approx\frac{1}{\tau_{\max}},\quad\quad T_c\approx\frac{1}{B_d}. \tag{12} \]

τ_max typically reaches tens of milliseconds and B_d reaches several hertz, so both B_c and T_c are small. The channel is spread in both time and frequency, which is what is meant by describing it as doubly spread [35].

4.4 Signal-to-Noise Ratio and the Range-Dependent Usable Band

For a transmitted power spectral density S(f) and receiver noise bandwidth Δf, the narrowband signal-to-noise ratio at distance l is

\[ \mathrm{SNR}(l,f)=\frac{S(f)}{A(l,f)N(f)\Delta f}. \tag{13} \]

Because A(l, f) increases with frequency while N(f) decreases, the factor 1/(A(l, f)N(f)) has a maximum at a frequency that depends on range [36]. The usable bandwidth is therefore a function of range, and it narrows as range increases.

4.5 From Channel Properties to Detector Requirements

Table 3 maps each of the quantities above to the design constraint it imposes on an IDS. The following three have the largest effect on how a detector must be designed.

Table 3 Channel properties, their governing relations, and the requirements they place on an IoUT IDS.

First, detection is delay-bounded. If a decision must be reached within a deadline T_d, and observations arrive at interval T_s after a propagation delay τ, the number of observations available to the detector is

\[ N_{obs}\leq\left\lfloor\frac{T_d-\tau}{T_s}\right\rfloor. \tag{14} \]

Detection performance improves with N_obs, so eqs. (10) and (14) together place a hard ceiling on what any detector can achieve at a given range and deadline.

Second, reporting is more expensive than detecting. The transmit power required to sustain a target SNR_req over distance l follows from eq. (13):

\[ P_{tx}(l,f)\,\geq\,SNR_{req}\,A(l,f)\,N(f)\,\Delta f. \tag{15} \]

Because A(l, f) grows with l and f as in eq. (2), the energy cost of sending an alert to a gateway grows quickly with range, while the energy cost of evaluating a model locally does not. The total detection energy

\[ E=E_{sense}+E_{compute}+E_{comm} \tag{16} \]

is therefore dominated by E_comm in almost any realistic deployment. This is the quantitative basis for preferring local or distributed detection over centralised detection underwater, and it applies to federated learning, as shown in Section 6.4.

Third, the environment can generate its own anomalies. The parameters s, w, T, S, and D in eqs. (5), (6), and (9) are dynamic and are not under network control. Any detector whose decision boundary is fixed at training time will drift.

4.6 Detection Performance under an Underwater Prior

Intrusion detection is a binary hypothesis test. Let H₀ denote normal operation and H₁ the presence of an intrusion, and let x be the observation vector. The Neyman-Pearson detector compares the likelihood ratio against a threshold γ [37]:

\[ \Lambda(\mathit{\pmb{x}})=\frac{p(\mathit{\pmb{x}} \mid H_1)}{p(\mathit{\pmb{x}} \mid H_0)} \underset{H_0}{\overset{H_1}{\gtrless}} \gamma, \tag{17} \]

with detection and false alarm probabilities

\[ P_D=\Pr\{\Lambda>\gamma\mid H_1\},\quad\quad P_{FA}=\Pr\{\Lambda>\gamma\mid H_0\}. \tag{18} \]

For the canonical case of a known signal in additive Gaussian noise with deflection coefficient d²,

\[ P_D=\mathrm{Q}\left(Q^{-1}(P_{FA})-\sqrt{d^2}\right), \tag{19} \]

where Q(·) is the Gaussian tail function and d² grows with N_obs. eq. (14) therefore enters eq. (19) directly: range and decision deadline bound d², and so bound the achievable operating point on the ROC curve.

The second consequence concerns how results are reported. Writing π = Pr{H₁} for the prior probability of intrusion, the precision of the detector is

\[ Precision=\frac{\pi P_D}{\pi P_D+(1-\pi)P_{FA}}, \tag{20} \]

and its accuracy is

\[ Accuracy=\pi P_D+(1-\pi)(1-P_{FA}). \tag{21} \]

In an operational underwater network, intrusion events are rare, so π is small. Suppose π = 10^-3, P_D = 0.95, and P_FA = 0.01. eq. (21) returns an accuracy of 0.990, which would be reported as a strong result. eq. (20) returns a precision of 0.087: fewer than one alert in eleven is genuine. eq. (21) also shows that a detector which simply declares H₀ always achieves an accuracy of 1 - π = 0.999 while detecting nothing.

This matters for reading the literature. Reported accuracies above 95% are common in the studies reviewed here, but the proportion of intrusions in the evaluation data is rarely stated. On a balanced or near-balanced dataset, π ≈ 0.5 and eq. (21) is well behaved, but such figures do not transfer to a deployment where π is three or four orders of magnitude smaller. The point is not that the reported results are wrong, but that accuracy on a balanced dataset does not predict field performance, and that the operating π is almost never stated. Section 6 returns to this when comparing the reviewed methods.

5. Types of Intrusions for IoUT

The IoUT interconnects physical devices equipped with embedded sensors and onboard software to support data collection, analysis, and decision-making. Recently, IoUT has received significant research attention. However, the underwater channel imposes constraints that are very different from the terrestrial IoT. In particular, radio and optical signals, which are widely used in terrestrial networks, are generally unsuitable for underwater because of severe attenuation and absorption. Hence, most UWSNs use acoustic communication. Although acoustic links support longer transmission ranges, they come with the constraints quantified in Section 4.

Therefore, these limitations, combined with the limited power, memory, and processing capability of underwater nodes, make IoUT networks more exposed to security threats. Protecting data confidentiality and integrity in such conditions requires sophisticated intrusion detection schemes that are specifically designed for underwater systems. Recent progress in high-performance computing and machine learning has also strengthened physical-layer security by using channel characteristics to improve resistance to eavesdropping and tampering.

Accordingly, intrusions in IoUT can be categorised based on the protocol layer, as summarised in Figure 5. Adam et al. [3] identified the types of intrusions at each network level, and these are described in Sections 5.1 to 5.4.

Figure 5 Taxonomy of intrusions in IoUT. The five protocol layers are shown on the left, the categories defined by adversary rather than by layer are shown on the right.

Three further categories are needed to describe the threats faced by a complete IoUT system. The first is the application layer, which a UWSN does not have but which is part of the IoUT attack surface as defined in Section 3.1. The second is cross-layer attacks, whose defining property is that no single-layer detector observes an anomaly large enough to trigger. The third covers threats that are defined by the adversary rather than by the protocol: insider threats from nodes that hold valid credentials, and advanced persistent threats that exploit the long maintenance intervals of underwater deployment. Sections 5.5 to 5.8 address these.

Section 5.9 then draws the categories together into a threat model that links each attack to the layer it acts on, the underwater property that makes it viable, the signal it produces that a detector could observe, and the countermeasures reported against it. Section 5.10 compares the attacks on severity, likelihood, scope, and attacker cost.

Table 4 summarises the impact of cyber-attacks across the protocol layers.

Table 4 Layer-wise intrusions in IoUT.

