False AIS ship trajectory detection method, device and equipment based on LSTM, and storage medium

Abstract

The invention provides an LSTM-based false AIS ship trajectory detection method, device and equipment and a storage medium, deep learning is performed on a ship historical behavior mode through an LSTM neural network, behavior characteristics are extracted from multiple dimensions such as speed, course and trajectory form, a time sequence dependency relationship is captured by using a memory mechanism of the LSTM, and a personalized'behavior fingerprint 'is established for each ship. And through a normal behavior index database constructed by KDTree, dynamic threshold detection based on a historical mode of the ship is realized, and a high false alarm rate caused by a unified threshold is avoided. During real-time detection, similarity matching is carried out on the current track characteristics and historical behavior fingerprints, so that not only can obvious position jump and other abnormalities be identified, but also careful forged tracks deviating from an inherent behavior mode can be found, and a technical breakthrough from single-dimensional rule detection to multi-dimensional intelligent identification is realized.

Description

TECHNICAL FIELD

[0001] The application relates to ship trajectory detection, in particular to an LSTM-based false AIS ship trajectory detection method, device, equipment and storage medium. BACKGROUND

[0002] With the rapid development of global maritime trade and marine activities, the automatic identification system (AIS) has become a core technical means for maritime traffic management and ship safety monitoring. The AIS system broadcasts the position, speed, heading and other key information of the ship in real time, and plays an irreplaceable role in ensuring navigation safety and improving the efficiency of maritime management. However, with the popularization and application of AIS technology, the problem of false AIS data is becoming increasingly serious, which has become a major hidden danger threatening maritime safety and marine governance.

[0003] The existing false AIS detection technology mainly relies on rule judgment and simple statistical analysis, such as time slot conflict detection, signal occupancy rate anomaly detection and other methods. However, the main defects of the current AIS deception detection method are the lack of modeling depth of ship behavior patterns, the lack of individualization of threshold setting and the singleness of detection dimension, which makes it difficult to effectively identify complex forgeries.

[0004] In view of this, the present application is proposed. SUMMARY

[0005] The application discloses an LSTM-based false AIS ship trajectory detection method, device, equipment and storage medium, aiming to solve the problem of insufficient accuracy in identifying complex false trajectories.

[0006] The first embodiment of the application provides an LSTM-based false AIS ship trajectory detection method, comprising: Obtaining ship AIS data stream in a target sea area, cleaning and processing the AIS data stream to generate a standardized trajectory data set, wherein the AIS data stream includes ship static information data and ship dynamic information data; Extracting a ship behavior feature vector based on the standardized trajectory data set, calling an LSTM neural network model to perform time series modeling on the behavior feature vector, generating a ship historical behavior representation, and constructing a ship normal behavior index library through a KDTree algorithm; Obtaining real-time AIS data points, extracting current trajectory features through a sliding window mechanism, performing similarity matching between the current trajectory features and the ship normal behavior index library, and determining trajectory authenticity according to a matching distance threshold to realize real-time detection of false trajectories.

[0007] Preferably, the cleaning and processing of the AIS data stream is specifically: Verify the coordinate validity of AIS data, limit the longitude range to [-180°, 180°], and limit the latitude range to [-90°, 90°], and remove data points that exceed the boundary; Calculate the Haversine distance d and time difference Δt between adjacent data points, and determine the jump point anomaly according to the expression: v = d / Δt; where v>60 knots or d>5km and Δt<30s, it is determined as a jump point and removed; Sort the data of the same MMSI by timestamp in ascending order, and remove data segments whose time reversal exceeds the preset length.

[0008] Preferably, the ship behavior feature vector is extracted based on the standardized trajectory data set, specifically: Resample the cleaned trajectory data at a fixed time interval to generate a standardized trajectory sequence with equal time intervals. For missing data points within a time interval, when the gap is less than a preset length, linear interpolation is used to fill in the gap, and when the gap is greater than the preset length, the trajectory is disconnected to form an independent trajectory segment. Based on the resampled equal-time-interval trajectory sequence, set the sliding time window size T minutes, which corresponds to m sampling points, and the window stepping time T_s seconds, which corresponds to a step length n=1 sampling point. For each trajectory sequence in the time window, when the number of valid data points is less than the minimum threshold, discard the window; calculate the speed statistical features, acceleration distribution features, heading change features, and trajectory shape features for the valid window. The speed statistical features include average speed, speed standard deviation, speed quantile, and maximum speed. The acceleration distribution features include average acceleration, acceleration standard deviation, and maximum absolute acceleration. The heading change features include average turning angle, turning angle standard deviation, average angular velocity, and maximum angular velocity. The trajectory shape features include linearity coefficient LS, curvature mean, curvature standard deviation, maximum curvature, path length, net displacement, and stop-to-go ratio. The expression of linearity coefficient LS is: LS = chord_length / path_length chord_length is the straight-line distance between the first and last points of the window, and path_length is the total length of the trajectory within the window.

[0009] Preferably, the LSTM neural network model is called to perform time series modeling on the behavior feature vector, specifically: The behavior feature vector sequence x t Input the LSTM network to process the time series dependency through the following gating mechanism, where, Forget gate calculation: ft =σ(W f ·[h t-1 ,x t ]+b f ) Input gate computation: i t =σ(W i ·[h t-1 ,x t ]+b i ) Candidate memory state generation: =tanh(W c ·[h t-1 ,x t ]+b c ) Memory cell update: c t =f t ⊙c t-1 +i t ⊙

[0010] Output gate computation: o t =σ(W o ·[h t-1 ,x t ]+b o ) Hidden state output: h t =o t ⊙tanh(c t ) Where σ is the Sigmoid activation function, tanh is the hyperbolic tangent activation function, W f , W i , W c , W o are weight matrices, b f , b i , b c , b o are bias vectors, ⊙ represents element-wise multiplication, h t-1 is the hidden state of the last time, c t-1 is the memory cell state of the last time. The mean pooling is performed on the hidden state sequence output by the LSTM to generate a fixed-dimensional ship behavior embedding vector h∈R^H, where H is the dimension of the embedding vector, and R represents the real number field.

