Method for detecting track anomalies and associated device
The method addresses computational inefficiencies and real-time limitations of existing track anomaly detection by using a neural network to set a fixed threshold based on average log-likelihood values, enhancing detection efficiency and accuracy on embedded systems.
Patent Information
- Authority / Receiving Office
- FR · FR
- Patent Type
- Patents
- Current Assignee / Owner
- Filing Date
- 2023-12-28
- Publication Date
- 2026-03-13
AI Technical Summary
Existing methods for detecting track anomalies, such as GeoTrackNet, require significant computational resources and are not suitable for real-time processing, especially on embedded systems with limited resources, and struggle with setting detection thresholds that vary based on track duration.
A method using a neural network to calculate average log-likelihood values, determine a median, and apply a statistical coefficient to set a fixed abnormality threshold, allowing real-time anomaly detection with reduced computational demands.
Enables efficient, real-time detection of track anomalies with reduced computational resources, improved performance on short tracks, and consistent detection thresholds across varying track durations.
Smart Images
Figure 00000015_0000 
Figure 00000016_0000 
Figure 00000017_0000
Abstract
Description
Title of the invention: Method for detecting track anomalies and associated device
[0001] The present invention relates to a method for detecting track anomalies.
[0002] The invention relates to the field of discrimination of anomalies in tracks, more particularly maritime, avionics or automotive tracks, and more particularly maritime AIS tracks (from the English "Automatic Identification System").
[0003] A track is a time series that provides, at each time step, information such as the position, speed, and heading of the tracked object. The track allows, for example, the reconstruction of the trajectory followed by the tracked object.
[0004] A maritime AIS track corresponds to the time series of AIS messages, emitted by an AIS beacon on board a ship, as a tracked object.
[0005] Each AIS message contains static and dynamic information relating to the vessel. In particular, an AIS message provides instantaneous information on geographic position, speed, heading, navigation status and turning radius.
[0006] AIS beacons have ranges from 5 nautical miles to 20 nautical miles, depending on the category of the AIS maritime system.
[0007] AIS messages are received by a listening station, either on the ground or on board a maritime surveillance aircraft. AIS messages can be analyzed either in real time or with a delay.
[0008] Among the possible analyses, we know the method of detecting AIS track anomalies of GeoTrackNet, with an inference using a so-called "contrario" detection.
[0009] This method is presented for example at: “https: / / github.com / CIA-Oceanix / GeoTrackNet”.
[0010] This method relies on the use of an artificial intelligence algorithm called GeoTrackNet. Following a training phase, a suitably parameterized neural network is used in inference to calculate a log likelihood score for each AIS message of a track of interest.
[0011] Then, the score of each message allows us to classify that message as either normal or abnormal.
[0012] If the track of interest contains too many abnormal messages, it is annotated as abnormal.
[0013] However, this method requires significant computational resources for inference, particularly when the track of interest contains many messages. In Indeed, this method requires the calculation of a cumulative increasing binomial distribution on each sub-segment of a track.
[0014] Moreover, this method is not suitable for real time because it requires an anomaly detection inference time from log-likelihoods of the order of 2 minutes for a batch of 100 AIS tracks.
[0015] Moreover, with this method, the detection threshold must be set according to the duration of the track and varies enormously (from the order of 10 for a 10-minute track, to 1.10 7 for a 4-hour track).
[0016] The anomaly detection performance of this method on short tracks (10 to 30 minutes) could also be improved.
[0017] It is therefore understood that, particularly for embedded systems, whose computing resources are constrained, there is a need for a method of detecting track anomalies that is less costly in terms of digital resources and that allows real-time processing.
[0018] Furthermore, it would be desirable to be able to detect an abnormal track as precisely and quickly as possible, after receiving its first AIS messages, and without having to continually modify the detection threshold according to the duration of the track.
[0019] The aim of the invention is therefore to propose a method for detecting track anomalies that addresses these problems.
