Computer system and method for detecting spoofed automated identification system data

Abstract

A system and method for detecting spoofing in automated identification system ("AIS") data is provided. The method includes: storing, in a data storage device, a vessel track comprising a plurality of temporally ordered AIS position reports with the same vessel identifier; identifying, by a processor, an AIS position report in the vessel track for spoofing detection; executing, by the processor, an anomaly type classifier algorithm on the AIS position report to classify the AIS position report as a non-persistent anomaly or a persistent anomaly; and flagging, by the processor, the vessel track for spoofing when the output of the anomaly type classifier algorithm is a persistent anomaly.

Description

COMPUTER SYSTEM AND METHOD FOR DETECTING SPOOFED AUTOMATED IDENTIFICATION SYSTEM DATATechnical Field

[0001] The following relates generally to ship tracking, and more particularly to systems and methods for detection and classification of anomalous ship tracking data.Introduction

[0002] Self-reporting Automated Identification System (AIS) technology provides information about a vessel’s identity and its location. The self-reporting nature of the AIS mechanism creates a risk for AIS spoofing, in addition to various self-reporting data anomalies. For example, vessels might use AIS spoofing to falsify their true identities or positions. Such vessels often engage in illegal activities such as unregulated fishing, narcotics transport, human trafficking, and sovereignty infringement.

[0003] Accordingly, there is a need for an improved system and method for detecting spoofing in AIS data that overcomes at least some of the disadvantages of existing systems and methods.Summary

[0004] A computer-implemented method of detecting spoofing in automated identification system (“AIS”) data is provided. The method includes: storing, in a data storage device, a vessel track comprising a plurality of temporally ordered AIS position reports with the same vessel identifier; identifying, by a processor, an AIS position report in the vessel track for spoofing detection; executing, by the processor, an anomaly type classifier algorithm on the AIS position report to classify the AIS position report as a non-persistent anomaly or a persistent anomaly; and flagging, by the processor, the vessel track for spoofing when the output of the anomaly type classifier algorithm is a persistent anomaly.

[0005] In an embodiment, the anomaly type classifier algorithm classifies based on a comparison of the AIS position report to a sequence of temporally previous AIS position reports in the vessel track.

[0006] In an embodiment, executing the anomaly type classifier algorithm includes: computing, by the processor, a cumulative anomaly score for the AIS position report by comparing the AIS position report to the sequence of temporally previous position reports in the vessel track; comparing, by the processor, the cumulative anomaly score to the threshold cumulative anomaly score; and where the cumulative anomaly score meets the threshold cumulative anomaly score, flagging the vessel track for spoofing.

[0007] In an embodiment, the method further includes: classifying, using a report classifier algorithm executed by the processor, the AIS report as anomalous prior to executing the anomaly type classifier algorithm; wherein the report classifier algorithm is configured to classify a given AIS report as anomalous or clean.

[0008] In an embodiment, the report classifier algorithm classifies based on a comparison between locations and timestamps of the AIS report and an immediately temporally previous AIS position report in the vessel track.

[0009] In an embodiment, the report classifier algorithm determines whether the AIS position report is within a physically possible distance from the immediately temporally previous AIS position report based on a maximum speed.

[0010] In an embodiment, the maximum speed is a user-defined parameter set by a user through a graphical user interface.

[0011] In an embodiment, the method further includes: when the output of the anomaly type classifier algorithm is a persistent anomaly, separating, by the processor, the vessel track into two or more vessel tracks, wherein each of the two of more vessel tracks have different vessel identifiers, and storing the two or more vessel tracks in the data storage device.

[0012] In an embodiment, the method further includes assigning the AIS position report a new vessel identifier prior to separating the vessel track.

[0013] In an embodiment, the method further includes: storing, in the data storage device, a field or regard or a reception range of an AIS receiver that received the AIS position report; comparing, by the processor, a reported vessel position in the AIS report to the field of regard or the reception range of the AIS receiver; and flagging, by theprocessor, the AIS position report for spoofing when the reported vessel position is outside the field of regard or the reception range of the AIS receiver.

[0014] In an embodiment, the method further includes generating, by the processor, an alert in response to flagging the AIS position report for spoofing and reporting the alert in a graphical user interface.

[0015] In an embodiment, the method further includes, when the AIS position report is classified as a non-persistent anomaly: classifying, by the processor, the non-persistent anomaly into one of at least two classes of bit flip type anomalies.

[0016] In an embodiment, the at least two classes include MMSI bit flip, position bit flip, and timestamp bit flip.

[0017] In an embodiment, the method further includes: classifying, by the processor, the non-persistent anomaly as an MMSI bit flip; determining, by the processor, whether the AIS position report could belong to a different vessel stored in the data storage device within a certain confidence level; and assigning, by the processor, a new vessel identifier to the AIS position report corresponding to the different vessel track when the confidence level is met.

[0018] In an embodiment, the method further includes: classifying, by the processor, the non-persistent anomaly as a position bit flip; and rectifying, by the processor, the AIS position report by fixing or placing the AIS position report into correct latitude and longitude coordinates.

[0019] In an embodiment, the method further includes receiving, by the processor, an area of interest (AOI) defined by a user through a graphical user interface; and determining that the vessel track is within the AOI.

[0020] In an embodiment, the method further includes: receiving, by the processor, a time limit defined by a user through a graphical user interface; and flagging, by the processor, the vessel track for a self-reporting interruption when: the vessel track has two AIS position reports spaced further in time than the time limit; or the vessel track has a time difference between a last received AIS position report and a current time that is greater than the time limit.

[0021] In an embodiment, the vessel identifier is a maritime mobile service identity (“MMSI”) number.

[0022] A system for detecting spoofing in automated identification system (“AIS”) data is also provided. The system includes: a data storage device that stores a vessel track comprising a plurality of temporally ordered AIS position reports with the same vessel identifier; and a processor in communication with the data storage device, the processor configured to: identify an AIS position report in the vessel track for spoofing detection; execute an anomaly type classifier algorithm on the AIS position report to classify the AIS position report as a non-persistent anomaly or a persistent anomaly; and flag the vessel track for spoofing when the output of the anomaly type classifier algorithm is a persistent anomaly.