[0011] Preferably, the ship historical behavior representation is used to construct a ship normal behavior index library by a KDTree algorithm, specifically: The window feature vector x and the embedding vector h output by the LSTM are spliced to generate a fusion representation: z=concat(h,x); Apply feature weights to fusion representation: z weighted =z⊙w; Wherein, w is a feature weight vector learned based on an attention mechanism; Collect all weighted fusion representations of historical normal voyage segments to form a matrix Z ∈ R^{N×(H+D)}, wherein N is the number of samples, H is the dimension of the embedding vector, D is the original feature dimension, R represents the real number field, and the matrix Z is used to construct a KDTree spatial index structure as a ship normal behavior index library.

[0012] Preferably, the real-time AIS data points are acquired, the current trajectory features are extracted through a sliding window mechanism, the current trajectory features are matched with the ship normal behavior index library in terms of similarity, and the trajectory authenticity is determined according to a matching distance threshold value, so as to realize real-time detection of false trajectories, and specifically: The trajectory sequence is extracted from the real-time AIS data stream according to the MMSI number, and the same sliding window mechanism as the historical data is applied to generate a real-time trajectory window; The real-time trajectory window is sequentially subjected to feature extraction, LSTM encoding and feature fusion weighting processing to generate real-time weighted fusion representation; The k-nearest neighbors of the real-time weighted fusion representation are queried in the KDTree index library, and the minimum Euclidean distance is calculated: d = min j ||z current -Z j || Wherein, z current is the real-time weighted fusion representation, Z j is the jth normal behavior sample in the index library, and according to a preset threshold value T, when d>T, it is marked as a false trajectory abnormal point; when d≤T, it is marked as a normal trajectory point.

[0013] Preferably, it further comprises: Performing morphological merging processing on the continuous abnormal windows to generate an abnormal trajectory segment; In the map visualization interface, the AIS points in the abnormal trajectory segment are marked as red, the normal trajectory points are marked as blue, and GeoJSON format data containing MMSI, timestamp, abnormal score and window number are output.

[0014] The second embodiment of the application provides a false AIS ship trajectory detection device based on LSTM, comprising: A preprocessing unit is configured to acquire ship AIS data stream in a target sea area, clean the AIS data stream to generate a standardized trajectory data set, wherein the AIS data stream comprises ship static information data and ship dynamic information data; The index building unit is used to extract ship behavior feature vectors based on the standardized trajectory dataset, call the LSTM neural network model to perform time-series modeling on the behavior feature vectors, generate ship historical behavior representations, and build a ship normal behavior index library using the KDTree algorithm on the ship historical behavior representations. The authenticity determination unit is used to acquire real-time AIS data points, extract current trajectory features through a sliding window mechanism, match the current trajectory features with the ship normal behavior index database for similarity, and determine the authenticity of the trajectory based on the matching distance threshold, so as to realize the real-time detection of false trajectories.

[0015] The third embodiment of the present invention provides a fake AIS ship trajectory detection device based on LSTM, including a memory and a processor. The memory stores a computer program, which can be executed by the processor to implement the fake AIS ship trajectory detection method based on LSTM as described in any of the above embodiments.

[0016] The fourth embodiment of the present invention provides a computer-readable storage medium, characterized in that it stores a computer program, which can be executed by the processor of the device where the computer-readable storage medium is located, to implement the LSTM-based method for detecting fake AIS ship trajectories as described in any of the above embodiments.

[0017] This invention provides a method, apparatus, device, and storage medium for detecting fake AIS ship trajectories based on LSTM. It utilizes LSTM neural networks to deeply learn historical ship behavior patterns, extracting behavioral features from multiple dimensions such as speed, heading, and trajectory morphology. The LSTM's memory mechanism captures temporal dependencies, creating a personalized "behavioral fingerprint" for each ship. A normal behavior index library built using KDTree enables dynamic threshold detection based on the ship's own historical patterns, avoiding the high false alarm rate caused by uniform thresholds. During real-time detection, similarity matching between current trajectory features and historical behavioral fingerprints not only identifies obvious positional jumps but also detects carefully forged trajectories that deviate from established behavioral patterns, achieving a technological breakthrough from single-dimensional rule detection to multi-dimensional intelligent recognition. Attached Figure Description

[0018] Figure 1 This is a flowchart illustrating a method for detecting fake AIS ship trajectories based on LSTM, provided in the first embodiment of the present invention. Figure 2 This is a schematic diagram of map rendering provided by the present invention; Figure 3 This is a schematic diagram of a module of a fake AIS ship trajectory detection device based on LSTM provided in the second embodiment of the present invention. Detailed Implementation

[0019] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0020] To better understand the technical solution of the present invention, the embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

[0021] This invention discloses a method, apparatus, device, and storage medium for detecting fake AIS ship trajectories based on LSTM, aiming to solve the problem of insufficient accuracy in identifying complex fake trajectories.

[0022] Please see Figure 1 The first embodiment of the present invention provides a method for detecting fake AIS ship trajectories based on LSTM, which can be executed by an LSTM-based fake AIS ship trajectory detection device (hereinafter referred to as the detection device or system), specifically, by one or more processors within the auxiliary device, to at least implement the following steps. S101, acquire the ship AIS data stream in the target sea area, clean the AIS data stream, and generate a standardized trajectory dataset, wherein the AIS data stream includes ship static information data and ship dynamic information data; In this embodiment, the detection device can be a desktop computer, server, workstation, or other terminal with data processing capabilities. The detection device can be equipped with a corresponding operating system and application software, and the functions required in this embodiment can be achieved through the combination of the operating system and application software.