5.1 Physical and Device-Level Intrusions

At the physical layer, attackers can exploit the doubly spread underwater acoustic channel to enhance the attacks. A primary threat is jamming, in which disruptive signals are injected into the channel to block communication [38,39,40,41]. Moreover, it interrupts data delivery and significantly shortens the lifetime of the nodes by forcing them to retransmit [41].

Eavesdropping is another physical layer threat, where an attacker intercepts transmitted signals to obtain sensitive information. In underwater acoustic nodes, both attacks and defences are strongly influenced by channel impairments. Analytical models have therefore been used to characterise eavesdropping and intrusion probability under realistic channel conditions [42]. To increase robustness against interference, techniques such as spread spectrum, frequency-hopping spread spectrum, and direct-sequence spread spectrum have been widely explored [43]. Additional mitigation strategies include adaptive duty-cycling, which switches nodes to sleep mode during an attack and resumes operation afterwards to limit energy loss. More recent approaches integrate machine learning to adjust protection policies as channel conditions and attack patterns evolve. Covert communication techniques are also used to hide the transmissions.

5.2 Data-Level Intrusions

At the data link layer, MAC protocols coordinate access to the shared acoustic channel under severe bandwidth constraints. Compared to physical-layer jamming, MAC-layer jamming can be more strategic and protocol-aware. For example, an attacker may repeatedly trigger control exchanges (e.g., RTS/CTS behaviour) to disrupt coordination among nodes and reduce overall throughput. Collision attacks occur when packets are transmitted in a way that intentionally causes collisions, corrupting frames and increasing retransmissions. An exhaustion attack keeps the channel busy and forces a victim to expend energy on repeated reception, processing, and retransmission. This may be achieved by flooding the network with excessive requests, which increases channel contention and drains node batteries.

5.3 Network-Level Intrusions

Network level threats in IoUT mainly target routing and packet forwarding. A replay attack occurs when an attacker retransmits valid messages to mislead the receiver or interfere with normal protocol operation. In selective forwarding, a compromised node appears to behave normally but deliberately drops packets, which lowers the overall throughput while making the attack difficult to detect [44]. Man-in-the-middle (MitM) attacks are also a serious concern because an attacker can intercept and modify communication between legitimate nodes.

Other common network layer attacks include Sybil, wormhole, and sinkhole attacks. In a Sybil attack, one adversary assumes multiple identities to disrupt trust relationships and influence routing decisions [45,46,47]. In a wormhole attack, messages are tunnelled between two distant points in the network to create the false impression of a shorter route. This can seriously affect routing, localisation, and data integrity [45,48,49,50]. Wormhole attacks may also support denial-of-service behaviour by enabling packet dropping, traffic analysis, or other coordinated attacks. In a sinkhole attack, a malicious node advertises an attractive route to draw in surrounding traffic and then drops or manipulates the packets it receives.

Network security mechanisms are intended to maintain communication performance under attack by reducing packet loss and preserving throughput [51,52]. IDS play an important role by monitoring network behaviour and identifying suspicious activity [53]. In practice, IDS is often combined with encryption, network segmentation, and anomaly detection to improve resilience. Effective network-layer defence is therefore essential for reliable routing and secure data exchange in IoUT deployments.

5.4 Transport-Layer Intrusions

At the transport layer, IoUT is vulnerable to DoS-style attacks such as desynchronisation and synchronisation flooding. A desynchronisation attack disrupts an established connection by injecting forged packets with incorrect sequence information, causing the nodes to lose alignment and trigger repeated retransmissions. Since underwater networks often rely on GPS-free synchronisation mechanisms [54], manipulation of timing and control information can have an impact on the network. In addition, Sybil and replay attacks can generate false measurements that degrade time synchronisation.

A synchronisation flooding attack targets protocols that maintain per-connection state by repeatedly sending connection requests until resource limits are reached. The resulting traffic surge overloads the network and makes it difficult to distinguish legitimate sessions from malicious activity. One possible mitigation is the use of connectionless transport protocols; however, this can reduce transport-layer functionality required by applications. A common defence is the use of SYN cookies [55], which avoids allocating server-side state until a client proves reachability. While effective against certain flooding behaviours, this approach can increase computation and introduce additional overhead.

5.5 Application-Layer Intrusions

As defined in Section 3.1, a UWSN has no application layer of its own. An IoUT system does: the surface gateway, the backhaul to shore, and the data services built on the collected measurements are all part of the system, and all are reachable by an adversary.

False data injection targets the integrity of the measurements. An adversary that controls a node can make it report false data, and because the node still holds valid credentials the readings pass every check the network applies, so downstream decisions are corrupted. This is difficult to detect by traffic analysis, because packet rates and routing behaviour remain normal. Command injection and unauthorised actuation target the downlink, and could give an adversary control of AUVs and actuated underwater nodes. Firmware and update abuse exploits a constraint specific to this setting. Updating a deployed node over an acoustic link is slow, so update mechanisms are designed for minimum payload, and signature verification is sometimes skipped to save bandwidth and energy. An unauthenticated update path gives an adversary control of a node that cannot be physically reached until the next maintenance cycle. Gateway and service compromise targets the gateways, which connect the underwater nodes to the surface. An adversary at the gateway sees all the traffic and can inject malicious data in either direction.

5.6 Cross-Layer Attacks

Sections 5.1 to 5.5 treat each layer as an independent target. A cross-layer attack affects several layers, but its effect at each individual layer stays below that layer’s detection threshold.

Consider an adversary that uses low-rate jamming at the physical layer, at a low duty cycle, so that the resulting increase in bit error rate stays within the variation that wind noise already produces eq. (6). The MAC layer retransmits the corrupted frames, which is normal behaviour, and the rate of retransmissions stays low. However, the retransmissions increase the energy cost of the node. The routing layer may then select an alternative path, and the adversary repeats the pattern on that path. This results in route flapping and battery depletion.

Let T_i be the test statistic of a detector operating at layer i with threshold γ_i. A layer-wise detection scheme raises an alarm when

\[ \exists i{:}\,T_i>\gamma_i, \tag{22} \]

and a cross-layer attack is one for which T_i ≤ γ_i holds for every i while a joint statistic T_joint (T₁, …, T_n) exceeds its own threshold. Lowering the individual γ_i to catch such an attack raises the per-layer false alarm rate, and by eq. (20) the operating precision degrades sharply. Detection therefore requires the joint statistic rather than per-layer thresholds.

Localisation-routing coupling exploits the dependence of underwater routing on position estimates. An attack on the ranging or timing used for localisation propagates into routing decisions without ever appearing as a routing anomaly.

5.7 Insider Threats and Compromised Nodes

An insider node is a trusted node inside a network that holds valid credentials but is controlled by an adversary. It is difficult to identify, because the node still authenticates correctly. Insider threats arise in IoUT through node capture, where an adversary physically recovers a deployed node, and through firmware compromise, as described in Section 5.5.

To identify a compromised node, trust and reputation models calculate node scores from observed behaviour rather than from credentials. These models are complex to deploy in an underwater network, and their design is outside the scope of this study.

A malicious node and a failing node produce similar behavioural signatures. A node suffering biofouling, sensor drift, corrosion, or battery decline will drop packets, report implausible values, and respond inconsistently, which is also the profile of selective forwarding or false data injection.

