Abnormal target detection method for marine target situation awareness knowledge graph

Abstract

According to the marine target situation awareness knowledge graph abnormal target detection method provided by the invention, the marine target situation awareness knowledge graph abnormal target detection based on kernel density estimation is adopted, a time-sensitive marine target situation knowledge graph is designed and constructed, and a normal behavior probability model is established through kernel density estimation; a structure entropy theory is used to quantify the complexity of a behavior pattern, and a self-adaptive threshold value is designed to realize anomaly judgment, so that the problems of insufficient marine target situation awareness time dynamic processing, difficulty in multi-dimensional feature fusion and the like in the prior art are effectively solved.

Description

Technical Field

[0001] This invention belongs to the field of maritime target monitoring and knowledge graph technology, specifically referring to a method for detecting abnormal targets in a maritime target situational awareness knowledge graph, and particularly relating to a method for detecting abnormal targets in a maritime situational awareness knowledge graph based on kernel density estimation. Background Technology

[0002] With the development of the marine economy and the increasing frequency of maritime activities, the perception of the situation of maritime targets and the detection of abnormal targets have become increasingly important. Automatic Identification Systems (AIS) provide rich information on ship dynamics, but traditional anomaly detection methods suffer from the following problems:

[0003] (1) Insufficient handling of time dynamics: Traditional methods often ignore the time evolution characteristics of behavioral patterns, making it difficult to capture subtle abnormal patterns and lacking a mathematical description of the internal structure of time series.

[0004] (2) Difficulty in integrating multi-dimensional features: Ship behavior involves multiple dimensions such as position, speed, and heading, and traditional methods are difficult to effectively integrate this information through mathematical methods.

[0005] (3) Inaccurate modeling of normal behavior: The marine environment is complex and changeable, and simple statistical models are difficult to accurately describe normal navigation patterns through mathematical modeling.

[0006] (4) Balance between anomaly detection sensitivity and false alarm rate: Existing methods are difficult to achieve a good balance between detection sensitivity and false alarm rate through mathematical optimization.

[0007] In existing technologies, some use simple threshold judgment methods, but these methods cannot establish a probabilistic model of ship behavior; others use fixed rule detection, but lack quantitative analysis of the complexity of behavior patterns.

[0008] With increasingly frequent maritime traffic activities, and diverse entities such as offshore oil and gas development, fisheries production, offshore wind power, and international shipping operating in the same sea area, higher demands are being placed on the refined situational awareness of maritime targets and the early detection of abnormal behavior. Automatic Identification Systems (AIS) provide continuous identity and dynamic information for various vessels, including key elements such as unique vessel identifiers, timestamps, position coordinates, speed, and heading. However, simply relying on raw spatiotemporal trajectories and threshold rules is insufficient to cope with the complex and ever-changing marine environment and heterogeneous data sources. Typical challenges lie in four aspects. First, insufficient handling of temporal dynamics. Vessel behavior exhibits obvious intraday cycles, seasonality, and segment switching characteristics. Anomalies often appear in the form of short-term abrupt changes and gradual changes superimposed on each other. Without a mathematical characterization of the time series structure, it is difficult to accurately capture weak but crucial anomalous signals. Second, difficulty in multi-dimensional feature fusion. There are coupling relationships between high-dimensional elements such as position, speed, heading, and their derivatives. Differences in waterway constraints and management systems in different sea areas further amplify the regional differences in feature distribution. Traditional linear or univariate discrimination strategies struggle to achieve robust fusion within the same framework. Third, the modeling of normal behavior is inaccurate. Normal navigation patterns at sea are influenced by a combination of factors, including marine meteorological conditions, port and shipping scheduling, watershed topography, and seasonal fishing seasons. Using overly simplified parametric models to describe the normal probability distribution can easily lead to both biased and underfitting, resulting in insufficient stability and interpretability of anomaly scores. Fourth, it is difficult to balance detection sensitivity and false alarm rate. In engineering practice, it is desirable to improve anomaly recall while controlling false alarms to save on enforcement and scheduling costs. The lack of a threshold mechanism that can adaptively adjust based on data often becomes a major obstacle to successful deployment. Summary of the Invention

[0009] This invention aims to address the problem that existing knowledge graph refinement methods cannot effectively filter out useless information. It provides an abnormal target detection method based on a maritime target situational awareness knowledge graph using kernel density estimation. The invention designs and constructs a time-sensitive maritime target situational awareness knowledge graph, establishes a normal behavior probability model through kernel density estimation, quantifies the complexity of behavior patterns using structural entropy theory, and designs an adaptive threshold to achieve anomaly detection. This effectively solves the problems of insufficient handling of the time dynamics of maritime target situational awareness and difficulty in fusing multi-dimensional features in existing technologies.

[0010] To achieve the above effects, this invention provides an abnormal target detection method based on a maritime target situational awareness knowledge graph, comprising the following steps:

[0011] Step 1: Construction of a time-sensitive maritime target situational awareness graph, including a set of entity nodes. , representing the ship target; attribute node set , representing dynamic behavior attributes; timestamp edge set Connect entity nodes and attribute nodes, carrying timestamps. Sum of values The graph is represented as a directed graph. ,in ;

[0012] Step 2: Modeling normal behavior based on kernel density estimation, and constructing a sample set by collecting verifiable normal target navigation data. ,in Let d represent the dimension of the behavioral feature vector. The probability density function is calculated using multivariate kernel density estimation.

[0013] ;

[0014] in The kernel function is calculated using the Gaussian kernel function:

[0015] ;

[0016] Bandwidth parameters Determined through Silverman's Law:

[0017] ;

[0018] in This is the mean of the sample standard deviations;

[0019] Step 3: Ship trajectory analysis based on structural entropy, for ships trajectory time series Extracting velocity sequences and heading sequence Calculate the first difference of the velocity sequence:

[0020] ;

[0021] Discretize the difference values ​​as follows Each interval, calculation segment Structural entropy:

[0022] ;

[0023] in , The difference value falls within the interval Quantity;

[0024] Step 4: Adaptive threshold anomaly detection, calculating the probability deviation based on kernel density estimation:

[0025] ;

[0026] Calculate the behavioral complexity based on structural entropy:

[0027] ;

[0028] Calculate the trajectory smoothness anomaly score:

[0029] ;

[0030] Calculate the overall anomaly score:

[0031] ;

[0032] in These are the weighting coefficients, and .