[0023] In an embodiment, the anomaly type classifier algorithm classifies based on a comparison of the AIS position report to a sequence of temporally previous AIS position reports in the vessel track.

[0024] In an embodiment, executing the anomaly type classifier algorithm includes: computing a cumulative anomaly score for the AIS position report by comparing the AIS position report to the sequence of temporally previous position reports in the vessel track; comparing the cumulative anomaly score to the threshold cumulative anomaly score; and where the cumulative anomaly score meets the threshold cumulative anomaly score, flagging the vessel track for spoofing.

[0025] In an embodiment, the processor is further configured to: classify, using a report classifier algorithm executed by the processor, the AIS report as anomalous prior to executing the anomaly type classifier algorithm. The report classifier algorithm is configured to classify a given AIS report as anomalous or clean.

[0026] In an embodiment, the report classifier algorithm classifies based on a comparison between location and timestamp of the AIS report and an immediately temporally previous AIS position report in the vessel track.

[0027] In an embodiment, the report classifier algorithm determines whether the AIS position report is within a physically possible distance from the immediately temporally previous AIS position report based on a maximum speed.

[0028] In an embodiment, the maximum speed is a user-defined parameter set by a user through a graphical user interface.

[0029] In an embodiment, the processor is further configured to: when the output of the anomaly type classifier algorithm is a persistent anomaly, separate the vessel track into two or more vessel tracks, wherein each of the two of more vessel tracks have different vessel identifiers, and store the two or more vessel tracks in the data storage device.

[0030] In an embodiment, the processor is further configured to: store, in the data storage device, a field or regard or a reception range of an AIS receiver that received the AIS position report; compare a reported vessel position in the AIS report to the field of regard or the reception range of the AIS receiver; and flag the AIS position report for spoofing when the reported vessel position is outside the field of regard or the reception range of the AIS receiver.

[0031] In an embodiment, when the AIS position report is classified as a non-persistent anomaly, the processor is further configured to: classify the non-persistent anomaly into one of at least two classes of bit flip type anomalies.

[0032] In an embodiment, the at least two classes include MMSI bit flip, position bit flip, and timestamp bit flip.

[0033] A computer-implemented method of detecting spoofing in automated identification system (“AIS”) data is also provided. The method includes: storing, in a data storage device, a vessel track comprising a plurality of temporally ordered AIS position reports with the same vessel identifier; executing, with a processor, a first anomaly detection algorithm to classify an AIS position report in the vessel track as anomalous or non-anomalous; where the AIS position report is anomalous, executing, with the processor, a second anomaly detection algorithm to classify the AIS position report as anon-persistent anomaly or a persistent anomaly; and where the AIS position report is classified as a persistent anomaly, flagging the vessel track for spoofing.

[0034] A system for detecting spoofing in automated identification system (“AIS”) data is also provided. The system includes: a data storage device storing a vessel track comprising a plurality of temporally ordered AIS position reports with the same vessel identifier; one or more processors in communication with the data storage device, the one or more processors configured to: execute a first anomaly detection algorithm to classify an AIS position report in the vessel track as anomalous or non-anomalous; where the AIS position report is anomalous, execute a second anomaly detection algorithm to classify the AIS position report as a non-persistent anomaly or a persistent anomaly; and where the AIS position report is classified as a persistent anomaly, flag the vessel track for identity spoofing.

[0035] A computer-implemented method of detecting spoofing in automated identification system (“AIS”) data is also provided. The method includes: storing, in a data storage device, a vessel track comprising a plurality of temporally ordered AIS position reports with the same vessel identifier and a threshold cumulative anomaly score; identifying, via a processor, an AIS position report in the vessel track for spoofing detection; computing, by the processor, a cumulative anomaly score for the AIS position report by comparing the AIS position report to a sequence of temporally previous position reports in the vessel track; comparing, by the processor, the cumulative anomaly score to the threshold cumulative anomaly score; and flagging, by the processor, the vessel track for spoofing where the cumulative anomaly score meets the threshold cumulative anomaly score.

[0036] In an embodiment, the method further includes, where the cumulative anomaly score does not meet the cumulative anomaly score threshold, flagging the AIS position report as a non-persistent anomaly.

[0037] In an embodiment, the method further includes classifying, by the processor, the non-persistent anomaly into one of at least two classes of bit flip type anomalies.

[0038] In an embodiment, the at least two classes include MMSI bit flip, position bit flip, and timestamp bit flip.

[0039] A system for detecting spoofing in automated identification system (“AIS”) data is also provided. The system includes: a data storage device that stores a vessel track comprising a plurality of temporally ordered AIS position reports with the same vessel identifier and a threshold cumulative anomaly score; a processor in communication with the data storage device, the processor configured to: identify an AIS position report in the vessel track for spoofing detection; compute a cumulative anomaly score for the AIS position report by comparing the AIS position report to a sequence of temporally previous position reports in the vessel track; compare the cumulative anomaly score to the threshold cumulative anomaly score; where the cumulative anomaly score meets the threshold cumulative anomaly score, flag the vessel track for spoofing.

[0040] Other aspects and features will become apparent, to those ordinarily skilled in the art, upon review of the following description of some exemplary embodiments.Brief Description of the Drawings

[0041] The drawings included herewith are for illustrating various examples of articles, methods, and apparatuses of the present specification. In the drawings:

[0042] Figure 1 is a schematic diagram of a system for detecting spoofed automated identification system (AIS) data, according to an embodiment;

[0043] Figure 2 is a block diagram of a computer system for AIS data spoofing detection, according to an embodiment;

[0044] Figure 3 is a flowchart of a method of detecting a self-reporting interruption of AIS data, according to an embodiment;

[0045] Figure 4 is a flowchart of a method of detecting anomalous AIS positional reports, according to an embodiment;

[0046] Figure 5 is a flowchart of a method of classifying an AIS positional report as a persistent anomaly or a non-persistent anomaly, according to an embodiment;

[0047] Figure 6 is a block diagram of a data processing pipeline for detecting spoofed AIS data, according to an embodiment; and

[0048] Figures 7A-7B are schematic diagrams illustrating typical scenarios for non-persistent and persistent anomalies, respectively, that may be detected by the systems of the present disclosure, according to an embodiment.Detailed Description

[0049] Various apparatuses or processes will be described below to provide an example of each claimed embodiment. No embodiment described below limits any claimed embodiment and any claimed embodiment may cover processes or apparatuses that differ from those described below. The claimed embodiments are not limited to apparatuses or processes having all of the features of any one apparatus or process described below or to features common to multiple or all of the apparatuses described below.