[0023] In this embodiment, the ship AIS data stream within the target sea area is first acquired. The AIS data stream is transmitted in real-time from the AIS base station receiver to the data processing center via TCP / UDP protocol or Kafka message queue. Each AIS data record contains two main categories: ship static information data and ship dynamic information data. The ship static information data includes relatively fixed identification information such as MMSI number (Maritime Mobile Service Identifier), ship name, call sign, ship type, and IMO number. The ship dynamic information data includes real-time changing motion parameters such as longitude (lon), latitude (lat), speed over land (sog, unit: knots), heading over land (cog, unit: degrees), heading (hdg, unit: degrees), timestamp (ts), navigation status (nav_status), and turning rate (rot, unit: degrees / minute).

[0024] Upon receiving the raw AIS data stream, the system performs a data cleaning process to ensure data quality. First, coordinate validity is verified. The system checks whether the latitude and longitude values ​​of each data point are within a reasonable range of geographic coordinates. Specifically, for the longitude field `lon`, it verifies whether it satisfies -180° ≤ lon ≤ 180°; for the latitude field `lat`, it verifies whether it satisfies -90° ≤ lat ≤ 90°. Any data point outside this range is considered to have abnormal coordinates and is immediately removed. For example, when an AIS record containing `lat = 95.3°` is received, the system determines that this latitude value is outside the range of the North Pole, marks the entire record as invalid, and deletes it from the dataset.

[0025] Subsequently, the system performs jump point anomaly detection on the data that has passed coordinate verification. For consecutive data points with the same MMSI number, the system calculates the Haversine surface distance d (in meters) between adjacent points. The Haversine formula takes into account the curvature of the Earth, and the calculation formula is as follows: a=sin 2 (Δlat / 2) + cos(lat1)×cos(lat2)×sin 2 (Δlon / 2) c = 2 × atan2(√a, √(1-a)) d=R×c Where R is the Earth's radius (approximately 6371 kilometers), and Δlat and Δlon are the latitude and longitude differences between the two points, respectively.

[0026] Simultaneously, the timestamp difference Δt (in seconds) between the two data points is extracted, and the instantaneous speed v = d / Δt is calculated. The system sets dual judgment conditions: when the calculated speed v exceeds 60 knots (approximately 111 km / h, exceeding the maximum speed of a typical ship), or when d is greater than 5 km and Δt is less than 30 seconds (indicating that the ship has moved an unreasonable distance in a very short time), an anomaly is judged to exist. For example, a cargo ship with MMSI 412345678 is located at (121.5°E, 31.2°N) at timestamp t1 = 1635840000, and is recorded as located at (122.1°E, 31.8°N) at timestamp t2 = 1635840020. The calculated d ≈ 85 km, Δt = 20 seconds, and the instantaneous speed is approximately 8330 knots, far exceeding the physical limit. The system judges the data point at time t2 as an anomaly and discards it.

[0027] Finally, the system performs a time consistency check on the data. All data points within the same MMSI are sorted in ascending order by timestamp (ts) to detect any time reversal. If a data point's timestamp is found to be more than 2 minutes earlier than the previous data point's timestamp, the system determines that the vessel may have equipment malfunction or signal interference, and either removes all data from that abnormal time period or breaks the trajectory at that point, creating an independent trajectory segment.

[0028] S102, Based on the standardized trajectory dataset, extract the ship behavior feature vector, call the LSTM neural network model to perform time series modeling on the behavior feature vector, generate the ship historical behavior representation, and construct the ship normal behavior index library by using the KDTree algorithm to construct the ship historical behavior representation. After obtaining the standardized trajectory dataset, the system begins to extract feature vectors that characterize ship behavior patterns. Specifically, the cleaned trajectory data is resampled at fixed time intervals to generate standardized trajectory sequences with equal time intervals, the fixed time intervals being set to 30 to 60 seconds. For missing data points within the time intervals, linear interpolation is used to fill in gaps less than 5 minutes, and the trajectories are broken into independent trajectory segments when the gaps are greater than 5 minutes.

[0029] Based on the resampled trajectory sequences with equal time intervals, a sliding time window size of T_w = 5 minutes is set, corresponding to m = 10 sampling points (when the sampling interval is 30 seconds). The window step time T_s = 30 seconds, corresponding to a step size of n = 1 sampling point. For the trajectory sequence within each time window, if the number of valid data points is less than the minimum threshold N_min = 6, the window is discarded. For the valid windows, velocity statistical characteristics, acceleration distribution characteristics, heading change characteristics, and trajectory morphology characteristics are calculated. For each sliding window containing a sequence of 10 trajectory points, the system first calculates the single-point derivation as the basis for subsequent statistics. For the i-th data point within the window, the Haversine distance d_i between it and the previous point is calculated as the displacement. Combined with the time difference Δt_i, the instantaneous velocity v_i = d_i / Δt_i is calculated, and the velocity unit is uniformly converted to knots. The acceleration a_i = (v_i - v_{i-1}) / Δt_i is obtained through velocity difference. The rate of change of heading is calculated using Δcog_i = wrap(cog_i - cog_{i-1}) / Δt_i, where the wrap function normalizes the angle difference to the range of [-180°, 180°], avoiding the problem of 359° to 1° being incorrectly calculated as 358°. The steering angle θ_i is also wrapped. The angular velocity ω_i = θ_i / Δt_i reflects the ship's steering agility. The curvature approximation κ_i ≈ 2 × sin(θ_i / 2) / d_i is used to describe the curvature of the trajectory. A small amount ε = 0.001 is added to the denominator during the calculation to prevent division by zero error.