[0033] Preferably, step three above minimizes the total cost function using dynamic programming:

[0034] ;

[0035] in For the number of segments, and For penalty parameters, For section The duration.

[0036] Preferably, the recursive relationship of the dynamic programming algorithm in step three above is as follows:

[0037] ;

[0038] in The optimal split point sequence is obtained by backtracking.

[0039] Preferably, the anomaly detection in step four above uses an adaptive threshold:

[0040] Calculate the mean of the overall anomaly scores for all targets. and standard deviation Set an abnormal threshold ,in For sensitivity parameters;

[0041] For the goal ,if If it is, then it is determined to be an abnormal target.

[0042] This invention also provides a method for detecting abnormal targets using a maritime target situational awareness knowledge graph, specifically including:

[0043] S1. Data preparation and preprocessing: Collect AIS data, perform data cleaning and coordinate transformation, convert latitude and longitude to a suitable plane coordinate system, and standardize speed and heading data.

[0044] S2. Construct a marine situation knowledge graph, create ship entity nodes, position attribute nodes, speed attribute nodes, and heading attribute nodes, and create timestamp edges for ship dynamics at each time point;

[0045] S3. Kernel density estimation modeling: Select feature dimensions, calculate optimal bandwidth parameters, establish a multivariate kernel density estimation model using Gaussian kernel function, and train the KDE model using historical normal navigation data.

[0046] S4. Structural entropy time series analysis: Structural entropy analysis is performed on the trajectory time series of each ship, with the number of discretization intervals set. Penalty parameters , The time series is segmented using a dynamic programming algorithm, and the structural entropy value of each time period is extracted as a behavioral complexity feature.

[0047] S5. Anomaly Score Calculation: For each ship target, calculate the probability deviation score based on kernel density estimation, the behavioral complexity score based on structural entropy, and the trajectory smoothness anomaly score, according to weighted coefficients. , , Calculate the overall anomaly score;

[0048] S6. Abnormal Target Identification: Calculate the average of the comprehensive abnormality scores for all ship targets. and standard deviation Set sensitivity parameters Calculate the abnormal threshold For comprehensive abnormal scores exceeding the threshold The ship target was identified as an abnormal target;

[0049] S7. Results visualization and output: Visualize the location and trajectory of abnormal targets on the map, output a list of abnormal targets and a detailed anomaly analysis report, including the scores of each anomaly and the basis for judgment.

[0050] Preferably, the AIS data in S1 includes MMSI, timestamp, latitude and longitude, speed, and heading information.

[0051] Preferably, the S2 edge attribute includes a timestamp and corresponding numerical information.

[0052] Preferably, the feature dimensions selected in S3 include location (longitude, latitude), speed, and heading, and the optimal bandwidth parameters are calculated using the Silverman rule.

[0053] This invention provides an apparatus for implementing the above-described method for detecting abnormal targets using a maritime target situational awareness knowledge graph. The apparatus includes a knowledge graph construction module, a kernel density estimation normal behavior modeling module, a ship trajectory analysis module, and an adaptive threshold anomaly determination module.

[0054] The knowledge graph construction module is used to construct a time-sensitive maritime target situational knowledge graph, including a set of entity nodes. , representing the ship target; attribute node set , representing dynamic behavior attributes; timestamp edge set Connect entity nodes and attribute nodes, carrying timestamps. Sum of values The graph is represented as a directed graph. ,in ;

[0055] The kernel density estimation normal behavior modeling module, based on kernel density estimation, collects verifiable normal target navigation data to construct a sample set. ,in Let d represent the dimension of the behavioral feature vector. The probability density function is calculated using multivariate kernel density estimation.

[0056] ;

[0057] in The kernel function is calculated using the Gaussian kernel function:

[0058] ;

[0059] Bandwidth parameters Determined through Silverman's Law:

[0060] ;

[0061] in This is the mean of the sample standard deviations;

[0062] The ship trajectory analysis module, based on structural entropy, analyzes ship trajectories for ships. trajectory time series Extracting velocity sequences and heading sequence Calculate the first difference of the velocity sequence:

[0063] ;

[0064] Discretize the difference values ​​as follows Each interval, calculation segment Structural entropy:

[0065] ;

[0066] in , The difference value falls within the interval Quantity;

[0067] Minimize the total cost function using dynamic programming:

[0068] ;

[0069] in For the number of segments, and For penalty parameters, For section The duration;

[0070] The recurrence relation for the dynamic programming algorithm is:

[0071] ;

[0072] in The optimal segmentation point sequence is obtained by backtracking;

[0073] The adaptive threshold anomaly detection module is used to calculate the probability deviation based on kernel density estimation:

[0074] ;

[0075] Calculate the behavioral complexity based on structural entropy:

[0076] ;

[0077] Calculate the trajectory smoothness anomaly score:

[0078] ;

[0079] Calculate the overall anomaly score:

[0080] ;

[0081] in These are the weighting coefficients, and ;

[0082] Anomaly detection uses an adaptive threshold:

[0083] Calculate the mean of the overall anomaly scores for all targets. and standard deviation Set an abnormal threshold ,in For sensitivity parameters;

[0084] For the goal ,if If it is, then it is determined to be an abnormal target.

[0085] The present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the above-described method.

[0086] This invention enables anomaly target detection in marine situational awareness knowledge graphs based on kernel density estimation and structural entropy, effectively addressing the shortcomings of traditional methods in handling temporal dynamics and the difficulty in fusing multi-dimensional features. It can quickly and efficiently identify anomalous maritime targets; it can identify anomalous patterns in the behavior of maritime targets; and through improvements in adaptive thresholding, it achieves adaptive adjustment of detection sensitivity. Furthermore, it maintains stable detection performance across different sea areas and time periods. Attached Figure Description

[0087] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the embodiments of the present invention will be briefly introduced below. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0088] Figure 1 A flowchart illustrating the abnormal target detection method based on the maritime target situational awareness knowledge graph of the present invention is shown.

[0089] Figure 2 This diagram illustrates the construction of a time-sensitive marine situational awareness knowledge graph in the abnormal target detection method of the marine target situational awareness knowledge graph of the present invention.

[0090] Figure 3 This paper illustrates a schematic diagram of normal behavior modeling based on kernel density estimation in the abnormal target detection method of maritime target situational awareness knowledge graph of the present invention.

[0091] Figure 4 This diagram illustrates the time-series segmentation algorithm based on structural entropy in the maritime target situational awareness knowledge graph abnormal target detection method of the present invention.