[0020] To this end, the invention relates to a method for detecting anomalies in tracks, a track comprising a temporal succession of data, the method comprising, in a configuration phase, the steps of: training a neural network on a plurality of training tracks to predict a log-likelihood value of a data point in a track;calculation of an average log-likelihood value for each track in a set of validation tracks and calculation of a median on the calculated average log-likelihood values, the average log-likelihood value of a track being obtained by averaging the log-likelihood value of the data of the track considered, the log-likelihood value of a data point being estimated using the trained neural network, calculation of a score on the average log-likelihood value of each track in a set of test tracks relative to the median and calculation of a statistical coefficient from the calculated scores; definition of an abnormality threshold from the median and the statistical coefficient;the process further includes, in an inference phase, the steps of: acquiring at least one lead of interest, processing the lead of interest by: calculating an average log-likelihood value of the lead of interest by averaging the log-likelihood values of the data that make up the lead of interest, the log-likelihood value of a data being estimated by means of the trained neural network,; calculate a score of the average log-likelihood value of the lead of interest relative to the median, and compare the score of the average log-likelihood value of the lead of interest to the threshold of abnormality, the lead of interest being classified as "abnormal" when the score of the average log-likelihood value of the lead of interest is greater than the threshold of abnormality, and "normal" otherwise.
[0021] According to other advantageous aspects of the invention, the track anomaly detection method comprises one or more of the following features, taken individually or in any technically possible combination:
[0022] - the statistical coefficient is the coefficient of the MAD algorithm on the scores of the average log-likelihood values of the tracks of the set of test tracks relative to the median;
[0023] - the abnormality threshold S is defined according to the following equation:
[0024] S = MEDvALID + nb_MAD x C_MAD
[0025] with MEDvalid the median, C__MAD the coefficient of the MAD algorithm and nb_MAD a coefficient;
[0026] - a track is a track of AIS messages, radar plots, satellite detections, or of GPS georeferenced positions;
[0027] - a data point being an AIS message, an abnormal track consists of: an anomaly of deviation; an anomaly of impossibility or interruption of the AIS system; an anomaly of risk of collision, or an anomaly of entry into an unusual zone;
[0028] - the processing step of the track of interest is carried out in real time, preferably at each update of the track of interest leading to the addition of a data point;
[0029] - the length of a track of interest is configurable by a sliding window;
[0030] - the training and validation tracks are tracks, the majority of which are considered normal; and
[0031] - the neural network is the GeoTrackNet network.
[0032] The invention also relates to a computer program product comprising software instructions which, when executed by a computer, implement all or part of the steps of the preceding process.
[0033] The invention will become clearer upon reading the following description, given solely by way of non-limiting example and with reference to the drawings in which:
[0034] [Fig-1] [Fig.1] is a schematic view of a system for anomaly detection of tracks, receiving AIS messages from a tracked vessel;
[0035] [Fig.2] [Fig.2] is an illustration of a monitored geographical area; and
[0036] [Fig.3] [Fig.3] is a flowchart of the steps of a preferred embodiment of the track anomaly detection method according to the invention, implemented by the track anomaly detection device of [Fig.1], to identify abnormal tracks in the geographical area of [Fig.2].
[0037] Although the present description is made for the particular case of tracks based on AIS messages, the invention applies to all types of tracks, including tracks made up of radar plots, satellite detections, GPS readings, etc.
[0038] From a track, consisting of the succession of N AIS messages from a ship, we seek to know if this ship is following a normal or abnormal route in relation to a set of routes considered normal.
[0039] For example, detectable anomalies include: deviation anomalies; AIS impossibility or cut-off; or entry into an unusual area.
[0040] The invention also relies on the GeoTrackNet algorithm, but modifies the way in which the results provided by this algorithm are used to facilitate calculations.
[0041] We seek to determine whether the route followed by a ship 1 is normal or abnormal.
[0042] Ship 1 is equipped with an AIS beacon 2 that periodically transmits messages AIS, xt, for example using a VHF antenna.
[0043] A monitoring station 3, on land or, preferably, on board a maritime surveillance aircraft, monitors the geographical area traversed by the ship 1.