The consequence is that a trust model tuned to isolate malicious nodes will also isolate degraded nodes, reducing coverage in a network that was already sparse, while a trust model tuned to tolerate degradation could allow an insider node to operate. None of the trust-based schemes reviewed in Section 6 reports how it separates these two cases, and we identify this as an open problem in Section 9.

5.8 Advanced Persistent Threats

An advanced persistent threat is characterised by an adversary pursuing a long-term objective while avoiding detection. IoUT networks are exposed for two reasons. First, dwell time is long: underwater deployments are serviced after long intervals, so a node compromised in a deployment cycle may remain compromised. Second, reconnaissance is passive and therefore undetectable: acoustic eavesdropping requires only a hydrophone within range and emits nothing, so it leaves no trace on the network.

A typical example of this attack begins with passive acoustic data collection to map the topology and traffic patterns, followed by compromise of a small number of nodes through capture or update abuse, firmware modification, and manipulation at a rate low enough to remain within normal variation. Detecting this pattern is extremely difficult and requires sophisticated resources. However, an underwater node has neither the storage to retain a long observation history nor the energy budget. Detection must therefore be performed where the history can be held, which is at the gateway or on shore. None of the detection methods reviewed in Section 6 operates on a timescale longer than a single evaluation run.

5.9 Threat Model

Table 5 sets out the threat model. Each attack is linked to the layer or layers it acts on, the underwater property that makes it viable, the observable signal a detector could use, the countermeasures reported in the reviewed literature, and the limitation of those countermeasures. The third column distinguishes this from a general IoT threat model: in most cases the attack is not new, but the property that makes it hard to detect is specific to the acoustic channel.

Table 5 Threat model for IoUT, linking each attack to the layer it acts on, the underwater property that makes it viable, the signal available to a detector, and the reported countermeasures with their limitations.

5.10 Comparative Risk Assessment

Table 6 compares these attacks on four dimensions. No standardised scoring system exists for underwater networks, and applying a terrestrial framework such as CVSS directly would misstate the likelihood since it does not account for acoustic range, deployment cost, or maintenance interval.

Table 6 Comparative risk assessment of IoUT attacks. Ratings are qualitative and assigned against the definitions given in Section 5.10.

The dimensions are defined as follows. Severity is the consequence if the attack succeeds: high denotes loss of network function or of data integrity across the deployment, medium denotes degraded performance or localised loss, and low denotes a limited or recoverable effect. Likelihood reflects how easily the attack can succeed given the channel, and how often it is reported in the studies. High likelihood denotes an attack requiring only off-the-shelf acoustic hardware, medium denotes one requiring network access or knowledge of the protocol, and low denotes one requiring node compromise or physical access. Scope is the extent of the effect. Attacker cost covers equipment, vessel time, positioning, and prior knowledge.

Two observations follow from Table 6 and are relevant to the future directions in Section 9. The attacks with the lowest attacker cost, jamming and eavesdropping, are also among the most likely, and neither is well addressed by the detection methods reviewed in Section 6, which concentrate on network-layer attacks. The attacks with the highest severity are concentrated at the application layer and in the multi-layer categories, which go beyond the four network layers usually used to classify attacks.

6. Intrusion Detection Approaches and Methods

IoUT-based IDS have been developed to counter security threats and improve overall network security. Early works between 2015 and 2020 focus mainly on basic security mechanisms, before shifting towards intrusion detection. The growing risk of wormhole, black hole, and Sybil attacks led researchers to develop adaptive anomaly detection methods. For example, the Virtual-Lattice Monitoring (VLM) algorithm [56] used both mobile and static nodes to detect intrusions in sparse underwater networks, while hybrid optical-acoustic clustering methods [57] improved the detection of wormhole attacks.

From 2021, ML and optimisation-based IDS models were presented. Moreover, energy-efficient and cluster-based frameworks were introduced to improve detection accuracy while reducing the impact on network lifetime. A recent study highlighted the need for advanced detection methods [19,58], while techniques such as SMOTE-based data balancing and random forest classifiers [59] enhanced the detection of rare and multitype attacks, ensuring greater resilience against sophisticated threats.

Federated learning (FL), blockchain-based security, and hybrid deep learning models were introduced to further improve the performance. IDS frameworks based on FL [18,60] enabled distributed anomaly detection in UWSNs. Moreover, CNN-Bi-LSTM architectures optimised with NADAM and AdamW techniques emerged as powerful tools for spatial-temporal attack detection, to improve detection efficiency and adaptability in dynamic underwater environments.

Currently, IoUT networks combine multiple ML-based IDS approaches, which include RL, FL, and clustering-based detection [18,59,61,62]. Despite these advancements, practical validation of federated and blockchain-based IDS remains limited. Figure 6 shows a generic IDS workflow used in IoUT systems.

Figure 6 Intrusion detection workflow for IoUT.

6.1 On the Comparability of Reported Results

Table 7 summarises the reviewed IoUT intrusion detection methods and their evaluation setting, and Table 8 gives the quantitative results they report. We recorded what each study reports, and presenting the results this way shows that the methods cannot be ranked against one another, because they lack a common benchmark and reporting method. None of the studies reports detection latency, communication overhead, or computational complexity in a form that allows comparison. The evaluations use different data sources, different network scales, and different attack sets. One study evaluated its underwater method only on KDD-99 and its revision NSL-KDD, which are terrestrial datasets, with no underwater network simulation.

Table 7 Reviewed IoUT intrusion detection methods: approach, scope, and evaluation setting. nr indicates the study does not report the item.

Table 8 Reported quantitative results for the reviewed methods. nr indicates the study does not report the quantity.

Where the validation strategy is stated, it also differs between the studies (Table 7): one uses prequential evaluation on a data stream, one a single train and test split, one only out-of-bag error, and two simulation runs with no separate test set, so overfitting to the evaluation data cannot be ruled out. None of the ten studies reports confidence intervals, repeated runs with different random seeds, or a significance test on its detection results, so a difference of a few percentage points between two methods cannot be shown to exceed run-to-run variation.

6.2 Machine Learning-Based Intrusion Detection Approaches

As mentioned earlier, protocols designed for terrestrial networks often perform poorly in underwater channels, which highlights the need for approaches that adapt to varying channel dynamics. Recent studies have explored methods such as hybrid deep learning models, FL for decentralised security, and adaptive techniques that aim to improve detection accuracy without increasing the computational complexity of resource-limited networks.

Several studies have investigated hybrid deep learning-based models that improve IDS performance by combining spatial and temporal feature extraction. In 2024, authors [63] proposed an IDS using a convolutional LSTM architecture optimised with NADAM for detecting intrusions in IoUT UWSNs, achieving 96.7% accuracy. Later, this idea was extended by integrating RL-based adaptive attack detection. For instance, authors in another study [18] developed a FL-based hierarchical IDS that uses CNNs for spatial analysis and Bidirectional Long Short-Term Memory (Bi-LSTM) networks for capturing temporal behaviours. Similarly, another study [61] proposed a multi-tier intrusion detection framework that combines CNNs, Bi-LSTMs, RL, and optimisation with AdamW to enhance adaptability and reduce false positives in UIoTWSNs.

