AIS data is widely regarded as a way to track the "good guys." That is, it’s only useful for tracking cooperating ships. Many people think that this means AIS is not useful for some applications such as security, border protection, or fighting illegal fishing. With the right tools, AIS can make an important and affordable contribution to these important applications.

Anomalies are simply events that are outside of the expected or normal result. Real-time tracking with AIS data can highlight many types of anomalies:

• Intrinsic anomalies represent problems with the AIS message itself. Failed error checks are an obvious example that causes a message to be rejected upon arrival. Another example is impossible positions: a latitude of 91° (North or South) is not meaningful but can be reported in an ais shipping message. A more challenging example is a latitude of 90° (i.e., the North Pole). Although a valid position, it is unlikely that a vessel is actually at the North Pole.

• Contextual anomalies represent message contents that are incompatible with known external truth. An example is an incorrect or mismatched IMO number being transmitted by a particular MMSI.

• Behavioural anomalies arise from invalid movements of a vessel. In this case, AIS data is compared to previous AIS data instead of an external data source. Doppelgangers are an example of a behavioral anomaly. Behavioral anomalies are fascinating since they can be used to define and tag suspicious vessels. Each mission or use case may define specific behavior to be considered anomalous.

Any system for monitoring and alerting should be flexible enough to accommodate unique mission requirements. It should also be able to operate as close to real-time as possible. Alert latency is the time between the observance of an anomaly and the subsequent delivery of an alert or reports to users who must act on that information.

Anomaly Detection Must Be Tuned

Each use case for anomaly detection requires a different approach. For example, a traffic or port management system may be interested in ensuring that vessels transmit accurate and timely position, IMO numbers, ship length, destination, and other voyage data to ensure that berth assignments are optimized. An environmental management agency might be interested in a vessel that stops unexpectedly offshore to dump ballast illegally. A border protection agency might be interested in a vessel that stopped transmitting AIS while it is transferring smuggled goods at sea.

Generally, the most interesting anomalies are behavioral. Is the ship following the expected route? Is it being detected correctly? Is it headed for restricted waters?

Maerospace has found that a key challenge is to define (1) what constitutes a meaningful anomaly for a given use case, (2) how can we use the available data and patterns to detect the anomaly without generating too many false alarms, and (3) how to present the results of the detection in a useful manner. All three of these factors require some work with the end-user.

An anomaly detection might only compare new data with static rules such as entry into an area of interest. However, it must be predictive in nature to supply users with time to respond appropriately. As we have discussed in earlier blogs, AIS data is inherently old and incomplete.

An anomaly detection tool will be valuable if it can:

• Predict ship movements into the future and compare these predictions with actual detections

• Compare predicted positions with defined areas of interest or boundary areas (e.g., national waters) and provide advance notification of entry in time to plan needed interdictions

• Track patterns in the data flow for all ships over time and compare new detections with these patterns

• Predict expected ship detections and alert when an expected detection does not occur, and

• Provide flexibility and support to tune the anomaly rules using the case to ensure the right balance between detection sensitivity and false alarm rate.

These anomalies require sophisticated tracking, alerting, and reporting capability.

What to do with detected anomalies?

There are many types of anomalies and once detected, the event and the associated data must be acted upon to ensure proper resolution. The first question is what to do with anomalous data?

Here are the most common choices:

1. Ignore the Anomaly and Pass it on: This is the default for all raw AIS data providers.

2. Count and Delete: The count can be used to assess the number and frequency of the anomaly at the end of a period for future system improvements or to study the system or the ships of interest. In this case, a given anomaly check should be configured to delete the message and not pass it onto the next stage of processing or to the end customers.

3. Count and Pass: Similar to Count and Delete except that the data is passed on to the next stage of the process.

4. Count, Tag and Pass: Similar to the previous option but the AIS message can be tagged before being passed to the next stage of the process. This is appropriate when there is a downstream system that can process the tag for its own purposes.

5. Alerts: Alerts are pushed to users or downstream systems that need to act immediately on the anomaly.

6. Report: Reports are pushed or made available periodically containing the record of anomalies that occurred since the last report.

When selecting an AIS service, it is important to ensure that the anomaly detection and processing fit the mission's needs and that the timeliness of the anomaly processing is acceptable for the mission.

Maerospace ADVISOR®

The Anomaly Detection, Visualization, and Operational Reporting (ADVISOR®) platform from Maerospace provides real-time predictive analytics to support anomaly detection missions. For over five years, this tool has been providing a wide and growing range of anomaly reports. Based on the company's world-leading TimeCaster technology provides the world's most accurate real-time and time-synchronized knowledge of ship positions globally, ADVISOR® generates alerts and reports to customers for each mission along with extensive support and the ability to integrate into other systems as needed.

About Maerospace

This blog shared what Maerospace has learned about the realities of global AIS and Satellite-AIS. Over the past decade, Maerospace team has worked with every satellite AIS supplier and with users and analysts from around the world. In their work to provide a vastly improved maritime domain awareness data feed using advanced analytics, they have developed a deep understanding of what goes on in the complex global network of sensors that support AIS. The goal of this article was to share what Maerospace has learned in hopes that this precious resource can continue to be enhanced. With a proper understanding of the AIS system, this unique global resource can be a critical tool to help save lives, guard the borders, protect the environment and enhance trade.