[0044] Monitoring station 3 tracks ship 1 from AIS messages received.
[0045] For this purpose, station 3 includes at least one sensor 8, configured to acquire the AIS xt messages over time and transmit them, in the form of digital signals, to a track anomaly detection device 10.
[0046] Device 10 is a computer comprising computing means, such as a processor, and storage means, such as memory. The memory stores, in particular, the instructions of computer programs, specifically a program whose execution enables the implementation of the method according to the invention.
[0047] The device 10 is thus programmed to develop a track from the set of the last N AIS messages xt received successively from the ship 1.
[0048] The device 10 is thus programmed to qualify this track of interest as normal or abnormal by implementing the method according to the invention, preferably in real time, as new AIS messages are received.
[0049] Alternatively, the track of interest is analyzed in delayed time, following an AIS message acquisition campaign.
[0050] More specifically, the track anomaly detection device 10 comprises an input module 22, a processing module 24 and an output module 26.
[0051] The input module 22 allows the digital signals from the sensor 8 to be received and a track to be reconstructed from a series of N successive AIS messages. A track is in fact a sliding window of fixed length, to retain the last N AIS messages.
[0052] The length of a track is fixed, but is configurable by the operator.
[0053] The processing module 24 makes it possible to discriminate whether the track of interest at the output of the module 22 is a normal or abnormal track.
[0054] The processing module 24 includes a neural network training unit 32, a mean log-likelihood calculation unit 33, a median calculation unit 34, a MAD score calculation unit 35, a MAD coefficient calculation unit 36, an abnormality threshold determination unit 37, and a discrimination unit 38.
[0055] The device 10 further comprises a database 28, storing in particular training data consisting of sets of training tracks and sets of validation tracks, and sets of test tracks and a plurality of medians of the average log-likelihoods of the tracks of the sets of validation tracks.
[0056] Each median of the plurality of medians is associated with a specific duration of the validation tracks used to calculate it. For example, there is a median of the average log-likelihoods of a set of validation tracks of 10 minutes, a median for a set of validation tracks of 20 minutes, etc., for track durations of 40 minutes, 1 hour, 2 hours, 3 hours, and for a validation set whose track durations range from 4 hours to 24 hours.
[0057] Finally, once processed by the processing module 24, the labeled track of interest is transmitted to the output module 26.
[0058] Module 26 is, for example, an application that displays an alert on the screen of a human-machine interface 12 of the device 10. This display of the label of the track of interest allows the operator to focus his actions on abnormal tracks in order to optimize the monitoring and / or intervention resources on the corresponding ships.
[0059] Alternatively, module 26 is an automated application that generates an action based on abnormal tracks. The generated action is, for example, to alert the crew of the ship whose route is deemed abnormal of a potential risk and / or propose one or more corrective routes.
[0060] On [Fig.2], a geographical area of interest Z, maritime in the case presented, is monitored by station 3.
[0061] The area of interest Z is crossed by a plurality of tracks.
[0062] The tracks do not necessarily all have the same length in terms of the number of AIS messages constituting them.
[0063] Among these leads, we distinguish between leads of interest to be addressed and leads of history.
[0064] Among these historical tracks, there are training tracks (such as tracks 41, 42, 43), validation tracks (such as tracks 51 and 52) and test tracks (such as tracks 61 and 62).
[0065] History tracks are tracks for learning and configuring the processing.
[0066] The training and validation tracks are considered to be mostly normal for training and calculating the medians of mean log-likelihood.
[0067] The test tracks include tracks considered normal (such as track 62) and tracks considered abnormal (such as track 61).
[0068] The tracks of interest are tracks that the implementation of the method according to the invention will allow to be classified as normal (case of track 71) or as abnormal (case of track 72). In [Fig. 2], the last three messages (relative to time 111 ooo current t), xt, xt_i and xt_2, from track 71 and the last three messages xt, xt4 and xt2 from track 72 are represented.
[0069] The operation of the track anomaly detection device 10 will now be described with reference to [Fig.3], which illustrates a preferred embodiment of the track anomaly detection method 100.