[0092] Figure 5 This invention illustrates a schematic diagram of the multi-dimensional anomaly determination and visualization interface in the maritime target situational awareness knowledge graph anomaly target detection method of the present invention;

[0093] Figure 6 The figure shows an embodiment of the abnormal target detection method based on the maritime target situational awareness knowledge graph of the present invention. Detailed Implementation

[0094] The features and exemplary embodiments of various aspects of the present invention will now be described in detail. To make the objectives, technical solutions, and advantages of the present invention clearer, the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only configured to explain the present invention and are not configured to limit the present invention. For those skilled in the art, the present invention can be practiced without some of these specific details. The following description of the embodiments is merely intended to provide a better understanding of the present invention by illustrating examples of the invention.

[0095] This invention introduces knowledge graphs to provide a unified semantic carrier for the organization and reasoning of complex, multi-source maritime data. Centered on ship entities, it associates attribute nodes such as position, speed, and heading with entity nodes in the time dimension, constructing edges carrying timestamps and numerical values, thereby reorganizing discrete message streams into a computable spatiotemporal semantic network. Compared to traditional tabular data management, knowledge graphs can explicitly express the relationships between entities, the connections between voyage segments, and the evolutionary trajectory of the same target at different times, laying a structured foundation for subsequent behavior modeling and anomaly detection. However, the graph structure alone is insufficient for a detailed characterization of normal patterns. Therefore, kernel density estimation is introduced to establish a probability density function for multivariate features. Utilizing a Gaussian kernel and employing a data-driven bandwidth selection strategy, it can characterize the normal distribution of maritime targets in the joint space of position, speed, and heading without requiring strong distribution assumptions. Compared to simple histograms and fixed threshold judgments, kernel density estimation can smoothly reflect local data density differences, making probability deviation an important quantitative indicator for measuring anomalies.

[0096] Meanwhile, structural changes in time series are often a direct indicator of anomalies. By performing first-order differencing, discretization, and segmentation on the velocity and heading sequences, and using structural entropy to measure the complexity of fluctuations within different time periods, combined with dynamic programming to minimize the total cost function, the optimal segmentation scheme corresponding to the behavioral stage can be obtained without pre-setting the number of segments. High structural entropy implies more complex maneuvers or unstable behaviors; if it increases simultaneously with probability deviation, it usually indicates that the target is in a suspicious state. Furthermore, by integrating geometric quantitative indicators such as trajectory smoothness, anomalies can be reinforced from multiple angles, reducing misjudgments caused by random fluctuations of a single indicator.

[0097] Finally, an adaptive threshold based on overall statistics is introduced at the anomaly decision-making level. Using the mean and standard deviation of the comprehensive anomaly scores as a baseline and setting sensitivity parameters, the threshold position can be automatically calibrated in different sea areas and time periods, avoiding the rigidity and non-transferability issues of manual thresholds. This strategy is naturally compatible with knowledge graph structures: on the one hand, the temporal associations in the graph can provide more stable sample references for threshold estimation; on the other hand, anomaly scores can be written back to graph edges or node attributes, supporting subsequent visualization, retrieval, and causal tracing. In summary, based on the organization of time-sensitive knowledge graphs, combined with nonparametric probabilistic modeling of kernel density estimation, temporal complexity analysis of structural entropy, and an engineered decision-making mechanism for adaptive thresholds, a complete and feasible anomaly detection chain is formed, enabling efficient identification, robust evaluation, and interpretable presentation of anomalous targets in complex marine environments.

[0098] Experimental conditions: A real AIS dataset was used, containing 1,000 ships sailing normally and 50 ships sailing abnormally. The data spanned 6 months and covered multiple sea areas and different weather conditions.

[0099] like Figure 1 As shown, this invention provides an embodiment of an abnormal target detection method based on a maritime target situational awareness knowledge graph, comprising:

[0100] S1. Data preparation and preprocessing: Collect AIS data, perform data cleaning and coordinate transformation, convert latitude and longitude to a suitable plane coordinate system, and standardize speed and heading data.

[0101] S2. Construct a marine situation knowledge graph, create ship entity nodes, position attribute nodes, speed attribute nodes, and heading attribute nodes, and create timestamp edges for ship dynamics at each time point;

[0102] S3. Kernel density estimation modeling: Select feature dimensions, calculate optimal bandwidth parameters, establish a multivariate kernel density estimation model using Gaussian kernel function, and train the KDE model using historical normal navigation data.

[0103] S4. Structural entropy time series analysis: Structural entropy analysis is performed on the trajectory time series of each ship, with the number of discretization intervals set. Penalty parameters , The time series is segmented using a dynamic programming algorithm, and the structural entropy value of each time period is extracted as a behavioral complexity feature.

[0104] S5. Anomaly Score Calculation: For each ship target, calculate the probability deviation score based on kernel density estimation, the behavioral complexity score based on structural entropy, and the trajectory smoothness anomaly score, according to weighted coefficients. , , Calculate the overall anomaly score;

[0105] S6. Abnormal Target Identification: Calculate the average of the comprehensive abnormality scores for all ship targets. and standard deviation Set sensitivity parameters Calculate the abnormal threshold For comprehensive abnormal scores exceeding the threshold The ship target was identified as an abnormal target;

[0106] S7. Results Visualization and Output: Visualize the location and trajectory of abnormal targets on a map, output a list of abnormal targets and a detailed anomaly analysis report, including scores for each anomaly and the criteria for judgment.

[0107] like Figure 2 As shown, this invention provides an embodiment of a time-sensitive marine situational awareness knowledge graph construction method for anomaly target detection, including a set of entity nodes. , representing the ship target; attribute node set , representing dynamic behavior attributes; timestamp edge set Connect entity nodes and attribute nodes, carrying timestamps. Sum of values The graph is represented as a directed graph. ,in ;

[0108] like Figure 3 As shown, this invention provides an embodiment of an abnormal target detection method based on kernel density estimation for normal behavior modeling of a maritime target situational awareness knowledge graph. Based on kernel density estimation, a sample set is constructed by collecting navigation data of verifiable normal targets. ,in Let d represent the dimension of the behavioral feature vector. The probability density function is calculated using multivariate kernel density estimation.