[0030] Based on these single-point derived quantities, the system extracts statistical features at the window level. The speed statistical features comprehensively characterize the speed distribution of the ship, including the average speed mean(v) reflecting the conventional speed, the speed standard deviation std(v) measuring the degree of speed variation, the speed percentiles p10(v), p50(v), p90(v) representing the 10%, 50%, and 90% quantiles of the speed distribution respectively, and the maximum speed max(v) identifying the speed peak. The acceleration distribution features quantify the acceleration and deceleration behavior patterns of the ship through three indicators: the average acceleration mean(a), the acceleration standard deviation std(a), and the maximum absolute acceleration max(|a|). The course change features describe the turning behavior of the ship from multiple perspectives. The average turning angle mean(|θ|) represents the overall turning amplitude, the standard deviation of the turning angle std(θ) reflects the regularity of turning, and the average angular velocity mean(|ω|) and the maximum angular velocity max(|ω|) characterize the speed of turning.

[0031] The trajectory shape features provide a deep description of the geometric characteristics of the track. The linearity coefficient LS is obtained by calculating the ratio of the straight-line distance chord_length between the first and last points of the window to the accumulated path length path_length of all adjacent points within the window, that is, LS = chord_length / path_length. Its value range is [0,1]. The closer it is to 1, the closer the trajectory is to a straight line, which is of great significance for identifying normal routes and abnormal detours. The curvature features quantitatively describe the bending characteristics of the trajectory through three statistics: the mean mean(κ), the standard deviation std(κ), and the maximum value max(κ). The path length path_length and the net displacement net_displacement represent the actual sailing distance and the straight-line distance between the starting and ending points respectively. The ratio of the two reflects the degree of detour of the sailing. The stop ratio is obtained by calculating the proportion of data points with a speed less than the stop threshold (such as 0.5 knots), and ratio(v < v_stop) can identify the anchoring or drifting state of the ship. In addition, the system also records the time span of the window, the data missing rate, and the mark of whether it crosses segments, forming time regularization features.

[0032] After multi-dimensional feature extraction, each sliding window is represented as a feature vector x ∈ R^D with a fixed dimension. In this embodiment, the dimension D is approximately 25 to 60 dimensions, specifically depending on the selected feature subset. To ensure the comparability of features with different dimensions, the system normalizes all feature dimensions. By calculating the mean μ and standard deviation σ of each feature on the training set, the feature values are converted into the z-score form: x_normalized = (x - μ) / σ. The normalization parameters are saved in the scaler.pkl file for use during online inference.

[0033] Furthermore: After extracting the ship behavior feature vectors, the system uses a Long Short-Term Memory (LSTM) network to perform deep temporal modeling of these features to capture the temporal evolution patterns and long-term dependencies of ship behavior. In this embodiment, the system uses the windowed behavior feature vector sequence x t As input to the LSTM network, each x t The feature vector representing the t-th time step contains multi-dimensional feature information such as velocity, acceleration, heading change, and trajectory morphology extracted within that time window.

[0034] LSTM networks, through their unique gating mechanism, process input temporal data, effectively solving the gradient vanishing problem in long sequence learning of traditional recurrent neural networks. The core computational process of the network begins with the forget gate, which is determined by formula f. t =σ(W f ·[h t-1 ,x t ]+b f The calculation yields W, where σ represents the Sigmoid activation function, which compresses the output value to the [0,1] interval. f Let b be the weight matrix of the forget gate. f For the corresponding bias vector, [h t-1 ,x t ] indicates that the hidden state h from the previous time step is... t-1 With the current input x t Perform splicing. The output f of the forget gate. t The memory unit c of the previous moment is determined t-1 The mechanism determines which information should be retained, with values ​​close to 1 indicating complete retention and close to 0 indicating complete forgetting. This allows the network to adaptively filter historical information.

[0035] Input gate via i t =σ(W i ·[h t-1 ,x t ]+b i )Calculates and controls which parts of the current input information should be written into the memory unit, W i and b i These are the weight matrix and bias vector of the input gate, respectively. Simultaneously, the network generates candidate memory states. =tanh(W c ·[h t-1 ,x t ]+b c ), where tanh is the hyperbolic tangent activation function, mapping the output to the interval [-1, 1], W c and b cThese are the weights and bias parameters for the candidate memories. The candidate memory state contains potentially important information extracted from the current input and historical hidden states, representing new knowledge that may need to be stored.

[0036] The updating of memory cells is the core step of LSTM, achieved through formula c. t =f t ⊙c t-1 +i t ⊙ The implementation, where ⊙ represents element-wise multiplication. The update mechanism selectively preserves historical memory (f t ⊙c t-1 ) and selective addition of new information (i t ⊙ This combination of features allows the network to continuously absorb new behavioral patterns while maintaining long-term memory. For example, when a ship transitions from normal navigation to berthing in port, the network gradually reduces the weight of high-speed navigation features and increases its focus on low-speed maneuvering features.

[0037] The output gate passes through o t =σ(W o ·[h t-1 ,x t ]+b o The calculation determines which information in the memory unit should be output to the current hidden state. o and b o The weights and biases of the output gate are given. The final hidden state is determined by h. t =o t ⊙tanh(c t The hidden representation is obtained by multiplying the state of the memory cell activated by tanh with the output gate, resulting in a hidden representation that contains both historical information and reflects current features. This hidden state h t It not only serves as input for the next moment in subsequent calculations, but also carries information on the ship's behavior patterns up to the current moment.

[0038] In actual training, the system uses the backpropagation algorithm to optimize all weight matrices W over time (BPTT). f W i W c W o and bias vector b f b i b c b oThe Adam optimizer is used to update parameters with an initial learning rate of 0.001, and gradient clipping is used to prevent gradient explosion. After the network processes the entire input sequence, a series of hidden states are obtained. The system performs mean pooling on these hidden state sequences, i.e., calculates h_embed=(1 / T)∑_{t=1}^{T}h_t, generating a fixed-dimensional ship behavior embedding vector h_embed∈R^H, where R represents the real number field and H is the dimension of the embedding vector. In this embodiment, H=64 is set. It should be noted that the pooling operation integrates information from all time steps in the sequence, and the resulting embedding vector h_embed becomes a highly condensed representation of the ship's behavior pattern within a specific time period.