[0050] One or more systems described herein may be implemented in computer programs executing on programmable computers, each comprising at least one processor, a data storage system (including volatile and non-volatile memory and / or storage elements), at least one input device, and at least one output device. For example, and without limitation, the programmable computer may be a programmable logic unit, a mainframe computer, server, and personal computer, cloud-based program or system, laptop, personal data assistance, cellular telephone, smartphone, or tablet device.

[0051] Each program is preferably implemented in a high-level procedural or object-oriented programming and / or scripting language to communicate with a computer system. However, the programs can be implemented in assembly or machine language, if desired. In any case, the language may be a compiled or interpreted language. Each such computer program is preferably stored on a storage media or a device readable by a general or special purpose programmable computer for configuring and operating the computer when the storage media or device is read by the computer to perform the procedures described herein.

[0052] A description of an embodiment with several components in communication with each other does not imply that all such components are required. On the contrary, a variety of optional components are described to illustrate the wide variety of possible embodiments of the present invention.

[0053] Further, although process steps, method steps, algorithms or the like may be described (in the disclosure and I or in the claims) in a sequential order, such processes, methods and algorithms may be configured to work in alternate orders. In other words, any sequence or order of steps that may be described does not necessarily indicate a requirement that the steps be performed in that order. The steps of processes described herein may be performed in any order that is practical. Further, some steps may be performed simultaneously.

[0054] When a single device or article is described herein, it will be readily apparent that more than one device I article (whether or not they cooperate) may be used in place of a single device I article. Similarly, where more than one device or article is described herein (whether or not they cooperate), it will be readily apparent that a single device I article may be used in place of the more than one device or article.

[0055] The following relates generally to ship tracking, and more particularly to systems and methods for detection and classification of anomalous ship tracking data.

[0056] Referring now to Figure 1, shown therein is a system 100 for detecting spoofed AIS ship tracking data, according to an embodiment.

[0057] The system 100 may be used to detect AIS data spoofing by a vessel 102.

[0058] The vessel 102 includes an AIS unit that automatically transmits key information 104 about the vessel 102 (“AIS data 104”). The AIS data 104 includes a timestamp, dynamic information, and static information. Dynamic information may include, for example, vessel position (e.g., latitude / longitude, GPS coordinates), heading, and speed. Static information may include, for example, a vessel name, a vessel identifier (e.g., MMSI number), vessel type, vessel length, cargo type, and destination. In an embodiment, the AIS data 104 includes attribute values for some or all of the following attributes:Table A-2 Parsing AIS data payloadField Description Field Description0-5 Message Type 89-115 Latitude6-7 Repeat Indic a tor 116-127 Course over Ground (CoG)8-37 MM SI 128-136 True Heading (HDG)38-41 Navigational Status 137-142 Time stamp42-49 Rate of Turn (RoT) 143-144 Maneuver indicator50-59 Speed over Ground (SoG) 145-147 Spare60-60 Positional A 148-148 Receiver Autonomous Integrityccuracy Monitoring (RAIM) flag61-88 Longitude 149-167 Radio Status

[0059] The AIS data 104 transmitted by the vessel 102 is collected by an AIS receiver 106. The AIS receiver 106 may be a satellite-based receiver (i.e., a satellite) or a terrestrial-based receiver (i.e., a terrestrial base station).

[0060] The AIS data 104 is sent from the AIS receiver 106 to an AIS data server 108. The AIS data server 108 executes an AIS tracking service application 110 for managing the collection, storage, and reporting of AIS data 104. The AIS application 110 may package or format the AIS data 104 in a manner that is convenient for consumption by a user or by another software application.

[0061] The system 100 includes an AIS spoofing detection server system 112, a user device 114, and an AIS data store 116 (or AIS data source). While a single server computer 112 and a single user device 114 are shown in Figure 1, the number of servers 112 and user devices 114 may vary (e.g., multiple) and the number is not particularly limited.

[0062] The server system 112 communicates with the user device 114 and the AIS data store 116 via a communication network 118. The network 118 may be a wide area network, such as the Internet. Communication in this context may include sending and receiving data. The server system 112 may also communicate with the AIS server 108 via network 118.

[0063] The AIS data store 116 stores AIS position reports 122. The AIS position reports 122 may be stored in any suitable format or structure, such as a database or the like. The AIS position reports 104 may be a formatted version of the raw AIS data 104 collected by AIS receiver 106.

[0064] The AIS data store 116 may be managed by the AIS data server 108 (e.g., via application 110), the server system 112, or another computer system.

[0065] In cases where the AIS data store 116 is managed by the server system 112, the AIS data store 116 may be local to server system 112 or remote to server system 112 as depicted in Figure 1 (and accessed through network 118).

[0066] The AIS data store 116 also stores AIS vessel tracks 124.

[0067] A vessel track 124 is a set of temporally consecutive AIS positional reports 122 that have the same vessel identifier (MMSI number).

[0068] The positional reports 122 in a vessel track 124 are ordered chronologically according to the timestamps associated with the reports 122.

[0069] A vessel track 124 is intended to estimate or give an indication of the track or path that a vessel has taken over time based on self-reported AIS data.

[0070] Vessel tracks 124 may be created from AIS reports 122 by the server system 112 (e.g., by application 120) or by AIS server 108 (e.g., by application 110).