[0109] ;

[0110] in The kernel function is calculated using the Gaussian kernel function:

[0111] ;

[0112] Bandwidth parameters Determined through Silverman's Law:

[0113] ;

[0114] in This is the mean of the sample standard deviations;

[0115] like Figure 4 As shown, this invention provides an embodiment of an anomaly target detection method based on a structural entropy time series segmentation algorithm using a maritime target situational awareness knowledge graph. Based on structural entropy-based ship trajectory analysis, for ships... trajectory time series Extracting velocity sequences and heading sequence Calculate the first difference of the velocity sequence:

[0116] ;

[0117] Discretize the difference values ​​as follows Each interval, calculation segment Structural entropy:

[0118] ;

[0119] in , The difference value falls within the interval Quantity;

[0120] Step 4: Adaptive threshold anomaly detection, calculating the probability deviation based on kernel density estimation:

[0121] ;

[0122] Calculate the behavioral complexity based on structural entropy:

[0123] ;

[0124] Calculate the trajectory smoothness anomaly score:

[0125] ;

[0126] Calculate the overall anomaly score:

[0127] ;

[0128] in These are the weighting coefficients, and .

[0129] Minimize the total cost function using dynamic programming:

[0130] ;

[0131] in For the number of segments, and For penalty parameters, For section The duration.

[0132] The recurrence relation for the dynamic programming algorithm is:

[0133] ;

[0134] in The optimal split point sequence is obtained by backtracking.

[0135] In some embodiments, the anomaly determination in step four uses an adaptive threshold:

[0136] Calculate the mean of the overall anomaly scores for all targets. and standard deviation Set an abnormal threshold ,in For sensitivity parameters;

[0137] For the goal ,if If it is, then it is determined to be an abnormal target.

[0138] In some embodiments, the AIS data in S1 includes MMSI, timestamp, latitude and longitude, speed, and heading information.

[0139] In some embodiments, the S2 edge attribute includes a timestamp and the corresponding numerical information.

[0140] In some embodiments, S3 selects feature dimensions including location (longitude, latitude), speed, and heading, and uses the Silverman rule to calculate the optimal bandwidth parameters.

[0141] This invention also provides an embodiment of an apparatus for implementing the above-described method for detecting abnormal targets using a maritime target situational awareness knowledge graph, comprising a knowledge graph construction module, a kernel density estimation normal behavior modeling module, a ship trajectory analysis module, and an adaptive threshold anomaly determination module, wherein...

[0142] The knowledge graph construction module is used to construct a time-sensitive maritime target situational knowledge graph, including a set of entity nodes. , representing the ship target; attribute node set , representing dynamic behavior attributes; timestamp edge set Connect entity nodes and attribute nodes, carrying timestamps. Sum of values The graph is represented as a directed graph. ,in ;

[0143] The kernel density estimation normal behavior modeling module, based on kernel density estimation, collects verifiable normal target navigation data to construct a sample set. ,in Let d represent the dimension of the behavioral feature vector. The probability density function is calculated using multivariate kernel density estimation.

[0144] ;

[0145] in The kernel function is calculated using the Gaussian kernel function:

[0146] ;

[0147] Bandwidth parameters Determined through Silverman's Law:

[0148] ;

[0149] in This is the mean of the sample standard deviations;

[0150] The ship trajectory analysis module, based on structural entropy, analyzes ship trajectories for ships. trajectory time series Extracting velocity sequences and heading sequence Calculate the first difference of the velocity sequence:

[0151] ;

[0152] Discretize the difference values ​​as follows Each interval, calculation segment Structural entropy:

[0153] ;

[0154] in , The difference value falls within the interval Quantity;

[0155] Minimize the total cost function using dynamic programming:

[0156] ;

[0157] in For the number of segments, and For penalty parameters, For section The duration;

[0158] The recurrence relation for the dynamic programming algorithm is:

[0159] ;

[0160] in The optimal segmentation point sequence is obtained by backtracking;

[0161] The adaptive threshold anomaly detection module is used to calculate the probability deviation based on kernel density estimation:

[0162] ;

[0163] Calculate the behavioral complexity based on structural entropy:

[0164] ;

[0165] Calculate the trajectory smoothness anomaly score:

[0166] ;

[0167] Calculate the overall anomaly score:

[0168] ;

[0169] in These are the weighting coefficients, and ;

[0170] Anomaly detection uses an adaptive threshold:

[0171] Calculate the mean of the overall anomaly scores for all targets. and standard deviation Set an abnormal threshold ,in For sensitivity parameters;

[0172] For the goal ,if If it is, then it is determined to be an abnormal target.

[0173] like Figure 5 As shown, the present invention also provides an embodiment of an abnormal target detection method based on a maritime target situational awareness knowledge graph, comprising:

[0174] Step 1: Data Preparation and Preprocessing. Collect AIS data, including MMSI, timestamp, latitude and longitude, speed, and heading information. Perform data cleaning and coordinate transformation, converting latitude and longitude to a suitable plane coordinate system, and standardizing speed and heading data.

[0175] Step 2: Knowledge Graph Construction. Construct a marine situation knowledge graph, create ship entity nodes, position attribute nodes, speed attribute nodes, and heading attribute nodes, and dynamically create timestamp edges for ships at each time point. The edge attributes include timestamps and corresponding numerical information.

[0176] Step 3: Kernel density estimation modeling. Select feature dimensions including location (longitude, latitude), speed, and heading. Use the Silverman rule to calculate the optimal bandwidth parameter, and use the Gaussian kernel function to establish a multivariate kernel density estimation model. Use historical normal navigation data to train the KDE model.

[0177] Step 4: Structural Entropy Time Series Analysis. Perform structural entropy analysis on the trajectory time series of each ship, setting the number of discretization intervals. Penalty parameters , The time series is segmented using a dynamic programming algorithm, and the structural entropy value of each time period is extracted as a behavioral complexity feature.

[0178] Step 5: Anomaly Score Calculation. For each ship target, calculate the probability deviation score based on kernel density estimation, the behavioral complexity score based on structural entropy, and the trajectory smoothness anomaly score, according to weighted coefficients. , , Calculate the overall anomaly score.

[0179] Step Six: Anomaly Target Identification - Calculate the average of the overall anomaly scores for all ship targets. and standard deviation Set sensitivity parameters Calculate the abnormal threshold For comprehensive abnormal scores exceeding the threshold The ship target was identified as an abnormal target.

[0180] Step 7: Visualizing and Outputting Results (e.g.) Figure 6 As shown, the location and trajectory of abnormal targets are visualized on the map, and a list of abnormal targets and a detailed anomaly analysis report are output, including the scores of each anomaly and the basis for judgment.