[0039] Furthermore: The system first performs a feature fusion operation, concatenating the original feature vector x∈R^D extracted from each sliding window with the corresponding LSTM output embedding vector h_embed∈R^H to generate a fused representation z=concat(h_embed,x)∈R^{H+D}. It should be noted that the fusion strategy fully utilizes the complementary advantages of the two types of features. The original feature vector x retains interpretable physical quantities such as velocity, acceleration, and heading changes; its dimension D is approximately 40 in this embodiment, covering all extracted statistical features. The LSTM embedding vector h_embed provides a high-level abstract representation extracted through deep learning; its dimension H is set to 64, enabling it to capture complex temporal patterns that are difficult to directly express in the original features. The concatenated fused representation z has a dimension of 104, maintaining both feature interpretability and enhanced expressive power.

[0040] To highlight the differences in the contribution of different feature dimensions to anomaly detection, the system introduces a feature weighting strategy based on an attention mechanism. During training, the system learns a feature weight vector w∈R^{H+D} through a lightweight attention network. This network uses a single fully connected layer followed by a Sigmoid activation function, with the fused representation z as input and the corresponding weight w=σ(W_att·z+b_att) as output, where W_att and b_att are learnable parameters. During training, the system uses labeled normal and abnormal trajectory samples, optimizing the weight parameters by maximizing the intra-class tightness of normal samples and the inter-class separation of abnormal samples. After training, the system found that certain feature dimensions, such as mean angular velocity (mean(|ω|), standard deviation of steering angle (std(θ)), and linearity coefficient (LS), obtained higher weight values ​​(typically between 0.7 and 0.9), indicating that these features have stronger discriminative power for identifying abnormal trajectories, while the weights of some redundant features are close to 0. The learned weight vector is stored in the weights.json file.

[0041] The weighting operation is achieved through element-wise multiplication, i.e., z_weighted = z⊙w, where ⊙ represents the Hadamard product. This weighting mechanism allows important features to have greater weight in subsequent distance calculations. For example, if a ship's steering behavior is abnormal while its speed remains normal, the weighted representation will highlight the abnormal steering-related features more prominently, improving detection sensitivity. In practice, the system can learn different weight configurations for different types of ships; for example, cargo ships focus more on speed and straightness features, while fishing vessels place greater emphasis on steering and stop-and-go ratio features.

[0042] The index is built based on rigorously screened historical normal voyage data. The system selects verified and reliable ship tracks from the historical AIS database. These tracks must meet several conditions: good continuity (data missing rate less than 5%), sufficient time span (containing at least 1000 valid data points), coverage of diverse navigation scenarios (including ocean voyages, near-shore voyages, port entry and exit, etc.), and coverage of different sea conditions (calm, moderate, and severe weather). A sliding window and feature extraction process are applied to each normal track to generate a corresponding weighted fusion representation z_weighted. The representation vectors of all samples are stacked row-wise to form a matrix Z∈R^{N×(H+D)}, where N is the total number of collected normal samples. In this embodiment, N is approximately 50,000 samples.

[0043] The KDTree spatial index structure is constructed using sklearn.neighbors.KDTree, with Euclidean distance chosen as the metric. The leaf node size is set to 30 to balance construction time and query efficiency. KDTree recursively divides the feature space into hyperrectangular regions, making each node represent a spatial partition. This tree structure reduces the time complexity of k-nearest neighbor queries from O(N) of brute-force search to O(log N). For an index containing 50,000 samples, the query time is reduced from seconds to milliseconds. The completed KDTree index is serialized and saved as a kdtree.pkl file using joblib.dump(), with a file size of approximately 20MB. Simultaneously, the system also saves the corresponding ship metadata table ship_vectors.parquet, recording attributes such as MMSI number, time period, and ship type for each index sample, facilitating subsequent result traceability and analysis.

[0044] S103, acquire real-time AIS data points, extract current trajectory features through a sliding window mechanism, match the current trajectory features with the ship normal behavior index database for similarity, and determine the authenticity of the trajectory based on the matching distance threshold, so as to realize the real-time detection of false trajectories.

[0045] In this embodiment, the system continuously receives real-time data streams from AIS base stations via TCP / UDP ports or Kafka message queues. The data receiving module maintains a hash table structure based on MMSI numbers, aggregating AIS data points belonging to the same vessel into corresponding buffer queues. Each MMSI's corresponding buffer queue adopts a circular buffer design with a capacity of 100 data points. When a new AIS data point arrives, the system first performs the same data cleaning process as in Embodiment 1, including coordinate validity verification, jump point detection, and time consistency checks, ensuring the reliability of the data entering the detection process. The cleaned data points are appended to the end of the corresponding MMSI's buffer queue. When the queue is full, the oldest data point is automatically removed, maintaining dynamic updates to the queue.

[0046] The generation of real-time trajectory windows strictly follows the same sliding window mechanism as historical data processing to ensure consistency in the feature space. Once sufficient data points have accumulated in the buffer queue of a certain MMSI, the system generates a sliding window with a window size W=10 and a step size S=1. Whenever a new data point is added to the queue, the system generates a new window for real-time detection. It should be noted that the point-by-point sliding strategy ensures a rapid response to abnormal behavior. When there are fewer than 10 data points in the queue, the system adopts an adaptive data point replenishment strategy, prioritizing the search for the nearest data point from the historical cache of the same MMSI. If historical data is still insufficient, it waits for new data to arrive until the window size requirement is met. For newly appearing MMSIs or ships reappearing after a long period of silence, the system marks its initial windows as a "cold start" state, appropriately relaxing the anomaly detection threshold to reduce false alarms.