[0071] The server 112 runs an AIS data spoofing detection software application 120. The user device 114 communicates with the server system 112 over the network 118 and provides a user interface of the AIS spoofing detection application 120 for a user to request and review outputs of the AIS spoofing detection application 120, including detected spoofing cases. Outputs may include alerts generated automatically by the application 120.

[0072] According to various embodiments, the AIS spoofing detection application 120 is hosted by the server system 112, or is installed locally on the user device 114, or runs on both the server system 112 and the user device 114.

[0073] The user device 114 is configured to receive input from a user and display data generated by the server 112. The input data received from a user may be used to request certain data generated and stored by the server 112. The user device 114 is configured to display a graphical user interface that allows a user to interact with the server 112. The user interface may include a series of user interface screens for receiving user input and displaying output data generated by the server 112. In some embodiments, the AIS spoofing detection application 120 is configured to generate an alert in response to a detected case of AIS spoofing and display the alert in the graphical user interface at the user device 114. In some embodiments, such an alert may be delivered as an email, text message, or the like.

[0074] The server system 112 uses application 120 to analyze the AIS reports 122 using one or more AIS spoofing detection techniques or algorithms, such as described herein.

[0075] In some cases, user input to the application 120 at user device 114 may dictate which AIS reports 122 are analyzed and when. For example, a user may define an area of interest (AOI) or subscription area using the application 120 and the application 120 monitors AIS reports 122 in the AOI for anomalies or instances of spoofing.

[0076] The AIS spoofing detection application 120 may be configured to detect any one or more of (i) interruptions in self-reporting of AIS data (self-reporting interruption), (ii) identity spoofing, (iii) position spoofing, and (iv) non-persistent anomalies (also referred to as one-off anomalies or false alarms).

[0077] Self-reporting interruptions occur when vessels stop reporting AIS data 104 for a period of time.

[0078] Identity spoofing (which may also be referred to as “identity recycling) includes cases where two or more ships broadcast a position report using the same MMSI number. When two (or more) ships are broadcasting their position reports using the same MMSI number, it can appear as though a single vessel is moving from one geographical location to another at impossible speeds.

[0079] In cases of detected identity spoofing, the application 120 may flag and disambiguate (separate) the vessel track with detected identity spoofing into multiple vessel tracks. While it may not be possible to definitively identify the identity of the spoofing vessels, separating and establishing realistic vessel tracks by application 120 may enable accurate vessel position prediction and SAR-AIS association.

[0080] Position spoofing includes cases of vessels reporting wrong locations or other wrong data (e.g., vessel length, speed, type, heading) in the AIS reports 122.

[0081] Non-persistent anomalies include unintentional AIS anomalies, such as transmission and instrument errors. Examples include bit flips in the fields of transmitted AIS data. The application 120 is configured to handle non-persistent anomalies differently from actual cases of identity or position spoofing. Non-persistent anomalies, such as bit flips, are considered non-malicious and thus their detection and differential treatment by the application 120 as compared to cases of spoofing is advantageous.

[0082] In a particular embodiment, the application 120 implements a single algorithm that detects non-persistent anomalies, identity spoofing, and position spoofing.

[0083] Referring now to Figure 2, shown therein is a computer system 200 for detecting spoofed AIS data, according to an embodiment.

[0084] The computer system 200 may be implemented using the server system 112 and the user device 114 of Figure 1.

[0085] The system 200 includes a memory 202 and a processor 204 in communication with the memory 202.

[0086] The system 200 includes a communication interface 206 for transmitting and receiving data. The communication interface 206 may include a network interface.

[0087] The system 200 includes a display 208 for displaying data generated by the system 100. The display 108 may be located at a user device of the system 200, such as user device 114 of Figure 1.

[0088] The system 200 includes an input device for providing input data to the system 200 by a user, such as through a graphical user interface. The input device 200 may include a pointing device (e.g., a mouse), a keypad, or the like.

[0089] The processor 204 executes an AIS spoofing detection application 120. The AIS spoofing detection application 120 may be the AIS spoofing detection application 120 of Figure 1. Modules and components of AIS spoofing detection application 120 may be implemented or executed at or across multiple computing devices (e.g., networked computer devices).

[0090] The memory 202 stores a vessel track 232. The vessel track 232 may be an instance of the vessel tracks 124 of Figure 1. A single vessel track 232 is shown in Figure 2 for illustrative purposes. It will be understood that in implementations of the system 200, there may be a plurality (i.e., many) vessel tracks.

[0091] The vessel track 232 may be received from an external source or system, such as through a network (e.g., network 118), or may be generated by the system 200 (e.g., by application 120 or another software application running on processor 204). The vessel track 232 may be generated by identifying AIS position reports with the same MMSI number and then sorting them by timestamp. In doing so, the assembled vessel track estimates a path or track traveled by the vessel.

[0092] The vessel track 232 includes a set of temporally consecutive AIS reports that contain the same MMSI number.

[0093] Vessel track 232 includes position reports 234-1 to 234-n, where 234-1 is the most recent, and where n is an integer greater than 1. For simplicity, only position reports 234-1, 234-2, 234-3, and 234-n are shown in Figure 2. Position reports may be referred to collectively as position reports 234 and generically as position report 234.

[0094] Each position report 234 includes an MMSI number 236, a timestamp 238 (e.g., UTC timestamp), a location 240 (e.g., latitude / longitude coordinates), and a speed 242. The reports 234 may include additional data fields that are not shown in Figure 2.

[0095] As previously noted, the position reports 234-1 to 234-n are grouped into a track based on them all having the same MMSI number 236 and ordered according to timestamp 238.

[0096] The AIS spoofing detection application 120 includes a self-reporting interruption detection module 212.

[0097] The self-reporting interruption detection module 212 is configured to detect vessels that stop reporting AIS data for a period of time.

[0098] In an embodiment, self-reporting interruption detection module 212 operates according to method 300 of Figure 3.

[0099] The AIS spoofing detection application 120 includes an AIS report classifier module 214.