[0070] In a configuration phase 101, carried out prior to a mission, the method 100 includes a training step 110, during which the training unit of a neural network 32 is executed to train a neural network on a set of training tracks.
[0071] The neural network is preferably a Variational Recurrent Neural Network - VRNN (“variational recurrent neural network”).
[0072] Preferably, it is the GeoTrackNet model.
[0073] The training is carried out on a set of training tracks, which is extracted from database 28, said training tracks being historical tracks recorded in the past.
[0074] The goal of the training is to learn a distribution that maximizes a log-likelihood of a sequence of T successive AIS messages extracted from a track. T is an integer less than N, the total number of AIS messages in the track.
[0075] In what follows, a track sequence is defined as a set of T successive AIS messages on the same track. A sequence is denoted: Xj.T = {xt}, jT, where XT is the last AIS message in the sequence.
[0076] We are therefore talking about the log-likelihood of an AIS track sequence, evaluated from the last message considered and the previous Tl messages.
[0077] The log-likelihood of the AIS track sequence is defined as:
[0078] logp(x) = logp(x logp(x I x^ i)
[0079] With: - xt; the t-th AIS message of the sequence; - j / x |xh , ) ,1a conditional probability of obtaining the message xt knowing the sequence of messages that precede it; - y is the probability of the first message in the sequence; and, - / j the likelihood of the sequence under consideration. ^tT / •
[0080] Advantageously, the GeoTrackNet neural network training technique presented in detail in the paper is used: https: / / arxiv.org / pdf / 1912.00682.pdf.
[0081] A trained neural network is obtained at the output of step 110. Finally, for a message xt of a track, the trained neural network predicts the log-likelihood of this message as the last message of a sequence of T messages.
[0082] Then, still in configuration phase 101, process 100 includes a step 120 of calculating average log-likelihood and a step 125 of calculating medians.
[0083] In step 120, for each track in a batch of validation tracks extracted from database 28, the previously trained neural network is used to predict a log-likelihood value for each of the messages in the considered validation track.
[0084] Then, unit 33 is executed to determine an average log-likelihood value for each validation track.
[0085] The average log-likelihood value of a track is equal to the average of the log-likelihood values of each of the messages that make up said track.
[0086] Then, in step 125, unit 34 is executed to determine the median, MEDvAr.tm of the average log-likelihood values for all the validation tracks of the lot under consideration.
[0087] This median is finally stored in database 28.
[0088] As a reminder, the median, MEDvalid, is the average log-likelihood value of a batch of validation tracks, for which 50% of the average log-likelihood values of the validation tracks in that batch are above said value and 50% of the average log-likelihood values of the validation tracks in that batch are below said value.
[0089] Advantageously, several medians are stored according to characteristics specific to the different validation tracks, in particular the track duration.
[0090] Then, still in configuration phase 101, process 100 includes a step 130 of calculating a MAD score and a step 135 of calculating a MAD coefficient.
[0091] In step 130, a batch of test tracks extracted from the database 28 for adjusting the detection thresholds of normal / abnormal track is considered.
[0092] For each test track, unit 34 is first run to determine a mean log-likelihood value.
[0093] For each test track, unit 35 calculates a score, SCOfe_MAD, of its average log-likelihood value.
[0094] This score corresponds to the absolute difference between the average log-likelihood value of the test track Li and the median of the average log-likelihood values of the tracks in the validation set determined in step 125:
[0095] score_MAD = |Lj- MEDy^LiDl
[0096] Preferably, the median value is chosen based on the duration of the test track. It is the value of the validation tracks whose duration is closest to the duration of the test track under consideration.
[0097] Then, in step 135, unit 36 is subsequently executed to implement the Median Absolute Deviation -MAD algorithm (for mean absolute deviation of a median).
[0098] The MAD algorithm then provides a MAD coefficient, C_MAD, from the scores, SCOre_MAD, of the test tracks:
[0099] C_MAD = med(scores_MAD)
[0100] The MAD coefficient is in fact the median of the absolute deviations of the mean log-likelihood values of the test tracks from the median of the mean log-likelihood values of the validation test tracks.
