Abstract

Smart ports now run on a dense mesh of information technology (IT), operational technology (OT), and Internet of Things (IoT) systems, and that connectivity has turned ports into high-value malware targets, as the 2017 NotPetya incident at Maersk demonstrated at a cost approaching $300 million to a single operator and roughly $10 billion globally. This article reviews the empirical machine learning (ML) literature on malware classification and the descriptive literature on smart port cybersecurity, identifies a gap between the two, and proposes a hybrid CNN-LSTM and gradient-boosted ensemble framework, supported by an explainable AI (SHAP) layer and a federated-learning deployment model, for malware classification and threat mitigation in smart port environments. The proposed framework is benchmarked conceptually against accuracy figures reported in recent literature (95.5–99.42 per cent across reviewed studies) rather than through original experimentation, and the article is explicit about this distinction throughout. The article contributes an integrated architecture, a dataset-combination strategy spanning EMBER2024, BODMAS, and CIC-MalMem2022, a threat-to-mitigation mapping specific to port IT/OT/IoT layers, and a research agenda for the empirical validation that the field still lacks.