Decentralised IDS solution based on FL has gained attraction for resource-constrained underwater environments. Unlike centralised models, FL supports distributed training across UWSNs while preserving data privacy and reducing communication overhead. Popli et al. [59] proposed a FL framework with a focus on privacy preservation and collaborative anomaly detection. Furthermore, another study proposed a FL-based IDS integrated with blockchain to secure model aggregation in hierarchical architectures [18] and its application in the broader IoUT through the Fed-IoUT framework proposed by Pei et al. [66]. Another study [67] has extensively reviewed the role of FL in IoUT, highlighting its advantages in handling heterogeneous underwater data sources and constrained environments.

In addition to DL and FL, adaptive ML models have been proposed to address the energy limitations and changing attack patterns in IoUT networks. Das et al. [2] introduced an adaptive intrusion detection and prevention system based on Adaptive Random Forest (ARF) and concept drift detection methods such as ADWIN, allowing the model to update as network conditions change. Classical ML-IDS methods such as Support Vector Machines (SVMs) also remain useful, as shown by a study on malicious attack detection in UWSNs [60].

Clustering-based IDS focus on local anomaly detection, hence minimising communication overhead, and efficiently managing energy resources. Several studies have explored density-based clustering for IDS. For example, Zhang et al. [62] proposed the DOIDS model, which uses DBSCAN clustering to detect routing attacks such as sinkhole attacks in opportunistic routing environments. In another study [57], authors developed a cluster-based method for detecting wormhole attacks through round-trip time analysis, reporting better energy efficiency and network throughput. Huang et al. [64] combined neighbourhood rough sets for dimensionality reduction with a random forest classifier to improve the detection of multiple attack types in clustered UWSNs.

Moreover, trust-based IDS methods provide another way to identify malicious nodes. Jiang et al. [65] proposed a cloud theory-based trust model, which was extended by [59]. They proposed hybrid trust frameworks that incorporate random forest classifiers to improve detection accuracy. These methods are intended to handle uncertainty in node behaviour while reducing misclassification in dynamic and noisy underwater environments.

Recent studies [3,68,69] have examined the ML-based IDSs in both IoT and IoUT networks. These studies highlight key challenges such as dataset scarcity, the need for real-world validation, and the trade-offs between detection accuracy and computational efficiency in underwater systems.

Most of the reviewed literature lacks real-world validation. One example is the use of ML models for SONAR-based mine detection [67], which shows how such techniques can be applied in a practical underwater defence network. Additionally, emerging techniques like Graph Neural Networks (GNNs) and Digital Twins remain under-explored despite their potential for modelling complex underwater attacks [70].

Overall, current research suggests that ML-based IDS is a promising direction for IoUT UWSNs. Future work should focus on addressing these limitations through approaches such as transfer learning, synthetic-to-real adaptation, and newer methods including GNNs and Digital Twins.

6.3 Learning-Based Detectors

This subsection formally states the detectors reviewed in this paper, so that their assumptions and costs can be compared.

6.3.1 Problem Statement

Let x_t ∈ R^d be the feature vector extracted from a node at time step t, typically comprising link-layer counters, routing statistics, energy readings, and physical-layer measurements such as received level and round-trip time. Detection operates on a window of L consecutive steps,

\[ \mathit{\pmb{X}}_t=[\mathit{\pmb{x}}_{t-L+1},...,\mathit{\pmb{x}}_t]\in\mathbf{R}^{d\times L}, \tag{23} \]

and produces $\widehat{y}_t$ = f_θ(X_t) ∈ [0,1], an estimate of Pr{H₁}. By eq. (12), L cannot be chosen freely: a window longer than the channel coherence time T_c mixes samples drawn from different channel realisations, so physical-layer features are no longer stationary across the window.

6.3.2 Convolutional Feature Extraction

The convolutional stage produces

\[ \mathit{\pmb{h}}^{(l)}=\sigma(\mathit{\pmb{W}}^{(l)}*\mathit{\pmb{h}}^{(l-1)}+\mathit{\pmb{b}}^{(l)}),\quad\quad \mathit{\pmb{h}}^{(0)}=\mathit{\pmb{X}}_t, \tag{24} \]

where * denotes discrete convolution, W^(l) the kernels of layer l, and σ(·) a pointwise nonlinearity, in this literature almost always σ(z) = max(0, z). The convolution is applied along the time axis, so the stage extracts patterns that are local in time and shared across positions. Its assumption is translation invariance: that an attack signature has the same shape wherever it occurs in the window. This holds for jamming and flooding, whose signatures are short and repeated, and holds less well for selective forwarding, whose signature is a change in a long-run rate.

6.3.3 Bidirectional Recurrent Stage

The recurrent stage models dependence across the window. For a long short-term memory cell [71], with ⊙ denoting the elementwise product,

\[ \mathit{\pmb{i}}_t=\sigma_g(\mathit{\pmb{W}}_i\mathit{\pmb{x}}_t+\mathit{\pmb{U}}_i\mathit{\pmb{h}}_{t-1}+\mathit{\pmb{b}}_i), \tag{25} \]

\[ \mathit{\pmb{f}}_t=\sigma_g(\mathit{\pmb{W}}_f\mathit{\pmb{x}}_t+\mathit{\pmb{U}}_f\mathit{\pmb{h}}_{t-1}+\mathit{\pmb{b}}_f), \tag{26} \]

\[ \mathit{\pmb{o}}_t=\sigma_g(\mathit{\pmb{W}}_o\mathit{\pmb{x}}_t+\mathit{\pmb{U}}_o\mathit{\pmb{h}}_{t-1}+\mathit{\pmb{b}}_o), \tag{27} \]

\[\mathit{\pmb{g}}_t=\tanh(\mathit{\pmb{W}}_c\mathit{\pmb{x}}_t+\mathit{\pmb{U}}_c\mathit{\pmb{h}}_{t-1}+\mathit{\pmb{b}}_c), \tag{28} \]

\[ \mathit{\pmb{c}}_t=\mathit{\pmb{f}}_t\odot \mathit{\pmb{c}}_{t-1}+\mathit{\pmb{i}}_t\odot \mathit{\pmb{g}}_t, \tag{29} \]

\[ \mathit{\pmb{h}}_t=\mathit{\pmb{o}}_t\odot \tanh(\mathit{\pmb{c}}_{t}), \tag{30} \]

where σ_g is the logistic function. The bidirectional form [72] runs one such recurrence forward and a second backward over the same window and concatenates their states,

\[ \mathit{\pmb{h}}_t^{bi}=[\overrightarrow{\mathit{\pmb{h}}_t};\overleftarrow{\mathit{\pmb{h}}}_t]. \tag{31} \]

The backward pass is what makes the stage bidirectional, and it carries a consequence that the reviewed papers do not discuss: computing $\overleftarrow{\mathit{\pmb{h}}}_t$ requires the whole window to be present, so a bidirectional detector cannot emit a decision until the window closes. It adds at least LT_s to the decision latency, which enters the budget in eq. (14) alongside the propagation delay. A bidirectional model is therefore a poorer fit to a tight deadline than its unidirectional equivalent, whatever its offline accuracy.