[0100] The AIS report classifier module 214 receives a position report 234 as input and classifies the position report 234 as anomalous or clean.

[0101] The report classifier module 214 detects anomalous position reports based on the location 236 and timestamp 234 of the position report 234.

[0102] The report classifier module 214 flags anomalous position reports.

[0103] The report classifier module 214 determines a validity of a position report 234 relative to a temporally previous position report in the same vessel track 212. For example, the report classifier module 214 determines whether positional report 234-1 is valid (i.e., non-anomalous) relative to positional report 234-2.

[0104] The report classifier module 214 determines whether a position report 234 is within a physically possible distance from a temporally previous position report in the same vessel track 232.

[0105] In an embodiment, the report classifier module 214 detects anomalous position reports according to method 400 of Figure 4.

[0106] The AIS spoofing detection application 120 further includes an anomaly type classifier module 216.

[0107] The anomaly type classifier module 216 determines the validity of a position report 234 relative to a sequence of previous position reports in the same vessel track 232. For example, where the anomaly type classifier module 216 is to classify position report 234-1 of vessel track 232, the anomaly type classifier module 216 analyzes the position report 234-1 relative to report 234-2, relative to report 234-3, and relative to report 234-n.

[0108] The anomaly type classifier module 216 receives a position report 234 as input and classifies the position report 234 as a persistent anomaly or a non-persistent anomaly.

[0109] In some embodiments, the anomaly type classifier module 216 is fed only position reports 234 that are identified as anomalous by the report classifier module 214.

[0110] Classification as a persistent anomaly is used by the system 200 as an indication of identity spoofing. Thus, classification by anomaly type classifier module 216 as a persistent anomaly may be considered akin to classifying as identity spoofing.

[0111] Classification as a non-persistent anomaly (or one-off or few-off anomaly) indicates an unintentional anomaly.

[0112] Whether a given position report 234 is classified as a non-persistent anomaly or a persistent anomaly depends on a cumulative anomaly score 244 computed by the anomaly type classifier module 216. The cumulative anomaly score 244 is stored in memory 202.

[0113] Once determined, the cumulative anomaly score 244 is compared to a threshold cumulative anomaly score 246. The threshold 246 may be a user-defined threshold and may be defined through user input via the GUI module 230. The threshold 246 is stored in memory 202.

[0114] If the cumulative anomaly score 244 meets the threshold 246, the anomaly type classifier 216 flags the vessel track 232 that contains the report 234 as a persistent anomaly.

[0115] If the cumulative anomaly score 244 does not meet the threshold 246, the anomaly type classifier 216 flags the report 234 as a non-persistent anomaly.

[0116] In an embodiment, the anomaly type classifier module 216 may work as follows. Let Ri be the current (latest) position report being considered (e.g., report 234-1 ). Let N be the number of position reports being considered for determining the validity of Ri (where invalidity indicates a persistent anomaly). That is, the sequence (Ri, Ri-i, Ri-2, Ri-n) forms the set of observations from which validity of Ri is established. Let pi be a binary value, indicating if R is anomalous to Ri-i. That is,p_i = {1 if R_i is anomalous to R_{i-1}; 0 if R_i is not anomalous to R_{i-1}

[0117] The anomalousness of Ri to Ri-1 may be established using the method 400 of Figure 4. The cumulative anomaly score 244, denoted s / , of Ri may be defined as:p_j, with summation from j=i-N to N

[0118] Generally, if a position report contains a transmission error, for example in either the position or temporal fields, the cumulative anomaly score s, will be low, whereas if position reports in the vessel track are consistently anomalous, the cumulative anomaly score s will be relatively high. This concept is illustrated in Figures 7A and 7B, which show typical scenarios of a non-persistent anomaly (position report Ri is anomalous) and a persistent anomaly (identity spoofing), respectively. The decision of whether or not to flag a position report Ri as an anomalous record is based on a threshold 246. If the cumulative anomaly score 244 is greater than or equal to the threshold 246 (sz> T), then the record Ri is flagged (the vessel track indicates a persistent anomaly). Setting a higher threshold 246 suggests less sensitivity to one-off (non-persistent) anomalies.

[0119] In an embodiment, the anomaly type classifier 216 works according to the method 500 of Figure 5.

[0120] The AIS spoofing detection application 120 also includes a vessel track separator module 218.

[0121] The vessel track separator 218 separates vessel track 232 into two or more vessel tracks. Vessel track separation is performed on vessel track 232 when vessel track 232 is identified as a persistent anomaly by anomaly type classifier 216.

[0122] The vessel track separator 218 separates the vessel track 232 based on the logical locations 240 of the position reports 234 in the vessel track 232. The vessel track separator 220 references a maximum speed value. The maximum speed value may be defined by a user, for example through GUI module 230.

[0123] The vessel track separator 218 considers the locations 240 between temporally consecutive position reports 234 and determines a distance between the two locations. The vessel track separator 218 also determines a time difference between the two position reports, using timestamps 238. The vessel track separator 218 computes a maximum distance travelled by multiplying the time difference by the maximum speed. The vessel track separator 218 compares the distance traveled to the maximum distance traveled. Where the distance traveled is greater than the maximum distance traveled, the two position reports are considered to be different vessels and are placed into separate vessel tracks. Where the distance traveled is less than or equal to the maximum distance traveled, the two positions are considered physically possible by the same vessel and are grouped into the same (a coherent) vessel track.

[0124] The vessel track separator 218 may flag the separated vessel tracks. Each subsequent positional report 234 may be checked against each separated vessel track to see if there is a possibility of there being yet another ship broadcasting on the same MMSI number.