[0047] The feature extraction and encoding process fully reuses the processing pipeline from the offline training phase, ensuring feature consistency. For each real-time trajectory window, the system first extracts multi-dimensional behavioral features, calculating velocity statistics mean(v), std(v), and max(v), acceleration features mean(a) and max(|a|), heading change indices mean(|θ|) and std(ω), and trajectory morphology parameters LS and mean(κ), forming the original feature vector x_current∈R^D. During feature extraction, the normalization parameters in the pre-loaded scaler.pkl file are used to perform z-score normalization on x_current: x_normalized=(x_current-μ) / σ, ensuring that the real-time features are consistent with the feature distribution during training. The normalized feature vector is input into the pre-trained LSTM model, which is loaded from the lstm.pt file and set to evaluation mode to disable training features such as dropout. After processing the window sequence, the LSTM network outputs the hidden state sequence, which is then averaged to obtain the embedding vector h_current∈R^H.

[0048] The fusion and weighting process combines the original features with the deep representation to generate the final query vector. The system performs a concatenation operation z_current=concat(h_current,x_current)∈R^{H+D} to obtain a 104-dimensional fused representation. The pre-trained feature weight vector w is loaded from the weights.json file, and element-wise weighting z_weighted_current=z_current⊙w is performed to highlight the contribution of important feature dimensions. The entire feature processing flow is optimized, with the processing time for a single window controlled within 5 milliseconds, including approximately 2 milliseconds for feature extraction, approximately 2 milliseconds for LSTM forward propagation, and approximately 1 millisecond for fusion and weighting.

[0049] Similarity matching utilizes the KDTree index for fast nearest neighbor lookup. The system uses `z_weighted_current` as the query point and calls the pre-loaded index structure in `kdtree.pkl` to perform a k-nearest neighbor search. In this embodiment, k=5 is set, meaning the 5 most similar historical normal samples are searched. This multi-nearest neighbor strategy improves the robustness of detection. KDTree returns the 5 nearest neighbors and their corresponding Euclidean distances [d1,d2,d3,d4,d5]. The system takes the minimum distance d=min{d1,d2,d3,d4,d5} as the anomaly metric score. The distance is calculated using the Euclidean distance formula: d=√(Σᵢ(z_weighted_current[i]-Z_j[i])). 2 Z_j represents the j-th normal behavior sample in the index. Thanks to KDTree's efficient index structure, even in an index containing 50,000 samples, a single query only takes 2-3 milliseconds.

[0050] Anomaly detection is based on a distance threshold T for binary classification. The threshold T is determined through ROC curve analysis during offline validation. The system tests the true positive rate (TPR) and false positive rate (FPR) at different thresholds on a labeled validation set, and selects the threshold that maximizes the F1 score as the default value. In this embodiment, T=2.5. When the minimum distance d is greater than the threshold T, the system determines that the AIS point at the center of the current window is a false trajectory anomaly point and assigns it a red mark; when d is less than or equal to T, it is determined to be a normal trajectory point and assigned a blue mark. To improve the stability of detection, the system also implements a continuous window voting mechanism. Only when three or more consecutive windows are determined to be anomalies is the time period finally confirmed as a false trajectory segment, effectively reducing false alarms caused by occasional data fluctuations. The detection results are output in real time in GeoJSON format, containing attributes {mmsi: ship identifier, ts: timestamp, lat: latitude, lon: longitude, is_anomaly: whether it is anomaly, score: anomaly score d, confidence: confidence level}, and are pushed to the front-end map interface via WebSocket to realize real-time visualization of abnormal trajectories. The end-to-end latency of the entire testing process, from data reception to result output, is controlled within 50 milliseconds, meeting the stringent real-time requirements of maritime supervision.

[0051] In one possible implementation of the present invention, it further includes: Please combine Figure 2 The system performs morphological merging on consecutive abnormal windows, aggregating discrete abnormal points into continuous abnormal trajectory segments. Because adjacent windows in the sliding window mechanism overlap by nine data points, a single abnormal data point may be detected repeatedly in multiple windows, necessitating deduplication and merging. The system first arranges all abnormal windows chronologically and uses morphological dilation to fill small gaps. Specifically, when the time interval between two abnormal windows is less than three data points, the normal point in between is also marked as abnormal, forming a continuous abnormal segment. Then, morphological erosion is performed to remove isolated abnormal points. If an abnormal segment is less than two windows in length (i.e., less than 11 data points), it is remarked as normal. This "dilation-then-erosion" strategy effectively smooths the detection results and avoids overly fragmented abnormal labeling. After morphological processing, the system outputs the final list of abnormal trajectory segments, with each segment recording its start time, end time, number of data points, and average abnormal score.

[0052] The visualization module, based on the Leaflet map engine, provides interactive display of abnormal trajectories. The system converts the processed detection results into GeoJSON format, a JSON-based geospatial data exchange format widely supported by various map applications. Each AIS data point is encoded as a Point type Feature object, whose geometric attribute includes latitude and longitude coordinates [lon, lat], and the properties field contains {mmsi: maritime mobile communication service identifier, ts: Unix timestamp, is_anomaly: boolean anomaly marker, score: anomaly score (minimum distance d from normal samples), window_id: the sliding window number}. The system assigns a visualization style to each point based on the is_anomaly field: anomaly points are marked with a red circle with a radius of 6 pixels for emphasis, while normal points are marked with a blue circle with a radius of 4 pixels for visual balance. All points are organized into a FeatureCollection structure for easy batch rendering and layer management on the front end. The map interface supports user interaction. Clicking on any trajectory point will pop up an information window displaying detailed information about that point, including precise time, speed (SOG), heading (COG), anomaly score, and the time range of the window it belongs to, helping analysts quickly locate and analyze the causes of anomalies. The system also provides a trajectory playback function, which can dynamically display the evolution of the vessel's movement trajectory and anomaly detection results in chronological order. Anomaly segments are highlighted with red trajectory lines, and the timeline control allows for convenient backtracking of historical data. Through this intuitive visualization method, maritime regulators can quickly identify suspicious vessel behavior.