[0101] Still in configuration phase 101, process 100 includes a step 140 of calculating the threshold of abnormality.
[0102] In this step, unit 37 is for example executed to determine an abnormality threshold S from the statistical parameters determined in the previous steps.
[0103] For example, the abnormality threshold is defined as:
[0104] S = MEDvalid + nb_MAD x C_MAD
[0105] where nbMAD is a fixed coefficient throughout the detection process, equal for example to three or four.
[0106] If for a test track, its score, score AD, is greater than the threshold of abnormality, S, this track is considered "abnormal", on the other hand if its score is less than or equal to the threshold of abnormality, S, this track is considered "normal".
[0107] Alternatively, the abnormality threshold is a value adjustable by the operator according to the needs and / or characteristics of the tracks.
[0108] In an inference phase 102 of the process 100, which is carried out during the detection mission, the process 100 includes an acquisition step 150, during which the input module 12 is executed in order to develop a lead of interest from the succession of AIS messages from the same vessel 1.
[0109] Then, in a step 160, the discrimination unit 38 is executed to monitor the track of interest and label it as normal (in the case of track 71) or abnormal (track 72).
[0110] First, unit 38 calls unit 33 to calculate an average log-likelihood value for the track of interest. To do this, the average of the log-likelihood values of the last N messages of the track of interest is calculated, the log-likelihood value of a message being estimated by the suitably parameterized neural network.
[0111] Next, unit 38 calls unit 35 to calculate a MAD score of the average log-likelihood value of the lead of interest.
[0112] Finally, unit 38 compares the MAD score of the track of interest with the adjusted abnormality threshold S in phase 101.
[0113] The track of interest is then considered "abnormal" if its MAD score is above the threshold of abnormality, and "normal" otherwise.
[0114] Finally, in step 170, the display module 26 is executed to display the track of interest on the HMI 12 and an alarm when the label associated with this track of interest is "abnormal". The alarm should help the operator identify tracks that deviate from normal learned behaviors.
[0115] In [Fig. 1], the various units implemented during the process according to the invention have been conveniently represented as belonging to the same electronic device 10. However, alternatively and preferably, the steps of the configuration phase 101 of the process 100 (and the associated units) are carried out on a first computer (for example, a ground-based computer with normal or high computing capabilities), while the steps of the inference phase 102 of the process 100 (and the associated units) are carried out on a second computer (for example, an onboard computer with limited computing capabilities). The first and second computers are independent. The content of the database associated with each computer is adapted to the steps actually implemented by that computer.
[0116] Advantageously, the second computer is implemented as a programmable logic component, such as an FPGA (Field Programmable Gate Array), or as an integrated circuit, such as an ASIC (Application-Specific Integrated Circuit).
[0117] In general, a neural network comprises an ordered succession of layers of neurons, each of which takes its inputs from the outputs of the previous layer.
[0118] More precisely, each layer comprises neurons taking their inputs from the outputs of the neurons of the previous layer, or from the input variables for the first layer.
[0119] Alternatively, more complex neural network structures can be envisaged with a layer that can be linked to a layer further away than the immediately preceding layer.
[0120] Alternatively, the neural network used is of the “Transformers” type.
[0121] Each neuron is also associated with an operation, that is to say a type of processing, to be carried out by said neuron within the corresponding processing layer.
[0122] Each layer is connected to the other layers by a plurality of synapses. A synaptic weight is associated with each synapse, and each synapse forms a link between two neurons. It is often a real number, which takes both positive and negative values. In some cases, the synaptic weight is a complex number.
[0123] Each neuron is designed to perform a weighted sum of the value(s) received from the neurons of the preceding layer, each value being multiplied by the respective synaptic weight of each synapse, or connection, between said neuron and the neurons of the preceding layer, and then to apply an activation function, typically a non-linear function, to said weighted sum, and to deliver at the output of said neuron, in particular to the neurons of the next layer connected to it, the value resulting from the application of the activation function. The activation function introduces non-linearity into the processing performed by each neuron. The sigmoid function, the hyperbolic tangent function, and the Heaviside function are examples of activation functions.