6.3.4 Objective Functions and Class Imbalance

Training minimises a loss over the labelled set. The usual choice is binary cross-entropy,

\[ L_\mathrm{BCE}(\mathit{\pmb{\theta}})=-\frac{1}{N}\sum_{i=1}^N[y_i\log\hat{y}_i+(1-y_i)\log(1-\hat{y}_i)]. \tag{32} \]

Under the small intrusion prior discussed in Section 4.6, eq. (32) is minimised close to the trivial predictor. Two standard corrections apply. Class weighting rescales the two terms,

\[ L_\mathrm{W}(\mathit{\pmb{\theta}})=-\frac{1}{N}\sum_{i=1}^N[w_1y_i\log\hat{y}_i+w_0(1-y_i)\log(1-\hat{y}_i)], \tag{33} \]

with w₁/w₀ typically set to the inverse class ratio. Focal loss [73] instead down-weights examples the model already classifies confidently,

\[ L_\mathrm{F}(\mathit{\pmb{\theta}})=-\frac{1}{N}\sum_{i=1}^N\alpha_t\left(1-p_{t,i}\right)^\gamma\log p_{t,i}, \tag{34} \]

where $p_{t,i}=\hat{y}_{i}$ if y_i = 1 and $1-\hat{y}_{i}$ otherwise, and γ > 0 controls the down-weighting. Neither correction changes the operating π; both change where the decision boundary sits relative to it. Rebalancing the dataset itself, commonly with SMOTE, alters π during training, and the deployed prior is then left unstated.

6.3.5 Optimisers

Several of the reviewed detectors are distinguished chiefly by their optimiser, so the update rules are given here for completeness. Adam [74] maintains bias-corrected first and second moment estimates $\mathit{\pmb{\widehat{m}}}_t$ and $\mathit{\pmb{\widehat{v}}}_t$ of the gradient g_t and applies

\[ \mathit{\pmb{\theta}}_{t+1}=\mathit{\pmb{\theta}}_t-\eta\frac{\mathit{\pmb{\widehat{m}}}_t}{\sqrt{\mathit{\pmb{\widehat{v}}}_t}+\epsilon}. \tag{35} \]

NADAM [75] substitutes a Nesterov-accelerated momentum term for $\mathit{\pmb{\widehat{m}}}_t$,

\[ \mathit{\pmb{\theta}}_{t+1}=\mathit{\pmb{\theta}}_t-\frac{\eta}{\sqrt{\mathit{\pmb{\widehat{v}}}_t}+\epsilon}\left(\beta_1{\mathit{\pmb{\widehat{m}}}_t}+\frac{(1-\beta_1)\mathit{\pmb{g}}_t}{1-\beta_1^t}\right), \tag{36} \]

and AdamW [76] decouples weight decay from the adaptive term,

\[ \mathit{\pmb{\theta}}_{t+1}=\mathit{\pmb{\theta}}_t-\eta\left(\frac{\mathit{\pmb{\widehat{m}}}_t}{\sqrt{\mathit{\pmb{\widehat{v}}}_t}+\epsilon}+\lambda \mathit{\pmb{\theta}}_t\right). \tag{37} \]

These differ in convergence behaviour during training. None of them affects inference cost, energy consumption, or detection latency on a deployed node, which is worth stating because the reviewed work sometimes presents the choice of optimiser as though it were a property of the deployed detector.

6.3.6 Reinforcement Learning Formulation

Where reinforcement learning is used for adaptive detection, the problem is a Markov decision process (S, A, P, R, γ). The state s_t ∈ S aggregates recent detector outputs and network observations; the action a_t ∈ A selects a detection threshold, a sampling rate, or a response; and the objective is

\[ \max_\pi\ \mathbf{E}\left[\sum_{t=0}^\infty\gamma^tr(\mathit{\pmb{s}}_t,a_t)\right], \tag{38} \]

with the action-value function satisfying

\[ Q^*(\mathit{\pmb{s}},a)=\mathbf{E}\left[r+\gamma\max_{a^{\prime}}Q^*(\mathit{\pmb{s}}^{\prime},a^{\prime})\,|\,\mathit{\pmb{s}},a\right]. \tag{39} \]

The reward is normally a weighted combination of detection benefit and false alarm and energy cost, for example r = β₁1[true detection] - β₂1[false alarm] - β₃E_t. Two assumptions embedded in eq. (39) deserve scrutiny underwater. It assumes the state is observed without delay, whereas eq. (10) says observations arrive at least τ late; and it assumes stationary transition dynamics P, whereas the environmental variation described in Section 4 makes P time-varying. Neither assumption is addressed in the reviewed work.

6.3.7 Detection Pipeline

Algorithm 1 states the general pipeline shared by the learning-based detectors reviewed here.

Algorithm 1 Learning-based IoUT intrusion detection pipeline.

Lines 1, 2, 5, 6, 9 and 12 of Algorithm 1 are the underwater-specific steps. None of the detectors reviewed in Table 7 implements all of them, and most implement none, which is a more precise statement of the gap than saying that terrestrial methods transfer poorly.

6.4 Federated Learning: Formulation, Aggregation, and Threat Model

Federated learning has recently been proposed for IoUT. This subsection states the formulation, the robust aggregation rules, and the threat model, and then evaluates them against the underwater constraints.

6.4.1 Formulation

Let K nodes hold local datasets D₁, …, D_K with n_K = |D_K| and n = Ʃ_kn_k. Federated averaging [77] minimises

\[ F(\mathit{\pmb{w}})=\sum_{k=1}^K\frac{n_k}{n}F_k(\mathit{\pmb{w}}),\quad \quad F_k(\mathit{\pmb{w}})=\frac{1}{n_k}\sum_{i\in D_k}l\left(\mathit{\pmb{w}};\mathit{\pmb{x}}_i,y_i\right), \tag{40} \]

by alternating local optimisation with aggregation. In round t each selected node runs E local epochs from the global model w_t to obtain $\mathit{\pmb{w}}_{t+1}^k$, and the server forms

\[ \mathit{\pmb{w}}_{t+1}=\sum_{k\in S_t}\frac{n_k}{n_{S_t}}\mathit{\pmb{w}}_{t+1}^k. \tag{41} \]

6.4.2 Non-IID Data and Client Drift

The convergence guarantees for eq. (41) assume that local datasets are drawn from a common distribution, but for underwater nodes they are not. Nodes at different depths and locations observe different traffic, different noise conditions, and different attack exposure. Let δ_k be the gradient divergence of node k,

\[ \delta_k=\parallel\nabla F_k(\mathit{\pmb{w}})-\nabla F(\mathit{\pmb{w}})\parallel, \tag{42} \]

the degradation of eq. (41) relative to centralised training grows with max_kδ_k and with the number of local epochs E [78]. Increasing E is the standard way to reduce communication rounds, so underwater deployments usually use a higher E. Proximal correction terms [79] bound local divergence at the cost of slower progress per round.

