AIS and the Good vs. the Bad Guys

Ais Timecaster

How AIS and S-AIS data are deliberately or inadvertently misused to hide ships and ship behaviour from those who rely on AIS and S-AIS data

How AIS and S-AIS data are deliberately or inadvertently misused to hide ships and ship behaviour from those who rely on AIS and S-AIS

1. Anomaly Detection

AIS data is widely regarded as a way to track the "good guys". That is, it’s only useful for tracking cooperating ships. Many people think that this means AIS is not useful for some applications such as security, border protection or fighting illegal fishing. Yet, with the right tools, AIS can make an important and affordable contribution to these important applications.

Anomalies are simply events that are outside of the expected or normal result. Real-time tracking with AIS data can highlight many types of anomalies.

Intrinsic anomalies represent problems with the AIS message itself. Failed error checks are an obvious example that causes a message to be rejected upon arrival. Another example is impossible positions: a latitude of 91° (North or South) is not meaningful but can be reported in an ais shipping message. A more challenging example is a latitude of 90° (i.e: the North Pole). Although a valid position, it is unlikely that a vessel is actually at the North Pole.

Contextual anomalies represent message contents that are incompatible with known external truth. An example is an incorrect or mismatched IMO number being transmitted by particular MMSI.

Behavioural anomalies arise from invalid movements of a vessel. In this case, AIS data is compared to previous AIS data instead of an external data source. Doppelgangers are an example of a behavioural anomaly. Behavioural anomalies are particularly interesting since they can be used to define and tag suspicious vessels. Each mission or use case may define specific behaviour to be considered anomalous.

Any system for monitoring and alerting should be flexible enough to accommodate unique mission requirements. It should also be able to operate as close to real-time as possible. Alert latency is the time between the observance of an anomaly and the subsequent delivery of an alert or report to users who must act on that information.

2. Anomaly Detection Must Be Tuned

Each use case for anomaly detection requires a different approach. For example, a traffic or port management system may be interested in ensuring that vessels are transmitting accurate and timely position, IMO numbers, ship length, destination and other voyage data to ensure that berth assignments are optimized. An environmental management agency might be interested in a vessel that stops unexpectedly offshore to illegally dump ballast. A border protection agency might be interested in a vessel that stopped transmitting AIS while it is transferring smuggled goods at sea.

Generally, the most interesting anomalies are behavioural. Is the ship following the expected route? Is it being detected correctly? Is it headed for restricted waters?

Maerospace has found that a key challenge is to define (1) what constitutes a meaningful anomaly for a given use case, (2) how can we use the available data and patterns to detect the anomaly without generating too many false alarms and (3) how to present the results of the detection in a useful manner. All three of these factors require some work with the end user.

An anomaly detection might only compare new data with static rules such as entry into an area of interest. However, it must be predictive in nature in order to supply users with time to respond appropriately. As we have discussed in earlier blogs, AIS data is inherently old and incomplete.

An anomaly detection tool will be valuable if it can:

  • Predict ship movements into the future and compare these predictions with actual detections;
  • Compare predicted positions with defined areas of interest or boundary areas (e.g. national waters) and provide advance notification of entry in time to plan needed interdictions;
  • Track patterns in the data flows for all ships over time and compare new detections with these patterns;
  • Predict expected ship detections and alert when an expected detection does not occur; and
  • Provide flexibility and support to tune the anomaly rules by use case to ensure the right balance between detection sensitivity and false alarm rate.

These anomalies require a sophisticated tracking, alerting and reporting capability.

3. What to do with Anomalies

There are many types of anomalies and once detected, the event and the associated data must be acted upon to ensure proper resolution. The first question is what to do with anomalous data?

There are choices:

  • Ignore the Anomaly and Pass it on: This is the default for all raw AIS data providers.
  • Count and Delete: The count can be used to assess the number and frequency of the anomaly at the end of a period for future system improvements or to study the system or the ships of interest. In this case, a given anomaly check should be configured to delete the message and not pass it onto the next stage of processing or to the end customers.
  • Count and Pass: Similar to Count and Delete except that the data is passed on to the next stage of the process.
  • Count, Tag and Pass: Similar to the previous option but the AIS message can be tagged before being passed to the next stage of the process. This is appropriate when there is a downstream system that can process the tag for its own purposes.
  • Alerts: Alerts are pushed to users or downstream systems that need to act immediately on the anomaly.
  • Report: Reports are pushed or made available periodically containing the record of anomalies that occurred since the last report.

When selecting an AIS service, it is important to ensure that the anomaly detection and processing both fit the needs of the mission and that the timeliness of the anomaly processing is acceptable for the mission.

4. Maerospace ADVISOR®

The Anomaly Detection, Visualization and Operational Reporting (ADVISOR®) platform from Maerospace provides the real-time predictive analytics to support anomaly detection missions. For over five years, this tool has been providing a wide, and growing range of anomaly reports. Based on the company's world-leading TimeCaster™ technology, which provides the world's most accurate real-time and time-synchronized knowledge of ship positions globally, ADVISOR® generates alerts and reports to customers for each mission along with extensive support and the ability to integrate into other systems as needed.

About Maerospace Corporation

Maerospace Corporation, based in Canada, is a global supplier of real-time, predictive analytics to the maritime market. Their core product, TimeCaster™ provides a dramatic improvement in the accuracy and completeness of the maritime picture. Our Advisor™ product analyzes this information to detect and provide real-time alerts on anomalous behavior. TimeCaster™ and Advisor™ together deliver the world's most accurate picture of the maritime domain for maritime authorities internationally as well as for commercial ship and cargo tracking companies. For more information, visit or email us at

About cloudeo

cloudeo operates a unique, vendor independent, data agnostic market platform through which customers can obtain professional geoinformation services from leading national and international providers at low cost. Services include dedicated solutions for many industries; such as agriculture, urban and landscape planning, logistics, telecommunications, and water management. Customers are provided with high resolution imagery, 3D terrain models, thematic maps, and sensor data for a wide range of applications. The TimeCaster™ service in our cloudeo web application is available on our store.