[0124] As an optional complement, each neuron is also capable of applying, in addition, a multiplicative factor, also called bias, to the output of the activation function, and the value delivered at the output of said neuron is then the product of the bias value and the value from the activation function.
[0125] Such a neural network is trained on a set of training tracks comprising mostly tracks considered to be normal.
[0126] The present invention has a number of advantages:
[0127] First, the invention makes it possible to discriminate between anomalous tracks within a set of tracks of interest in a more computationally efficient manner for similar performance. This is achieved by performing a simple thresholding operation on the MAD score of the average log-likelihood of a track.
[0128] Furthermore, the invention makes it possible to discriminate against abnormal tracks in a more economical way in terms of digital resources.
[0129] With the invention, an anomaly detection inference time of the order of 1 second is achieved for 100 tracks, for performance equivalent to that of the state of the art method.
[0130] The invention also makes it possible to detect anomalies on a short track. More precisely, it detects approximately 15% more abnormal tracks for tracks ranging from 10 to 30 minutes in length.
[0131] Finally, the method allows the same detection threshold to be used continuously regardless of the duration of the test track, unlike the state-of-the-art method.
Claims
1. Demands Method (100) for detecting track anomalies, a track comprising a temporal sequence of data including, at each time step, information such as the position, speed and heading of a tracked object, the method comprising, in a configuration phase, the steps of: a. training a neural network (110) on a plurality of training tracks to predict a log-likelihood value of a data point from a track; b. calculation (120) of an average log-likelihood value for each track in a set of validation tracks and calculation (125) of a median on the calculated average log-likelihood values, the average log-likelihood value of a track being obtained by averaging the log-likelihood value of the data of the track in question, the log-likelihood value of a data point being estimated using the trained neural network, c. calculation (130) of a score on the mean log-likelihood value of each track in a set of test tracks relative to the median and calculation (135) of a statistical coefficient from the calculated scores; d. definition (140) of an abnormality threshold from the median and the statistical coefficient; the process further includes, in an inference phase, the steps of: a. acquisition (150) of at least one lead of interest (3), b. processing (160) of the lead of interest by: • calculating an average log-likelihood value of the track of interest by averaging the log-likelihood values of the data that make up the track of interest, the log-likelihood value of a data point being estimated using the trained neural network, • calculating a score of the average log-likelihood value of the lead of interest relative to the median, and • comparing the score of the average log-likelihood value of the lead of interest to the threshold of abnormality, the lead of interest being classified as "abnormal" when the score of the average log-likelihood value of the lead of interest is greater than the threshold of abnormality, and "normal" otherwise.
2. A method according to claim 1, wherein the statistical coefficient is the coefficient of the MAD algorithm on the scores of the mean log-likelihood values of the tracks of the set of test tracks relative to the median.
3. A method according to claim 2, wherein the abnormality threshold S is defined according to the following equation: S = MEDval1d + nb_MAD x C_MAD With MEDVA, [n the median, C_MAD the coefficient of the MAD algorithm and nb_MAD a coefficient.
4. A method according to any one of the preceding claims, wherein a track is a track of AIS messages, radar plots, satellite detections, or GPS georeferenced positions.
5. A method according to any one of the preceding claims, wherein, data being an AIS message, an abnormal track consists of: a deviation anomaly; an AIS system inability or interruption anomaly; a collision risk anomaly; or an entry anomaly into an unusual area.
6. A method according to any one of the preceding claims, wherein step f is performed in real time, preferably at each update of the track of interest leading to the addition of data.
7. A method according to any one of the preceding claims, wherein a length of a track of interest (3) is configurable by a sliding window.
8. A method according to any one of the preceding claims, wherein the training and validation tracks are tracks of which the majority are considered to be normal.
9. A method according to any one of the preceding claims, wherein the neural network is the GeoTrackNet network.
10. A computer program comprising software instructions which, when executed by a computer, implement a method according to any one of the preceding claims.