6.4.3 Communication Cost

For a FL model with |w| parameters at b bits and R rounds, the payload per node is

\[ C=2R\,|\mathit{\pmb{w}}|\, b\quad\mathrm{bits}, \tag{43} \]

and over a link of rate B the airtime is C/B, to which eq. (10) adds 2Rτ of propagation. A modest CNN-BiLSTM detector with |w| = 10⁶ parameters at b = 32 bits transmits 3.2 × 10⁷ bits per direction per round. Over an acoustic link at B = 5 kbit/s, one direction of one round occupies approximately 6.4 × 10³ s, or about 1.8 hours. Fifty rounds of training would occupy roughly 178 hours of channel time per node, on a shared channel, at a transmit power set by eq. (15). Quantising the weights to reduce b can degrade detection performance.

6.4.4 Threat Model

Assume an adversary that controls a subset B ⊂ {1, …, K} of nodes with |B| = f, has full knowledge of the model architecture and can read and control the nodes. Under this model three attacks are relevant.

In an untargeted poisoning attack, a node in B submits $\mathit{\pmb{w}}_{t+1}^{k}=\mathit{\pmb{w}}_{t+1}^{honest}+\mathit{\pmb{\epsilon}}$ with ϵ chosen to move the aggregate away from the optimum and degrade overall accuracy. In a targeted or backdoor attack, the adversary trains on data carrying a trigger pattern δ and submits a scaled update so that the aggregate satisfies f_w(x + δ) = y_target while behaving normally on clean inputs; in an intrusion detection setting the natural target is to have a specific attack signature classified as benign. In a gradient inversion attack [80], an honest-but-curious server reconstructs a node’s training data from its submitted update by solving

\[ \min_{x^{\prime}}\ \parallel\nabla l(\mathit{\pmb{w}};\mathit{\pmb{x}}^{\prime},y^{\prime})-\nabla l(\mathit{\pmb{w}};\mathit{\pmb{x}},y)\parallel^2+\lambda R(\mathit{\pmb{x}}^{\prime}), \tag{44} \]

where R is a prior on the input. This defeats the privacy argument usually given for adopting federated learning in the first place.

6.4.5 Robust Aggregation Rules

Robust aggregation replaces the weighted mean in eq. (41) with a rule that resists a bounded number of Byzantine updates. Krum [81] scores each update by its distance to its nearest neighbours. Writing Δ_i for the update of node i and N_i for the set of K–f–2 updates closest to Δ_i in Euclidean distance, the score is

\[ s(i)=\sum_{j\in N_i}\left\|\mathit{\pmb{\Delta}}_i-\mathit{\pmb{\Delta}}_j\right\|^2, \tag{45} \]

and the rule selects the single update with the lowest score,

\[ \mathrm{Krum}(\mathit{\pmb{\Delta}}_1,...,\mathit{\pmb{\Delta}}_K)=\mathit{\pmb{\Delta}}_i^*,\quad\quad i^*=\arg\min_is(i). \tag{46} \]

Multi-Krum selects the m updates with the lowest scores and averages them, trading some robustness for the variance reduction of averaging. Byzantine resilience of eq. (46) requires

\[ K\geq2f+3. \tag{47} \]

Alternative rules include coordinate-wise median and trimmed mean, and geometric-median approaches such as RFA [82]. Differential privacy [83] addresses eq. (44) rather than poisoning, by adding calibrated noise to each update; for the Gaussian mechanism, (ε, δ)-differential privacy requires a noise scale

\[ \sigma\geq\frac{\Delta_2\sqrt{2\ln{(1.25/\delta)}}}{\varepsilon}, \tag{48} \]

where Δ₂ is the l₂ sensitivity of the update.

Condition eq. (47) is hard to satisfy in underwater clusters, because they are small. A cluster of K = 8 nodes tolerates f ≤ 2 by eq. (47), and a cluster of K = 5 tolerates none. Krum also requires all K updates to be present before scoring, so a single node whose acoustic link is degraded stalls the round. Both properties conflict with sparse, intermittently connected underwater topologies. The federated IoUT studies reviewed here cite robust aggregation as a mitigation without reporting K, f, or whether eq. (47) is satisfied in their configuration. Establishing which robust aggregation rules remain meaningful at the cluster sizes and connectivity typical of underwater deployment is an open problem, and it is stated as such in Section 9.

6.5 Blockchain and Clustering: Assumptions Against the Channel

A blockchain relies on consensus among participants, here the nodes, on the state of a shared ledger. However, consensus among the nodes requires communication. For example, a system in which K nodes must agree on each block exchange messages on the order of K per round for a leader-based protocol and K² for the Byzantine agreement protocols, usually invoked when an adversarial participant is assumed. According to eq. (43) and the link rates implied by eq. (13), this is the same budget problem that constrains federated learning in Section 6.4, because consensus is required per transaction rather than per training round.

Moreover, consensus protocols assume a participant set that is known and reachable, whereas underwater links fail intermittently. None of the blockchain-assisted IoUT schemes reviewed here reports its message complexity, its block interval, or its storage requirement. In their current form, distributed ledgers are not applicable to underwater networks, because the consensus mechanism needs to be investigated for this setting. Convergence under asynchronous and delayed communication has been studied in the distributed consensus literature [84,85], and those results can be applied to underwater networks.

Cluster-based detection assumes that a cluster head can observe its members, and that members are comparable to one another. The first assumption fails in sparse deployments, where a cluster head may have few members and each member few neighbours, so the neighbourhood baseline used for anomaly scoring is estimated from a handful of samples. The second assumes that the channel is the same for all members, but, as shown in Section 4, nodes at different depths experience different noise and channel variations, so deviation from the cluster mean is not evidence of misbehaviour.

Cluster maintenance in UWSNs includes energy-efficient aggregation within clusters [86] and the interaction between data gathering, node mobility, and topology change [87]. The aggregation strategy determines what a cluster head can observe, and therefore what it can detect. Position estimates underwater are uncertain and are obtained by optimisation over noisy range measurements [88,89], so a detector that scores nodes on position consistency, as several trust and Sybil detection schemes do, inherits that uncertainty as false positives. Separating localisation error from adversarial position falsification is an open problem.

6.6 Explainability of Learning-Based Detection (XAI)

None of the detectors reviewed in Table 7 reports any explanation mechanism. For a deployed IoUT system this is a practical problem. In a terrestrial network, an alert can be checked by examining the host and the traffic, and confirmed or dismissed at low cost. This is not possible for nodes deployed underwater. The usual response is to isolate the node, which removes its coverage from a network that is already sparse and may be exactly what an adversary intends. Section 5.7 showed that a failing node and a malicious node produce similar signatures, so an alert with no reason attached is hard to act on, and is likely to be ignored.

Post-hoc attribution methods explain an individual decision of a trained model. SHAP [90] assigns each input feature a contribution to the prediction using Shapley values from cooperative game theory, and LIME [91] fits a locally faithful linear surrogate around the instance being explained. Both are model-agnostic and both are expensive: SHAP requires many model evaluations per explanation, which is not ideal for a node operating under limited energy. The practical arrangement underwater is therefore to detect locally and analyse at the gateway, where the compute budget is higher. This requires that enough of the feature vector is transmitted to support the explanation.