[0181] In the embodiments provided by this invention, the range of technical parameters is as follows:

[0182] Kernel density estimation bandwidth parameters: - Structural entropy segmentation parameters: , , - Weighting of outlier scores: , , - Sensitivity parameters:

[0183] Through the above implementation steps, abnormal target detection of marine situational awareness knowledge graph based on kernel density estimation and structural entropy can be realized, effectively solving the problems of insufficient handling of temporal dynamics and difficulty in multi-dimensional feature fusion of traditional methods.

[0184] The present invention also provides an embodiment of a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the above-described method.

[0185] To further illustrate the beneficial technical effects of the present invention, two specific application scenarios are used as examples.

[0186] Example 1: Detection of Abnormal Fishing Vessels in Nearshore Fisheries Protection Zones

[0187] (I) Scene Background

[0188] A nearshore fisheries protected area in my country covers approximately 500 square kilometers. Non-fishing vessels are prohibited from entering the core area, and fishing vessels are required to operate within designated time periods and restricted areas. The area experiences complex maritime traffic, including legal fishing vessels, fisheries enforcement vessels, unlicensed fishing vessels, and illegally entered transport ships. Driven by profit, some vessels engage in illegal operations by disabling AIS signals, camouflaging navigation tracks, and illegally entering at night. Traditional monitoring relies on manual patrols, which suffers from limited coverage, delayed response, and high false positive rates. Based on the abnormal target detection method proposed in this patent, automated and high-precision identification of abnormal vessel behavior in this area can be achieved, providing technical support for fisheries law enforcement.

[0189] (II) Implementation Process

[0190] 1. Data preparation and preprocessing

[0191] Six months of AIS data were collected from the fisheries protected area and surrounding waters. The data included MMSI, timestamps, latitude and longitude, speed, and heading information for 1200 vessels. This included 1150 vessels confirmed as normal by law enforcement (including fishing vessels, law enforcement vessels, and passing merchant ships) and 50 abnormal vessels (unlicensed fishing vessels, vessels illegally entering the protected area, etc.). During the data cleaning phase, abnormal data such as missing signals, coordinates outside the protected area and its surrounding 10 nautical miles, and negative speeds were removed, retaining a total of 8.6 million valid data entries. For coordinate transformation, considering the near-shore nature of the protected area, the UTM plane coordinate system was used to convert latitude and longitude coordinates to Cartesian coordinates for easier distance and position calculations. Speed ​​data standardization employed the Z-score standardization method to eliminate the impact of speed range differences between different vessel types (e.g., fishing vessels and merchant ships); heading data was converted from 0-360° to radians to ensure calculation consistency.

[0192] 2. Knowledge Graph Construction

[0193] When constructing a time-sensitive maritime target situational awareness graph, the entity node set VE contains unique identifiers (MMSI corresponding to) for 1200 vessels. The attribute node set VA, in addition to location, speed, and heading, adds a "vessel type" attribute node (divided into fishing vessels, law enforcement vessels, merchant vessels, and others), which is supplemented by the vessel's MMSI registration information. The timestamp edge set E uses a 10-minute time granularity, connecting vessel entity nodes with each attribute node. Edge attributes carry the corresponding timestamp and attribute value, for example (MMSI:123456789, Location, 2024-05-10 08:30:00, (325120.5,4568912.3)). The entire graph is represented as a directed graph G=(V,E), where V=VE∪VA∪{vessel type}.

[0194] 3. Kernel density estimation modeling

[0195] The feature dimensions selected are position (x and y components of UTM plane coordinates), speed, and heading, for a total of four dimensions (d=4). The sample set X consists of navigation data from 1150 normal vessels. For each vessel, behavioral feature vectors from 30 consecutive timestamps are selected, resulting in a sample set of 34,500 samples. A Gaussian kernel function is used, and the bandwidth parameter h is calculated using the Silverman rule. The average standard deviation σ of the samples is 12.8, and with a sample size n=34,500, h=0.32 is obtained by substituting these parameters into the formula. Based on these parameters, a multivariate kernel density estimation model is established and trained using historical normal navigation data to obtain the probability density function of normal behavior.

[0196] 4. Structural entropy time series analysis

[0197] For each vessel's trajectory time series S, the velocity sequence Sv and heading sequence Sθ are extracted, and the first-order difference Δv of the velocity sequence is calculated. The number of discretization intervals B is set to 15, with penalty parameters λ=0.08 and μ=0.03. A dynamic programming algorithm is used for time series segmentation. The optimal segmentation point sequence is obtained through backtracking, dividing each vessel's trajectory time series into 5-8 time periods. The structural entropy value of each time period is extracted as a behavioral complexity feature. For example, the structural entropy value of the trajectory time series of legal fishing vessels is mostly concentrated between 0.8 and 1.2, while the structural entropy value of illegally entering vessels suddenly rises to above 1.8 when approaching the core area of ​​the protected area.

[0198] 5. Calculation of Outlier Scores

[0199] In the calculation of the comprehensive anomaly score, the weighting coefficients were adjusted to α=0.35, β=0.45, and γ=0.2. The weight β for the behavioral complexity score based on structural entropy was increased because abnormal vessel behavior within nearshore fishery protected areas often manifests as complex maneuvers such as frequent changes in course and unstable speed. The probability deviation score (SKDE), behavioral complexity score (SSE), and trajectory smoothness anomaly score (Ssmooth) for each vessel were calculated, and then weighted and summed to obtain the comprehensive anomaly score (Stotal).

[0200] 6. Abnormal Target Identification

[0201] The mean of the overall anomaly score for all vessels was calculated as μs = 2.3, the standard deviation as σs = 0.85, the sensitivity parameter k was set to 2.2, and the anomaly threshold as T = 2.3 + 2.2 × 0.85 = 4.17. Vessels with an overall anomaly score exceeding 4.17 were identified as anomalous targets. A total of 48 anomalous vessels were identified, of which 45 matched the enforcement records.

[0202] 7. Results Visualization and Output

[0203] The system visualizes the location, trajectory, and time of occurrence of anomalous targets on electronic nautical charts, using different colors to indicate different anomaly types (such as unauthorized intrusion, illegal operations, and signal anomalies). It outputs a list of anomalous targets, including the vessel's MMSI, the time of occurrence of the anomaly, the anomaly score (scores for each sub-item and the overall score), and the criteria for judgment (such as "structural entropy value consistently higher than 1.5 times the normal range, probability deviation located in a low-density area"). This provides fisheries law enforcement agencies with precise leads for investigation and prosecution.