[0125] In an embodiment, the vessel track separator module 218 may work as follows. Let Ri be a sequence of anomalous position reports which requires track separation. Let NJ be the number of records in vessel js track. The vessel track separator 218 executes the following algorithm:Initialize: U = { track 1} / / sec of vessel TracksInitialize: = {} / / se of possible tracksSet ■ ■ L t'’ niax*for! = JVJby -1 to 2 do:for fc = l by 1 oo size (EJ) do:Ad = distfR,, / / distance between Rj and R^At = ti'irie(Rj, Rj_1) / / UTC difference between R / and Rj_tif At ■ IVria.'C Adcreate new vessel track k, add it to the set 1LT.assign to the new track k.elseadd track k to V.endendif V {0}Let R,frbe the last report in track.assign R, to n?t {[Usr R,, R,^)}.endr_cl

[0126] The AIS spoofing detection application 120 also includes a non-persistent anomaly type classifier 220.

[0127] The non-persistent anomaly type classifier module 220 classifies a non-persistent anomaly report as one of an MMSI bit flip, a position (latitude I longitude) bit flip, or a timestamp (e.g., UTC) bit flip. In other embodiments, other classes or types of bit flip anomalies may be used (e.g., other fields in the AIS data) and classified by the classifier 220.

[0128] The non-persistent anomaly type classifier module 220 may identify a one-off anomaly as a MMSI bit flip by checking if the anomalous report could feasibly belong to any other ship track in the vicinity of the anomalous positional report. This involves matching the location and time of the anomalous positional report to other AIS tracks in the area. Additionally, other metadata may be compared (like vessel course / heading / speed). If these are consistent with another vessel, then it is likely a MMSI bitflip and the module 220 classifies the anomalous report as such.

[0129] In a positional bitflip, either the Latitude or the Longitude will be out of sync with the vessel track. The non-persistent anomaly type classifier module 220 checks if the track would make sense by altering either latitude or the longitude of the anomalouspositional report. If so, then the non-persistent anomaly type classifier module 220 identifies the one-off anomaly as a positional bitflip.

[0130] In the case of a UTC bitflip, the anomalous report looks like it is at the right place, but at the wrong time. The non-persistent anomaly type classifier module 220 may check this by seeing if the location of the anomalous report lies on top of the current track, while disregarding its timestamp.

[0131] The AIS spoofing detection application 120 also includes a position report reassignment module 222. The position report reassignment module 222 attempts reassignment on a position report 234 that has been classified as an MMSI bit flip. The reassignment is based on seeing if the anomalous position report can belong to another vessel track with a certain level of confidence. Reassignment includes assigning a new MMSI number to the anomalous position report that has been classified as an MMSI bitflip.

[0132] The AIS spoofing detection application 120 also includes a position report rectification module 224. The position report rectification module 224 performs rectification on a position report 234 that has been classified as a position bit flip. Rectification of the position report 234 may be based on dead reckoning on the previously received report. For example, if position report 234-1 was classified as a position bit flip, the position report rectification module 224 performs dead reckoning on position report 234-2. Rectification of the position report 234 by module 224 includes fixing or placing the anomalous position report into the correct coordinates (lat / long).

[0133] The AIS spoofing detection application 120 also includes a position spoofing detector module 226.

[0134] The position spoofing detector 226 receives a position report 234 as input and compares the reported vessel position (location) 240 in the report 234 to AIS receiver data 248 to determine if the vessel’s reported position 240 is feasible in view of the AIS receiver that received the broadcast.

[0135] The AIS receiver data 248 is stored in memory 202. The AIS receiver data 248 may be obtained or retrieved from an external AIS receiver data source (e.g., through a network, such as network 118).

[0136] AIS receiver data 248 includes satellite two line elements (TLEs) data 250 and terrestrial base station information data 252.

[0137] Where the AIS receiver that received the position report 234 is a satellite, the satellite TLEs data 250 is used. Where the AIS receiver that received the position report 234 report is a terrestrial base station, the terrestrial base station data 252 is used.

[0138] The position spoofing module 226 may first determine from the positional report 234 in question whether the AIS receiver was a satellite (satellite-based report) or a terrestrial base station (terrestrial-based report) and use satellite TLEs 250 or base station data 252, respectively, based upon the determination.

[0139] Where the position report 234 is from a satellite, the position spoofing module 226 compares the reported position 240 of the vessel in the position report 234 with the position and field of regard of the satellite that received the AIS report and determines whether the vessel’s reported position 240 is outside the satellite’s field of regard. If the reported position 240 is outside the satellite’s field of regard, the position spoofing module 226 flags the position report 234 as a case of position spoofing. The position spoofing module 226 obtains the satellite’s position and field of regard from the satellite TLE data 250. Satellite TLEs 250 encode a list of orbital elements of a satellite (speed, position, etc.) from which position and field of regard can be obtained.

[0140] Similarly, where the position spoofing module 226 determines that the report is a terrestrial-based report, the position spoofing module 226 compares the vessel’s reported position with a reception range of the receiving base station. The position spoofing module 226 may compute or obtain the reception range based on a base station location and other information about the base station contained in the base station data 252. If the ship's reported position 240 is outside of the reception range of the base station, then the position spoofing module 226 flags the report 234 for position spoofing.

[0141] In some embodiments, the system 200 may store satellite-based SAR data in memory 202 and the position spoofing detection module 226 may use the SAR data to confirm the position spoofing. The SAR data may include information on SAR-based vessel detections. The position spoofing detection module 226 may use the location 240 and timestamp 238 in the anomalous report 234 and determine whether there is a SAR-based vessel detection in the SAR data at that time and location. Where SAR data is used, the alert or report of position spoofing may include information on SAR data that was checked (and identified a SAR detection if found).

[0142] The AIS spoofing detection application 120 also includes an alert module 228. The alert module 228 reports flagged data to the user through the graphical user interface module 130. The alert module 228 may generate an alert or report. The alert module 228 may be invoked automatically when a position report or vessel track is flagged by another module of the application 120 (e.g., as a one-off or non-persistent anomaly, as identity spoofing, as position spoofing, as a self-reporting interruption). For example, where position spoofing module 226 detects position spoofing in a report 234, the position spoofing module 226 may flag the position report 234 with a unique flag indicating position spoofing and invoke the alert module 228. The alert module 228 generates an alert or report that notes the position spoofing (or other detected anomaly).