[0053] Please see Figure 3 The second embodiment of the present invention provides a fake AIS ship trajectory detection device based on LSTM, comprising: The preprocessing unit 201 is used to acquire ship AIS data streams in the target sea area, clean the AIS data streams, and generate a standardized trajectory dataset. The AIS data streams include ship static information data and ship dynamic information data. The index library construction unit 202 is used to extract ship behavior feature vectors based on the standardized trajectory dataset, call the LSTM neural network model to perform time series modeling on the behavior feature vectors, generate ship historical behavior representations, and construct a ship normal behavior index library using the KDTree algorithm for the ship historical behavior representations. The authenticity judgment unit 203 is used to acquire real-time AIS data points, extract current trajectory features through a sliding window mechanism, match the current trajectory features with the ship normal behavior index database for similarity, and determine the authenticity of the trajectory based on the matching distance threshold, so as to realize the real-time detection of false trajectories.

[0054] The third embodiment of the present invention provides a fake AIS ship trajectory detection device based on LSTM, including a memory and a processor. The memory stores a computer program, which can be executed by the processor to implement the fake AIS ship trajectory detection method based on LSTM as described in any of the above embodiments.

[0055] The fourth embodiment of the present invention provides a computer-readable storage medium, characterized in that it stores a computer program, which can be executed by the processor of the device where the computer-readable storage medium is located, to implement the LSTM-based method for detecting fake AIS ship trajectories as described in any of the above embodiments.

[0056] This invention provides a method, apparatus, device, and storage medium for detecting fake AIS ship trajectories based on LSTM. It utilizes LSTM neural networks to deeply learn historical ship behavior patterns, extracting behavioral features from multiple dimensions such as speed, heading, and trajectory morphology. The LSTM's memory mechanism captures temporal dependencies, creating a personalized "behavioral fingerprint" for each ship. A normal behavior index library built using KDTree enables dynamic threshold detection based on the ship's own historical patterns, avoiding the high false alarm rate caused by uniform thresholds. During real-time detection, similarity matching between current trajectory features and historical behavioral fingerprints not only identifies obvious positional jumps but also detects carefully forged trajectories that deviate from established behavioral patterns, achieving a technological breakthrough from single-dimensional rule detection to multi-dimensional intelligent recognition.

[0057] Exemplary examples show that the computer program described in the third and fourth embodiments of the present invention can be divided into one or more modules, which are stored in the memory and executed by the processor to complete the present invention. The one or more modules can be a series of computer program instruction segments capable of performing specific functions, which describe the execution process of the computer program in implementing an LSTM-based fake AIS ship trajectory detection device. For example, the apparatus described in the second embodiment of the present invention.

[0058] The processor referred to can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor. This processor is the control center of the LSTM-based fake AIS ship trajectory detection method, connecting various parts of the entire LSTM-based fake AIS ship trajectory detection method through various interfaces and lines.

[0059] The memory can be used to store the computer program and / or modules. The processor, by running or executing the computer program and / or modules stored in the memory, and by calling the data stored in the memory, implements various functions of an LSTM-based fake AIS ship trajectory detection method. The memory may mainly include a program storage area and a data storage area. The program storage area may store the operating system, at least one application program required for a function (such as sound playback function, text conversion function, etc.), etc.; the data storage area may store data created based on the use of the mobile phone (such as audio data, text message data, etc.). In addition, the memory may include high-speed random access memory, and may also include non-volatile memory, such as hard disk, memory, plug-in hard disk, smart media card (SMC), secure digital card (SD card), flash card, at least one disk storage device, flash memory device, or other volatile solid-state storage device.

[0060] If the implemented module is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the above embodiments of the present invention can also be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by a processor, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. The computer-readable medium can include: any entity or device capable of carrying the computer program code, recording media, USB flash drives, portable hard drives, magnetic disks, optical disks, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signals, telecommunication signals, and software distribution media, etc. It should be noted that the content included in the computer-readable medium can be appropriately added or removed according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, computer-readable media do not include electrical carrier signals and telecommunication signals.

[0061] It should be noted that the device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Furthermore, in the accompanying drawings of the device embodiments provided by this invention, the connection relationships between modules indicate that they have communication connections, which can be specifically implemented as one or more communication buses or signal lines. Those skilled in the art can understand and implement this without any creative effort.

[0062] The above description is merely a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A method for detecting fake AIS ship trajectories based on LSTM, characterized in that, include: The AIS data stream of ships within the target sea area is acquired, and the AIS data stream is cleaned to generate a standardized trajectory dataset. The AIS data stream includes ship static information data and ship dynamic information data. Based on the standardized trajectory dataset, ship behavior feature vectors are extracted, and the LSTM neural network model is called to perform time-series modeling on the behavior feature vectors to generate ship historical behavior representations. The ship historical behavior representations are then used to construct a ship normal behavior index library through the KDTree algorithm. Real-time AIS data points are acquired, and current trajectory features are extracted through a sliding window mechanism. The current trajectory features are then matched with the ship's normal behavior index database for similarity. The authenticity of the trajectory is determined based on the matching distance threshold, thereby enabling real-time detection of false trajectories.

2. The method for detecting fake AIS ship trajectories based on LSTM according to claim 1, characterized in that, The cleaning process for the AIS data stream specifically includes: To verify the validity of the AIS data coordinates, the longitude range was limited to [-180°, 180°] and the latitude range was limited to [-90°, 90°], and out-of-bounds data points were removed. Calculate the Haversine distance d and time difference Δt between adjacent data points, and determine jump points based on the expression: v = d / Δt; where, when v > 60 knots or d > 5 km and Δt < 30 seconds, it is determined to be a jump point and removed. Data for the same MMSI is sorted in ascending order by timestamp, and data segments whose time has receded beyond a preset duration are removed.