[0204] (III) Explanation of Scene Fine-tuning

[0205] 1. Knowledge Graph Optimization: A new "Vessel Type" attribute node has been added, and attributes have been supplemented by MMSI registration information, so that the graph can better adapt to the diverse characteristics of vessel types in nearshore fishing areas and provide a type dimension reference for subsequent anomaly judgment.

[0206] 2. Feature Dimensions and Parameter Adjustment: In the kernel density estimation model, the feature dimensions are kept at 4 core dimensions. However, in order to meet the location calculation needs of nearshore areas, the UTM plane coordinate system is used instead of the general coordinate system to improve the accuracy of location-related calculations. The bandwidth parameter h is calculated to be 0.32, which is within a reasonable range of [0.1, 1.0] and is suitable for the characteristics of relatively slow ship speeds and concentrated location distribution near the coast.

[0207] 3. Weighting coefficient adjustment: The weight β of the behavioral complexity score in the comprehensive anomaly score is increased from 0.4 to 0.45, because the abnormal behavior in nearshore fishery protected areas is mostly characterized by complex maneuvers, and strengthening the weight of this dimension can improve the sensitivity of identifying such anomalies.

[0208] 4. Anomaly threshold adjustment: The sensitivity parameter k is set to 2.2, which is higher than the default 2.0. This is because anomaly detection in fishery protected areas needs to reduce the false negative rate and appropriately increase the sensitivity to ensure that illegal vessels are identified as much as possible. At the same time, the risk of false alarms is reduced by optimizing the model.

[0209] Example 2: Detection of abnormal vessel traffic in densely packed strait shipping lanes

[0210] (I) Scene Background

[0211] A certain strait waterway, approximately 80 kilometers long and only 3 kilometers wide at its narrowest point, is a vital international shipping route, with over 300 vessels passing through daily, including container ships, tankers, bulk carriers, and passenger ships. This waterway experiences high traffic density and frequent vessel turns, and is significantly affected by ocean currents and monsoons, making it prone to abnormal behaviors such as vessel deviation from the channel, speeding, and illegal passing, leading to collisions, groundings, and other maritime accidents. Traditional traffic management relies on the Vessel Traffic Service (VTS) system, but this system's judgment of abnormal vessel behavior is largely based on fixed rules, making it difficult to adapt to the complex and ever-changing navigation environment and diverse abnormal patterns. The abnormal target detection method proposed in this patent enables dynamic monitoring and accurate identification of abnormal vessel behavior within the waterway, improving the level of navigation safety management.

[0212] (II) Implementation Process

[0213] 1. Data preparation and preprocessing

[0214] Six months of AIS data for the strait was collected, including navigation information for 1,800 vessels. Of these, 1,750 vessels were confirmed to be operating normally by VTS records, while 50 vessels were found to be acting abnormally (including deviations from the channel, speeding, and illegal passing). During the data cleaning phase, the focus was on addressing missing heading data caused by signal obstruction, which was supplemented using linear interpolation. Abnormal data exceeding 30 knots (the channel's maximum speed limit) were removed, resulting in 12 million valid data entries. Coordinate transformation employed the Gauss-Kruger plane coordinate system, suitable for narrow channels, to ensure the accuracy of distance calculations along the channel axis. Speed ​​data standardization used min-max standardization, mapping the speed range to the [0,1] interval to accommodate the speed differences among different types of vessels within the channel. Heading data retained the 0-360° range, and angle normalization was used to eliminate calculation errors.

[0215] 2. Knowledge Graph Construction

[0216] The entity node set VE contains MMSI identifiers for 1800 vessels. The attribute node set VA adds "Channel Zone" attribute nodes (dividing the channel into three zones: entrance zone, core navigation zone, and exit zone) and "Navigation Status" attribute nodes (normal navigation, turning, and berthing). The timestamp edge set E uses a 3-minute time granularity because the vessel density within the channel is high and dynamic changes are rapid; finer time granularity allows for timely capture of changes in vessel behavior. Edge attributes carry timestamps, attribute values, and a "whether it has deviated from the channel" flag (determined by the distance between the ship's position and the channel boundary), for example (MMSI:567890123, position, 2024-09-05 10:20:00, (156230.8, 3215678.9)), associated with information such as "channel partition: core navigation area" and "whether it has deviated from the channel: no". In the directed graph G=(V,E), V=VE∪VA∪{channel partition, navigation status, whether it has deviated from the channel}.

[0217] 3. Kernel density estimation modeling

[0218] The feature dimensions selected are position, speed, heading, and channel zone (coded as 1, 2, and 3), totaling 5 dimensions (d=5). The sample set X consists of navigation data from 1750 normal vessels, with behavioral feature vectors for each vessel selected from 25 consecutive timestamps, resulting in a sample size of 43750 samples. A Gaussian kernel function is used, and the bandwidth parameter h is calculated using the Silverman rule. With the average standard deviation σ=14.6 and the sample size n=43750, h=0.28 is calculated. A multivariate kernel density estimation model is established based on this parameter. The training data focuses on the behavior of normal vessels under different channel zones and navigation conditions, ensuring the model can adapt to the complex navigation environment within the channel.

[0219] 4. Structural entropy time series analysis

[0220] In the trajectory time series S processing, the velocity sequence Sv, heading sequence Sθ, and channel partition sequence Sz (channel partition encoding based on timestamp association) are extracted. The first-order difference Δv of the velocity sequence and the first-order difference Δθ of the heading sequence are calculated. With a discretization interval number B=16, penalty parameters λ=0.07, and μ=0.04, the ship trajectory time series is divided into 4-7 time periods using this algorithm, and the structural entropy value of each time period is extracted. For example, when the ship deviates from the channel, the fluctuation amplitude of the first-order difference Δθ of the heading sequence increases, leading to an increase in the structural entropy value; when sailing at excessive speed, the stability of the velocity sequence decreases, which also causes the structural entropy value to deviate from the normal range.

[0221] 5. Calculation of Outlier Scores

[0222] The weighting coefficients for the overall anomaly score are adjusted to α=0.45, β=0.3, and γ=0.25. The weighting α for the probability deviation score is increased because the position and speed distribution of normal vessel behavior within the waterway is relatively concentrated, and the probability deviation score can effectively distinguish abnormal behaviors that deviate from normal navigation patterns. When calculating SKDE, a probability density function based on 5-dimensional features is used to focus on whether the vessel's position and speed within the waterway section conform to a normal distribution; SSE integrates the fluctuation complexity of speed and heading; Ssmooth focuses on calculating the rate of change of speed and heading between adjacent timestamps. These three factors are weighted to obtain the overall anomaly score, Sttotal.