[0143] In some embodiments of system 200, machine learning techniques may be used to detect cases of AIS spoofing.

[0144] For example, in an embodiment, a machine learning model may be trained to detect at least one type of AIS spoofing used a supervised learning technique. Training data may include spoofed vessel tracks identified by the AIS spoofing detection application 120 (e.g., via module 216 or module 226) and non-spoofed vessel tracks. The training samples are labelled (e.g., spoofed, not spoofed; or not spoofed, identity spoofing, position spoofing). The machine learning model is trained using the labelled training data. The machine learning model is trained to classify a new (unlabeled) vessel track.

[0145] Once trained, the machine learning model may be used to perform inference. The AIS spoofing application 120 may feed a new (unclassified) vessel trackas input to the trained model and the model returns a classification for the vessel track (e.g., spoofed, not spoofed). The number and nature of the classes may vary and depend on the training data. For example, in one embodiment, the model may classify a vessel track as spoofed or not spoofed. In another embodiment, the model may classify a vessel track as not spoofed, position spoofing, or identity spoofing. In another embodiment, the application 120 may use multiple machine learning models. For example, the application 120 may use a first machine learning model to classify the vessel track as spoofed or not spoofed. For ship tracks classified as spoofed, the vessel track may then be provided to a second machine learning model configured to classify the vessel track as position spoofing or identity spoofing.

[0146] Accordingly, while the system 200 may be used to detect spoofing of AIS data, the system 200 may also be used as a means of identifying and labeling training data for use in training a machine learning model via supervised learning to detect cases of spoofed AIS data (which training and use may also be performed by the system 200, or by another embodiment of the AIS spoofing detection application 120).

[0147] Referring now to Figure 6, shown therein is a data processing pipeline 600 for AIS spoofing detection, according to an embodiment. The data processing pipeline 600 represents an algorithm for detecting multiple types of anomalies in AIS data, including one-off anomalies, identity spoofing, and position spoofing.

[0148] The data processing pipeline 600 may be encoded as computer-executable instructions and executed by one or more computing devices comprising one or more processors. In an embodiment, the pipeline 600 may be executed by the server system 112 of Figure 1 or the computer system 200 of Figure 2. The pipeline 600 may be implemented by the AIS spoofing detection application 120 of Figure 1 or Figure 2.

[0149] It should be noted that, in some embodiments, the execution of pipeline 600 may be limited to AIS position reports that correspond to an AOI or subscription area (and potentially time period), which may be user defined, such as through a III. In this context, the AOI may be considered an area for which the user wants the system to check for AIS spoofing (and potentially other types of anomalies).

[0150] It should also be noted that pipeline 600 refers to different “flags” (e.g., flag 1, flag2). The different flags represent a classification of the type of anomaly and are thus unique to the particular anomaly type (e.g., Flagl for non-persistent anomaly, Flag2 for identity spoofing, Flag3 for position spoofing). In some cases, the manner of or information included in a report, alert, or visualization of anomalies detected by pipeline 600 may vary based on the flag type associated with the anomaly.

[0151] The pipeline 600 is used to process AIS position reports 602 and detect cases of AIS spoofing. The AIS position reports 602 may be the position reports 122 of Figure 1 or the position reports 234 of Figure 2. As noted, in some embodiments, the position reports 602 that are provided as input to pipeline 600 may be limited to those position reports 602 that meet AOI criteria defined by a user.

[0152] In pipeline 600, every AIS position report 602 is first fed through a high-level classification module 604. The AIS position report 602 is denoted Ri in Figure 6. The high level classification module 604 may be the report classifier module 214 of Figure 2. The high level classification module 604 determines whether the position report 602 is anomalous or clean (non-anomalous). Such determination is based on a location and a time of the report 602 in relation to a previously received report 606 in the same vessel track. The previously received report 606 is denoted Ri-i in Figure 6.

[0153] Reports 602 that are classified as anomalous by high level classifier 604 are fed to an anomaly type classifier module 608. The anomaly type classifier module 608 may be the anomaly type classifier module 216 of Figure 2. Reports 602 classified as anomalous by high level classifier 604 are also fed to a position spoofing module 634 (described below).

[0154] The anomaly type classifier module 608 classifies an anomalous report as a non-persistent anomaly 610 (also referred to as a one-off or few-off anomaly) or a persistent anomaly 612. The determination is based on computing a cumulative anomaly score from a sequence of previous position reports 614 in the same vessel track. The sequence of previous position reports 614 are denoted Ri-2, Ri-3, and so on.

[0155] The anomaly type classifier module 608 determines if the cumulative anomaly score for the current position report 602 exceeds a user-defined threshold level.The user-defined threshold may be received by the system 600 through a graphical user interface. For example, the user-defined threshold may be defined by a user through graphical user interface module 230 of Figure 2.

[0156] If the position report 602 is classified as a non-persistent anomaly 610, the non-persistent anomaly 610 is further classified into a specific type or class of non-persistent anomaly. This secondary classification of non-persistent anomalies 610 may be implemented, for example, by the non-persistent anomaly type classifier module 220 of Figure 2.

[0157] The non-persistent anomaly 610 is classified into one of an MMSI bit flip 618, a position bit flip 620 (e.g., a bit flip in latitude, longitude, or both), or a timestamp (e.g., UTC) bit flip 622. In other embodiments, other types of non-persistent anomalies 610 may be identified by the system 600. Examples of other types of non-persistent anomalies 610 that may be identified by the system 600 in other embodiments include erroneous static data, impossibly high speeds, location not in navigable water, or the like (which may be based on bit flips or faulty sensor readings).

[0158] Non-persistent anomalies 610 are flagged by flagl 624. Flagl 624 may be a generic flag indicating the likely case of a non-intentional anomalies. Flagl 624 may be indicated to the user by a subtle change in symbology (e.g., through graphical user interface module 230).

[0159] For an MMSI bit flip 618, a position report reassignment 626 is attempted on the report 602. The position report reassignment 626 is based on seeing if the anomalous position report 602 can belong to another vessel track with a certain level of confidence. The position report reassignment 626 may be performed by the position report reassignment module 222 of Figure 2.