3. The method for detecting fake AIS ship trajectories based on LSTM according to claim 1, characterized in that, The extraction of ship behavior feature vectors based on the standardized trajectory dataset specifically involves: The cleaned trajectory data is resampled at fixed time intervals to generate a standardized trajectory sequence with equal time intervals. For missing data points within the time interval, linear interpolation is used to fill in the gap when the gap is less than the preset time length, and the trajectory is broken to form independent trajectory segments when the gap is greater than the preset time length. Based on the resampled trajectory sequence with equal time intervals, the sliding time window size is set to T minutes, which corresponds to m sampling points, and the window step time is T_s seconds, which corresponds to a step size of n=1 sampling points; For each time window, if the number of valid data points is less than the minimum threshold, the window is discarded; for each valid window, the velocity statistics, acceleration distribution, heading change, and trajectory morphology characteristics are calculated. Among them, the speed statistical characteristics include average speed, speed standard deviation, speed quantiles, and maximum speed; Acceleration distribution characteristics include average acceleration, acceleration standard deviation, and maximum absolute acceleration; The characteristics of course change include mean turning angle, standard deviation of turning angle, mean angular velocity, and maximum angular velocity; Trajectory morphology features include straightness coefficient LS, mean curvature, standard deviation of curvature, maximum curvature, path length, net displacement, and stop ratio; The linearity coefficient LS is expressed as: LS = chord_length / path_length chord_length is the straight-line distance between the first and last points of the window, and path_length is the total length of the trajectory within the window.

4. The method for detecting fake AIS ship trajectories based on LSTM according to claim 1, characterized in that, The step of calling the LSTM neural network model to perform time-series modeling on the behavioral feature vector is specifically as follows: The behavioral feature vector sequence x t The input is to an LSTM network, and the timing dependencies are handled through the following gating mechanism, where, Forget gate calculation: f t =σ(W f ·[h t-1 ,x t ]+b f ) Input gate calculation: i t =σ(W i ·[h t-1 ,x t ]+b i ) Candidate memory state generation: =tanh(W c ·[h t-1 ,x t ]+b c ) Memory unit update: c t =f t ⊙c t-1 +i t ⊙ Output gate calculation: o t =σ(W o ·[h t-1 ,x t ]+b o ) Hidden state output: h t =o t ⊙tanh(c t ) Where σ is the Sigmoid activation function, tanh is the hyperbolic tangent activation function, and W f W i W c W o Let b be the weight matrix. f b i b c b o The bias vector is ⊙, which represents element-wise multiplication. t-1 c is the hidden state from the previous moment. t-1 The state of the memory unit from the previous moment; The hidden state sequence output by the LSTM is subjected to mean pooling to generate a fixed-dimensional ship behavior embedding vector h∈R^H, where H is the dimension of the embedding vector and R represents the real number field.

5. The method for detecting fake AIS ship trajectories based on LSTM according to claim 1, characterized in that, The construction of a ship's normal behavior index based on the ship's historical behavior representation using the KDTree algorithm is specifically as follows: The window feature vector x is concatenated with the embedding vector h output by the LSTM to generate a fused representation: z = concat(h, x); Apply feature weights to the fused representation: With weighted =z⊙w; Where w is the feature weight vector learned based on the attention mechanism; All weighted fusion representations of historical normal voyage segments are collected to form a matrix Z ∈ R^{N×(H+D)}, where N is the number of samples, H is the dimension of the embedding vector, D is the dimension of the original feature, and R represents the real number field. The matrix Z is used to construct a KDTree spatial index structure as an index library for normal ship behavior.

6. The method for detecting fake AIS ship trajectories based on LSTM according to claim 1, characterized in that, The process of acquiring real-time AIS data points involves extracting current trajectory features using a sliding window mechanism, matching these features with the ship's normal behavior index database based on similarity, and determining the authenticity of the trajectory according to a matching distance threshold. This enables real-time detection of false trajectories. Specifically: The trajectory sequence is extracted from the real-time AIS data stream by MMSI number, and a real-time trajectory window is generated using the same sliding window mechanism as the historical data. The real-time trajectory window is sequentially processed by feature extraction, LSTM encoding, and feature fusion weighting to generate a real-time weighted fusion representation; Query the k-nearest neighbors of the real-time weighted fusion representation in the KDTree index and calculate the minimum Euclidean distance: d = min j ||with current -WITH j || Among them, z current For real-time weighted fusion representation, Z j For the j-th normal behavior sample in the index, a preset threshold T is used to determine whether it is a false trajectory abnormal point when d>T and a normal trajectory point when d≤T.

7. The method for detecting fake AIS ship trajectories based on LSTM according to claim 1, characterized in that, Also includes: Morphological merging is performed on consecutive abnormal windows to generate abnormal trajectory segments; On the map visualization interface, AIS points within abnormal trajectory segments are marked in red, and normal trajectory points are marked in blue. GeoJSON format data containing MMSI, timestamp, anomaly score, and window number is output.

8. A device for detecting fake AIS ship trajectories based on LSTM, characterized in that, include: The preprocessing unit is used to acquire ship AIS data streams within the target sea area, clean the AIS data streams, and generate a standardized trajectory dataset. The AIS data streams include ship static information data and ship dynamic information data. The index building unit is used to extract ship behavior feature vectors based on the standardized trajectory dataset, call the LSTM neural network model to perform time-series modeling on the behavior feature vectors, generate ship historical behavior representations, and build a ship normal behavior index library using the KDTree algorithm on the ship historical behavior representations. The authenticity determination unit is used to acquire real-time AIS data points, extract current trajectory features through a sliding window mechanism, match the current trajectory features with the ship normal behavior index database for similarity, and determine the authenticity of the trajectory based on the matching distance threshold, so as to realize the real-time detection of false trajectories.

9. A fake AIS ship trajectory detection device based on LSTM, characterized in that, The system includes a memory and a processor. The memory stores a computer program that can be executed by the processor to implement a method for detecting fake AIS ship trajectories based on LSTM as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The device contains a computer program that can be executed by a processor of the device in which the computer-readable storage medium is located, to implement the LSTM-based method for detecting fake AIS ship trajectories as described in any one of claims 1 to 7.

Images