[0223] 6. Abnormal Target Identification

[0224] The mean of the overall anomaly score for all vessels was μs = 2.5, the standard deviation was σs = 0.88, the sensitivity parameter was k = 2.1, and the anomaly threshold was T = 2.5 + 2.1 × 0.88 = 4.348. Vessels with an overall anomaly score exceeding this threshold were considered anomalous targets. A total of 47 anomalous vessels were identified in this inspection. After verification by the VTS department, 45 vessels were found to be genuinely anomalous, including 22 vessels deviating from their course, 15 vessels exceeding the speed limit, and 8 vessels illegally passing each other.

[0225] 7. Results Visualization and Output

[0226] The visualization interface is based on electronic nautical charts, overlaying geographic information such as channel boundaries and channel zones. Normal vessels are displayed as blue dots, while abnormal vessels are displayed as red dots. Different anomaly types are marked with different shapes (e.g., deviation from the channel is a triangle, speeding is a circle). The trajectory display uses solid lines (normal) and dashed lines (abnormal) of different colors, with abnormal periods marked with highlighted blocks. The output anomaly analysis report includes the vessel's MMSI, the type of abnormal behavior, the channel zone where the anomaly occurred, the duration, the anomaly score for each sub-item, and the judgment basis. It also provides spatiotemporal distribution statistical charts of abnormal behavior, providing data support for the VTS department to optimize channel management strategies and rationally allocate regulatory resources.

[0227] (III) Explanation of Scene Fine-tuning

[0228] 1. Knowledge Graph Adaptation: Added attribute nodes for "Channel Zone", "Navigation Status" and "Whether it deviates from the channel", with the time granularity refined to 3 minutes, which is in line with the characteristics of high ship density and rapid dynamic changes in the strait channel, and enhances the graph's characterization of channel management-related attributes.

[0229] 2. Feature and Model Optimization: The kernel density estimation model adds a "channel partition" feature dimension, enabling the model to accurately capture the normal navigation patterns of different partitions; the structural entropy analysis focuses on the differential fluctuations in speed and heading, adapting to the frequent turning behavior of ships in the channel.

[0230] 3. Parameter and weight adjustment: The kernel density estimation bandwidth parameter h=0.28 is adapted to the concentrated distribution of ship positions in the waterway; the structural entropy segmentation parameters B=16, λ=0.07, μ=0.04 are used to balance the precision of time series segmentation and computational efficiency; the comprehensive anomaly score weight α is increased to 0.45 to enhance the ability of probability deviation to identify abnormal behavior in the waterway.

[0231] 4. Optimized output results: The visualization interface overlays waterway geographic information, and the report adds spatiotemporal distribution statistical charts to adapt to the waterway management business needs of the VTS department and improve the practicality of anomaly detection results.

[0232] Compared with the prior art, the present invention has the following beneficial effects:

[0233] I. Improve the comprehensiveness and accuracy of anomaly identification

[0234] This invention, within a knowledge graph framework, organically connects ship entities with attributes such as position, speed, and heading through timestamped edges, thus reconstructing the spatiotemporal semantics of the original message. Based on this, kernel density estimation is used to nonparametrically model the normal distribution of the multidimensional joint space, without relying on strong distribution assumptions, accurately reflecting local density variations in different sea areas and seasons. A probability deviation measure is used to assess the degree to which samples fall into low-density regions, making anomaly scores more sensitive to subtle pattern deviations, thereby balancing wide-area coverage with local accuracy and significantly improving the comprehensiveness and precision of anomaly identification.

[0235] II. Enhance the ability to detect phased anomalies

[0236] By differentially analyzing, discretizing, and optimally segmenting the speed and heading sequences, and using structural entropy to quantify the behavioral complexity of each time period, different states such as stable navigation, evasive maneuvers, and abnormal maneuvers can be effectively distinguished. An increase in complexity is often accompanied by suspicious behavior; when it rises in tandem with probability deviation, it forms strong and consistent evidence of anomalies. This mechanism can adapt to different sampling frequencies and sea state conditions, avoiding false alarms and missed alarms caused by relying solely on instantaneous thresholds, and exhibits good sensitivity to phased anomalies, slow yaws, and anomalous acceleration / deceleration.

[0237] III. Achieving adjustable balance and easy implementation

[0238] This invention uses the overall mean and standard deviation of comprehensive anomaly scores as a baseline, combined with sensitivity parameters to form an adaptive threshold. This threshold can automatically calibrate the decision boundary as data distribution changes, reducing the burden of manual parameter tuning. Simultaneously, indicators such as probability deviation, structural entropy complexity, and trajectory smoothness are weighted and integrated into a single score. The weights have clear physical meanings, facilitating calibration with a small number of samples during the gray-scale phase. This strategy demonstrates stable performance across different sea areas, seasons, and target types, achieving a task-oriented adjustable balance between recall and false alarm rates, meeting the differentiated needs of diverse application scenarios such as surveillance, search and rescue, and waterway safety.

[0239] IV. Supporting Explainable Traceability and Business Closed Loop

[0240] The components of the anomaly score, the temporal distribution of structural entropy, and the spatiotemporal relationships in the knowledge graph can collectively form a business-oriented chain of evidence. The time period of an anomaly occurrence, the corresponding flight segment location, related relationship edges, and attribute nodes can all be visually presented on the graph, facilitating law enforcement and operations personnel to understand the source of the anomaly, verify the judgment basis, and take rapid action. This interpretable framework also helps to form a closed loop of data governance: when a certain type of anomaly occurs frequently in a specific sea area, the weights, thresholds, and feature configurations can be adjusted accordingly, and the experience can be solidified into rules and policy upgrades, reducing long-term operation and maintenance costs and continuously improving detection stability and scalability.

[0241] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0242] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to interchangeably. Each embodiment focuses on describing the differences from other embodiments. In particular, the system embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments.

[0243] The above description is merely an embodiment of this application and is not intended to limit this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principle of this application should be included within the scope of the claims of this application.