Two requirements follow that are not addressed in the reviewed work. First, an explanation must distinguish adversarial cause from environmental cause. Second, the explanation must be cheap enough to transmit. By eq. (15) the cost of reporting grows with range, so an explanation that doubles the alert payload doubles the energy cost of alerting.

7. Datasets for IoUT Intrusion Detection

Section 6.1 showed that the reviewed methods cannot be compared partly because they are not evaluated on common data. This section examines the data available, since it underlies most of the evaluation problems identified above.

7.1 What is Available

The datasets used in this literature fall into three groups, and none of them is an IoUT intrusion dataset in the sense that CICIDS2017 and UNSW-NB15 are terrestrial intrusion datasets. KDD-99 and its revised version NSL-KDD [92] are commonly used, followed by UNSW-NB15 [93] and CICIDS2017 [94]. WSN-DS is also reported in a study [95] as it is generated from a wireless sensor network, but it is designed for a terrestrial LEACH-based network with radio links. Using these datasets for underwater environment means evaluating against a threat model that does not match the acoustic channel modelled in Section 4.

Most of the remaining studies generate their own data from a network simulator, typically NS-2 with Aqua-Sim, NS-3, or MATLAB. This does reproduce underwater propagation characteristics, but each study generates its own data, with its own topology, node count and mobility model, traffic profile, and attack implementation. The exception among the studies examined here is the dataset released by [2], which is publicly available.

Measured underwater acoustic data exists, but it was collected to characterise the communication channel rather than security. The Watermark benchmark [96], for instance, provides recorded at-sea channel responses for the replay-based evaluation of modulation schemes. Such data contains no intrusions and no labels, so it cannot be used directly to train or evaluate a detector, though it is a realistic basis for generating a channel against which synthetic attacks could be injected.

7.2 Why the Gap Persists

Generating a labelled underwater intrusion dataset is much harder than a terrestrial one. Deploying and recovering a test network is complex and expensive. Moreover, it is difficult to establish that a node behaved maliciously. Real attacks against a deployed network in open water raise legal and safety questions. Furthermore, the resulting data would be specific to one site, one season, and one topology, so its generality would be limited by exactly the environmental variability described by eqs. (5), (6), and (9).

7.3 Class Imbalance and Labelling

IoUT intrusion datasets are imbalanced, so a model trained on them without correction is biased towards the majority class. Common responses are resampling, for example SMOTE [97], and loss reweighting as in eqs. (33), and (34). Resampling changes the class ratio the model is trained on, and therefore the calibration of its output, whereas reweighting changes the decision boundary. For this reason the class ratio after resampling should be reported.

Labels are a second problem. In a simulation the label is exact, because the attack was scripted. In a real deployment it is not, since a failing node and a malicious node can behave alike (Section 5.7), so the label is itself an estimate.

7.4 Synthetic Data Generation

Given the data collection complexity, synthetic data is generated to simulate the IoUT network. Simulator-generated traces are the most common source, but their fidelity is bounded by the channel model in the simulator, which is typically the Urick and Thorp model eq. (2), and eq. (1) with a statistical multipath model. Replay-based generation uses measured channel responses such as those in [96] and injects synthetic attack traffic through them. This retains real channel statistics, including the variability that Section 4 identifies as a source of false alarms. Generative models learn the distribution of an existing dataset and sample from it. Generative adversarial networks [98] and their tabular variants [99] have been proposed for augmenting minority attack classes. However, a generative model trained on simulator output reproduces the simulator’s assumptions, including its channel model and the scripted attack signatures. Augmentation increases the quantity of training data, but not its information content.

7.5 What A Usable Dataset Would Require

A useful IoUT intrusion dataset would need to specify the channel conditions under which it was collected or generated, including sea state and shipping activity; the topology, node count, and ranges, since these set the propagation delay and hence the observation budget in eq. (14); and the labelling procedure and its uncertainty. For a real deployment it should also state the hardware on which the detector ran.

8. Deployment, Testbeds, and Standards

The detectors reviewed in Section 6 were designed and evaluated based on simulation or on recorded data. This section covers the deployment constraints that simulation does not capture, the testbeds that exist, and the standards that apply.

8.1 Deployment Constraints

Deploying UWSNs at scale is constrained by several factors that simulation rarely captures.

• Battery life. A deployed node runs on a fixed battery that cannot be replaced without recovering the node.
• Limited hardware. Nodes use low-power embedded processors, which limits the size of the model that can run on them.
• Biofouling and corrosion. Marine growth and corrosion degrade sensors and transducers over the course of a deployment.
• Infrequent servicing. Nodes are recovered every few months to years, so a fault or compromise can go unaddressed for a long time.
• No ground truth in the field. A deployed detector cannot be checked against a known label, so its false alarm rate cannot be measured directly.

8.2 Experimental Infrastructure

Infrastructure for at-sea experimentation exists and is more mature than the reviewed security literature suggests. The Littoral Ocean Observatory Network operated by the NATO STO Centre for Maritime Research and Experimentation in the Gulf of La Spezia is a cabled, persistent, remotely operable testbed for underwater communication and networking experiments [100]. It was extended and connected, together with facilities at the University of Porto and others, into the federated set of testbeds assembled by the SUNRISE project, accessible through a common interface [101]. On the software side, SUNSET [102] and DESERT Underwater [103] allow the same protocol implementation to be run in simulation, in emulation with real modems, and in a field trial, which removes the usual reimplementation step between a simulated result and a trial.

8.3 Digital Twins and Attack Emulation

A digital twin is a synchronised model of a physical system, updated from live telemetry and used for prediction and monitoring. For IoUT networks, it allows a candidate detector to be tested against attack scenarios that cannot be mounted against a real deployment. Moreover, it offers a reference for expected behaviour against which model performance can be compared. System-level digital twin modelling for IoUT networks has been proposed, combining a twin network with federated learning and a security prediction component [70].

8.4 Security Standards and Regulatory Frameworks

The first internationally adopted digital underwater acoustic communication standard is JANUS, developed at CMRE and promulgated as NATO STANAG 4748 in March 2017 [104,105]. It is open and free to use, and lets otherwise incompatible modems communicate with each other. Its design favoured interoperability over security, and the baseline packet has no authentication field [106]. Anyone within acoustic range can transmit using this protocol, including an adversary, so the replay, injection, and spoofing attacks in Table 5 are easier to mount. Work on secure and interoperable underwater acoustic communication is under way in the NATO IST-174 research task group [107], and authentication protocols built on JANUS have been proposed [106].

IEC 62443 [108] addresses industrial automation and control systems and provides a zone and conduit model, which maps reasonably onto the IoUT deployment. NIST SP 800-82 [109] covers operational technology security and starts from similar assumptions: devices last a long time, are hard to patch, and are physically exposed. All of these hold for underwater networks. However, neither standard accounts for the acoustic channel.

On the regulatory side, IMO Resolution MSC.428(98) requires cyber risk to be addressed in a ship’s safety management system [110], and the guidelines in MSC-FAL.1/Circ.3 follow the functions of the NIST Cybersecurity Framework [111]. Both are written for ships and the ship-to-port interface, so they do not obviously cover a seabed sensor network connected to a shore facility. We did not find a security standard written specifically for underwater networks.

