The proliferation of Internet of Things (IoT) devices has created a pressing need for efficient anomaly detection models that can operate under strict resource constraints. Conventional approaches, which rely on deep architectures or high‐dimensional feature representations, are often unsuitable for direct deployment in IoT environments due to limited computational capability and energy budgets. In addition, dynamic and noisy network traffic further challenges static feature selection strategies, leading to performance degradation over time. To address these issues, this paper presents LAD‐RL, a Double DQN–based framework for the automatic construction of lightweight network anomaly detection models. Unlike selecting features for a predetermined classifier alone, LAD‐RL jointly searches the feature subset and learning algorithm in an offline generation stage. A multimetric, thresholded reward balances detection effectiveness and model compactness, enabling resource‐efficient detectors without manual intervention. After policy convergence, only the resulting compact detector is deployed for inference, without requiring reinforcement learning operations at runtime. Experiments on CIC‐IDS‐2017, CIC‐IoT‐2023, and a real‐world enterprise traffic trace show that LAD‐RL yields competitive detection performance with reduced model complexity and stable feature selection across repeated runs. On CIC‐IDS‐2017, LAD‐RL achieves 99.09% accuracy with a 2.39% false‐positive rate, outperforming several baseline methods.
The Automatic Identification System (AIS) has become a cornerstone of modern maritime navigation, traffic management, and situational awareness, enabling continuous exchange of vessel identity, position, speed, and voyage‐related information across global maritime networks. While AIS significantly enhances navigational safety and operational efficiency, its open and unauthenticated broadcast design introduces critical cybersecurity vulnerabilities that can be exploited through spoofing, message replay, data manipulation, and denial‐of‐service attacks. These threats not only undermine trust in AIS data but also pose serious risks to maritime safety, security, and environmental protection. This paper presents a comprehensive and systematic review of AIS within the broader maritime communication and cybersecurity ecosystem. It examines the architectural foundations of AIS, its integration with physical and digital maritime infrastructures, and its evolving role in maritime domain awareness (MDA). Particular emphasis is placed on identifying inherent protocol‐level weaknesses and analyzing documented cyberattack vectors enabled by software‐defined radio technologies and unencrypted VHF communications. The review further synthesizes recent advances in machine learning and artificial intelligence techniques applied to AIS data, including anomaly detection, trajectory analysis, intrusion detection systems, and federated learning–based privacy‐preserving frameworks. By critically evaluating existing methodologies, datasets, and deployment challenges, this study highlights key limitations related to scalability, real‐time applicability, explainability, and adversarial robustness. Drawing insights from parallel developments in aviation cybersecurity, the paper outlines future research directions aimed at strengthening AIS resilience through adaptive, explainable, and policy‐aligned AI‐driven defenses. Overall, this work provides a structured foundation for advancing AIS cybersecurity research and supports the development of robust, data‐driven strategies to safeguard increasingly digitalized maritime operations.