Claims

1. A method for detecting abnormal targets of a maritime target situation awareness knowledge graph, characterized in that The method comprises the following steps: Step 1: Construction of a time-sensitive maritime target situational awareness graph, including a set of entity nodes. , representing the ship target; attribute node set , representing dynamic behavior attributes; timestamp edge set Connect entity nodes and attribute nodes, carrying timestamps. Sum of values The graph is represented as a directed graph. ,in ; Step two, normal behavior modeling based on kernel density estimation, collect the confirmed normal target navigation data to build a sample set wherein is the behavior feature vector, d represents the dimension of the behavior feature vector, and the probability density function is calculated using multivariate kernel density estimation: ； wherein is a kernel function, and a Gaussian kernel function is used for calculation: ； Bandwidth parameter Determined by Silverman's rule: ； wherein is the average of the sample standard deviations; Step 3: Ship trajectory analysis based on structural entropy, for ships trajectory time series Extracting velocity sequences and heading sequence Calculate the first difference of the velocity sequence: The difference value is discretized into intervals, and the structural entropy of the segment is calculated. ； wherein , is the number of difference values falling in the interval ; Step four, adaptive threshold abnormality determination, calculating the probability deviation degree based on kernel density estimation: ； Calculating the behavior complexity based on structural entropy: ； Calculating the trajectory smoothness abnormality score: ； Calculating the comprehensive abnormality score: ； wherein is a weight coefficient, and . 2.The offshore target situation awareness knowledge graph anomaly target detection method according to claim 1, characterized in that The step three minimizes the total cost function by dynamic programming: ； wherein is the number of segments, and is the penalty parameter, is the duration of segment .

3. The offshore target situation awareness knowledge graph anomaly target detection method according to claim 1 or 2, characterized in that The recursive relationship of the dynamic programming algorithm is: ； wherein by backtracking to obtain the optimal sequence of split points. 4.The offshore target situation awareness knowledge graph anomaly target detection method according to claim 1, characterized in that The abnormality determination in the step four adopts an adaptive threshold: Calculate the mean of all target composite anomaly scores and the standard deviation Set the anomaly threshold where is the sensitivity parameter; For the target If Then determine as an abnormal target. 5.The offshore target situation awareness knowledge graph anomaly target detection method according to claim 1, characterized in that Specifically comprises: S1, data preparation and preprocessing, collecting AIS data, performing data cleaning and coordinate conversion, converting latitude and longitude into a suitable plane coordinate system, and standardizing the speed and heading data; S2, constructing an ocean situation knowledge graph, creating ship entity nodes, location attribute nodes, speed attribute nodes, and heading attribute nodes, and creating a timestamp edge for each time point of ship dynamics; S3, kernel density estimation modeling, selecting feature dimensions, calculating optimal bandwidth parameters, and establishing a multivariate kernel density estimation model using a Gaussian kernel function, and training the KDE model using historical normal navigation data; S4, structure entropy time series analysis, structure entropy analysis of each ship's trajectory time series, set the number of discrete intervals , penalty parameter , , time series segmentation by dynamic programming algorithm, extract the structure entropy value of each time period as the behavior complexity feature; S5, Abnormal score calculation, for each ship target, calculate the probability deviation degree score based on the kernel density estimation, calculate the behavior complexity score based on the structural entropy, calculate the trajectory smoothness abnormal score, calculate the comprehensive abnormal score according to the weight coefficient , , ​ S6, Abnormal target determination, calculate the mean of all ship target comprehensive anomaly score and standard deviation , set sensitivity parameters , calculate anomaly threshold , determine the ship target whose comprehensive anomaly score exceeds the threshold as an abnormal target ; S7, result visualization and output, visualizing the abnormal target position and trajectory on the map, outputting an abnormal target list and detailed abnormal analysis report, including each abnormality score and determination basis.

6. The offshore target situation awareness knowledge graph anomaly target detection method according to claim 5, characterized in that The AIS data in the S1 comprises MMSI, timestamp, latitude and longitude, speed, and heading information.

7. The offshore target situation awareness knowledge graph anomaly target detection method according to claim 5, characterized in that The edge attribute in the S2 comprises a timestamp and corresponding numerical information. 8.The offshore target situation awareness knowledge graph anomaly target detection method according to claim 5, characterized in that The feature dimensions in the S3 include location (longitude and latitude), speed, and heading, and the optimal bandwidth parameters are calculated using the Silverman rule.

9. A device for implementing the abnormal target detection method of the maritime target situation awareness knowledge graph according to any one of claims 1-8, comprising a knowledge graph construction module, a kernel density estimation normal behavior modeling module, a ship trajectory analysis module, and an adaptive threshold abnormality determination module, characterized in that: The knowledge graph construction module is configured to construct a time-sensitive maritime target situation knowledge graph, including an entity node set , representing a ship target , representing a dynamic behavior attribute , connecting the entity node and the attribute node, carrying a timestamp and a numerical value The graph representation is a directed graph , wherein ; The kernel density estimation normal behavior modeling module collects identifiable normal target navigation data to construct a sample set based on kernel density estimation normal behavior modeling wherein is the behavior feature vector, d represents the dimension of the behavior feature vector, and a probability density function is calculated using a multivariate kernel density estimation: ； wherein is a kernel function, and a Gaussian kernel function is used for the calculation: ； Bandwidth parameter Determined by Silverman's rule: ； wherein is the average of the sample standard deviations; The ship trajectory analysis module, based on structural entropy of ship trajectory analysis, for ship trajectory time series , extract speed sequence and heading sequence , calculate the first order difference of speed sequence: ； The differential value is discretized into segments, and the structural entropy of the segment is calculated. ； wherein , is the number of difference values falling in the interval ; The total cost function is minimized by dynamic programming: ； wherein is the number of segments, and is the penalty parameter, is the duration of the segment . The recursive relationship of the dynamic programming algorithm is: ； wherein by backtracking to obtain the optimal sequence of split points; The adaptive threshold abnormality determination module is configured to calculate the probability deviation degree based on kernel density estimation: ； Calculating the behavior complexity based on structural entropy: ； Calculating the trajectory smoothness abnormality score: ； Calculating the comprehensive abnormality score: ； wherein are weight coefficients, and ; The abnormality determination adopts an adaptive threshold: Calculate the mean of all target composite anomaly scores and the standard deviation Set the anomaly threshold where is the sensitivity parameter; For the target If , it is determined as an abnormal target.

10. A computer-readable storage medium having a computer program stored thereon, wherein the program is executed by a processor to implement the method according to any one of claims 1-6.

Images