Across the attacks summarised in Table 5, two needs remain unaddressed: authenticating acoustic traffic within tight link budgets, and incident response for nodes that cannot be reached physically. Section 9 states both as open problems.

9. Future Direction

We frame the challenges below as concrete research questions rather than broad topics. Each subsection examines the key obstacle that currently blocks progress, and Figure 7 summarises the overall landscape.

Figure 7 Possible Future Research Direction for IoUT.

9.1 Cross-Layer Detection Under a Joint Statistic

Section 5.6 showed that an attack constructed with T_i ≤ γ_i at every layer evades any layer-wise detection scheme, and that lowering the individual thresholds degrades precision. The open problem is to construct a joint statistic T_joint over per-layer observations that detects such attacks without requiring each layer to raise its own alarm. This problem breaks down into three key questions:

• which per-layer features must be shared, given the transmission energy costs?
• what baseline dependencies exist across layers during benign operation, ensuring that deviations reliably indicate an attack?
• can nodes compute the test statistic incrementally within the memory limits?

9.2 Communication-Efficient Federated Detection

Section 6.4 showed that federated learning at realistic model sizes does not fit an acoustic link. The open problem is to specify a federated scheme whose total payload under eq. (43) fits the link budget available at the deployment range, while retaining the accuracy of centralised training. This requires joint optimisation of quantisation, sparsification, and round reduction, since reducing rounds increases local epochs and therefore divergence.

9.3 Robust Aggregation at Underwater Cluster Sizes

Condition eq. (47) requires K ≥ 2f + 3, which underwater cluster sizes do not satisfy: eight nodes tolerate two adversaries and five tolerate none. Krum additionally blocks until all updates arrive, which intermittent links prevent. The open problem is to identify aggregation rules that remain meaningful at K ≤ 10 and tolerate missing updates, or alternatively to determine the cluster organisation under which existing rules become applicable.

9.4 Adaptive Thresholding Against Environmental Drift

Sections 4 and 5.7 identified two drift sources that are not adversarial: environmental variation, and monotonic sensor degradation from biofouling. A detector with a fixed decision boundary drifts with both. The open problem is a thresholding rule that tracks the environment without tracking the adversary, so that a slowly increasing attack is not absorbed into the baseline. This is harder than drift adaptation because the adversary can adapt to the drift.

9.5 Separating Malicious Nodes from Failing Ones

Section 5.7 identified this as the central weakness of trust-based detection underwater. A node suffering from biofouling, corrosion, or low battery tends to produce the behavioural signature of selective forwarding or false data injection. The open problem is to identify observable quantities that differ between the two cases.

9.6 Explainability Within the Alert Budget

Section 6.6 argued that an alert that cannot be justified will be ignored, because the response to an alert is expensive and slow. The open problem is an explanation that distinguishes adversarial from environmental cause. This is a joint constraint on explanation method and payload format, and it is not addressed by applying SHAP or LIME unmodified, since both assume the explanation is cheap to compute and free to deliver.

9.7 Long-Horizon Detection for Persistent Threats

Section 5.8 showed that IoUT is unusually exposed to slow attacks, because service intervals are long, reconnaissance is passive, and communication is slow. Detecting these requires correlating weak evidence over a long period of time, which conflicts with storage and energy limitation. The open problem is to determine what part of a node’s history must be transmitted for long-horizon detection at the gateway, and how a summary of it can be maintained on the node within its memory and energy budget.

9.8 A Common Reporting Template and a Shared Dataset

Section 6.1 showed that the reviewed methods cannot be ranked, and Section 7 showed that no common dataset exists. The open problem is an agreement on a reporting template and on at least one shared evaluation dataset.

9.9 Validation at Sea

No detector reviewed here reports a sea trial, yet Section 8 showed that the facilities exist and that frameworks such as SUNSET and DESERT Underwater allow the implementation to move from simulation to emulation with real modems. Running an IoUT intrusion detection method on real hardware over a real acoustic link, and reporting what changes, is complex and expensive.

9.10 Authentication and Response Within the Standards Gap

Section 8.4 identified two needs that no existing study addresses: authentication of acoustic traffic at a cost compatible with the link budget, and a defined response procedure for a compromise that cannot be physically reached. The first is a research problem, since the payload and computation budget for authentication under eqs. (13) and (16) is severe and JANUS has no authentication [106]. The second is mainly a standardisation problem.

10. Lessons Learned

This survey highlights unique challenges, types, and detection strategies required to secure the underwater network. IoUT operates in a harsh environment where the conventional IoT model is ineffective. The delayed propagation and long-range properties of acoustic communication make the IoUT network highly vulnerable to jamming. Variations of underwater characteristics complicate the security implementation. Moreover, nodes are battery-powered, and it is difficult to replace them. Energy-efficient algorithms are necessary to sustain operation in such an environment while maintaining detection accuracy. Machine learning, federated learning, and blockchain-based IDS have shown promise but require further optimisation for real-world underwater deployment. The limited availability of datasets is one of the biggest hurdles in designing secure UWSNs. Current studies rely mainly on synthetic data, which does not capture the variability of real underwater conditions, and in some cases terrestrial datasets that do not model the underwater channel.

Relying on a single detection layer is not enough for IoUT networks. Because attacks can target several layers at once, and can be constructed so that no single layer registers an anomaly, cross-layer protocols are required. Hybrid IDS models that combine signature-based, anomaly-based, and trust-based techniques may offer better adaptability and improved detection accuracy against threats. Federated learning also provides a decentralised way to strengthen security while preserving data privacy, whereas DOIDS can help detect anomalies with lower overhead. Since underwater conditions change over time, adaptive systems and machine learning-based IDS may become more practical for responding to new and emerging attacks.

Despite the challenges of deploying UWSNs, recent advances in hybrid IDS, machine learning, federated learning, and blockchain-based security show strong potential. However, practical deployment needs to focus on energy efficiency, and adaptive security mechanisms that can support resilient and scalable underwater networks.

11. Conclusion

IoUT is reshaping the monitoring and management of underwater environments and infrastructure, and effective intrusion detection is essential for maintaining network security, protecting data integrity, and ensuring reliable communication in these systems. The properties of the acoustic channel limit what a detector can achieve, since delay, bandwidth, and noise restrict the observations available to it. The attack surface of a complete IoUT deployment extends beyond the protocol layers, to application-layer, cross-layer, insider, and persistent threats, and the highest-severity attacks fall in precisely those categories. The reviewed detection methods cannot be compared with each other, because they do not evaluate their models against a unified set of criteria. As underwater applications continue to grow, there is a need for robust, adaptive, and lightweight intrusion detection frameworks.

Author Contributions

The author solely wrote the manuscript.

Funding

This research received no external funding.

Competing Interests

The author declares no competing interests.

AI-Assisted Technologies Statement

ChatGPT was used during manuscript revision to improve grammar and overall language. The scientific content, literature interpretation, analysis, and conclusions were developed by the author. All scientific content, data interpretation, and conclusions were developed independently by the author. The author has thoroughly reviewed and edited the AI-assisted text to ensure its accuracy and accept full responsibility for the content of the manuscript.