[0160] For position bit flips 620, a position report rectification 628 is performed on the report 602. The position report rectification 628 is based on dead reckoning on the previously received report 606. The position report rectification 628 may be performed by the position report rectification module 224 of Figure 2.

[0161] Where a corrected position report 630 is generated, as in reassignment 626 and rectification 628, the corrected position report 630 may be flagged by flag 1 624.

[0162] Where the anomaly type classifier 608 classifies the report 602 as a persistent anomaly, the vessel track to which report 602 belongs is identified as a case of identity spoofing 632.

[0163] In the case of a vessel track with identity spoofing 632, vessel track separation 636 is performed on the vessel track to obtain separated vessel tracks. Vessel track separation 636 may be performed by the vessel track separator module 218 of Figure 2.

[0164] Separated vessel tracks 638 are flagged by flag2 640. While it may not be possible to establish the identity of the spoofing vessel, the vessel can be visualized differently because it was identified as spoofing.

[0165] When report 602 is classified at 604 as anomalous by high level classification module 604, the report 602 is also provided to a positional spoofing module 634 to detect positional spoofing. The positional spoofing module 634 may be the position spoofing detector module 226 of Figure 2.

[0166] To determine whether report 602 indicates positional spoofing, satellite TLEs 644 and terrestrial base station information (e.g., locations, specifications) 646 is used. The positional spoofing module 634 uses satellite TLEs 644 when the report 602 was received by a satellite (satellite-based) and uses the terrestrial base station information 646 when the report 602 was received by a terrestrial AIS base station.

[0167] Generally, the positional spoofing module 634 identifies when the reported vessel position in report 602 is not feasible in view of the field of regard of the satellite or the reception range of the base station.

[0168] Where position spoofing is detected, the report 602 is flagged by flag3650 to obtain flagged report 648.

[0169] The outcome of the AIS spoofing analysis of pipeline 600, whether clean 652, one-off anomaly 630, identity spoofing 638, or position spoofing 648, may be recorded and provided as input to a recognized maritime picture module 654. Therecognized maritime picture module 654 is a software component that provides a view of all maritime contacts at a particular place and time and is informed and supported by the output of the pipeline 600.

[0170] Once the pipeline 600 has been completed on the current position report 602, the pipeline 600 is repeated on the next-received position report (i.e., which becomes new position report 602). The just-processed position report becomes the previously received position report. This is denoted at 656 by the notation Ri-1 ← Ri (i.e., report 602 would be previous report 606 for the next-received position report).

[0171] Referring now to Figure 3, shown therein is a method 300 of detecting a self-reporting interruption in AIS data, according to an embodiment.

[0172] The method 300 may be implemented by the system of Figure 1 or the system of Figure 2. The method 300 may be implemented by the self-reporting interruption detection module 212 of Figure 2.

[0173] At 302, a user inputs a subscription area and a time limit. The subscription area and time limit may be received through user interface module 230. The subscription area may be defined by a polygon. The polygon may be drawn by the user through graphical user interface module 230 using input device 210 (e.g., through pointing and clicking). The time limit is a maximum time that can elapse before a vessel is considered to have turned off its AIS.

[0174] At 304, for each vessel in the subscription area from 302, the self-reporting detection module 214 checks whether there are any vessels with two temporally consecutive position reports that are spaced further apart in time than the time limit from 302. For example, if the vessel track 232 is within the subscription area, the module 214 determines whether vessel track 232 has two temporally consecutive position reports 234 (e.g., 234-1 and 234-2) that are spaced further apart in time than the time limit from 302 (using timestamp 234). Any such vessels are identified.

[0175] At 306, for each vessel in the subscription area from 302, the self-reporting interruption detection module 214 determines whether a time difference between a current time and the timestamp of the last received position report is greater than the timelimit from 302. Any such vessels are identified. For example, if the vessel track 232 is within the subscription area, the time difference between the current time and the timestamp 238 of positional report 234-1 is compared to the time limit from 302.

[0176] At 308, the self-reporting interruption detection module 214 flags any vessels identified from 304 or 306 as having a self-reporting interruption.

[0177] At 310, the flagged vessels from 308 are reported to the user in the graphical user interface using graphical user interface module 230 (e.g., using display device 210).

[0178] Referring now to Figure 4, shown therein is a method 400 of detecting anomalous AIS reports, according to an embodiment. The method 400 may be implemented by the system of Figure 1 or the system of Figure 2. The method 400 may be implemented by the report classifier module 214 of Figure 2.

[0179] While method 400 is shown as being performed on a position report Ri in a vessel track, the method 400 may be performed on all position reports R in a given vessel track. In some cases, the method 400 may be performed automatically on each position report R as it is received (i.e., on an ongoing basis or as part of a dynamic process). Note that method 400 refers to a vessel track that includes temporally consecutive position reports (Ri, Ri-i, Ri-2, Ri-n), which may correspond to position reports 234-1, 234-2, 234-3, 234-n of Figure 2.

[0180] At 402, the method 400 includes setting a maximum vessel speed. The maximum vessel speed may be user-defined and set through a user interface, such as GUI module 230.

[0181] At 404, the method 400 includes determining the distance between the location in position report Ri and the location in position report Ri-i.

[0182] At 406, the method 400 includes determining a time difference (e.g., UTC) between timestamps of the position report Ri and the temporally previous position report Ri-i.

[0183] At 408, the method 400 includes flagging the report Ri as anomalous if the product of multiplying the time difference from 406 by the maximum vessel speed from 402 is greater than the distance determined at 404.

[0184] Referring now to Figure 5, shown therein is a method 500 of identifying identity spoofing of AIS data, according to an embodiment. The method 500 may be implemented by the anomaly type classifier module 216 of Figure 2.

[0185] At 502, the method 500 includes setting a cumulative anomaly score threshold T. The Threshold T may be set by a user through a user interface, such as graphical user interface module 230.

[0186] At 504, the method 500 includes identifying a position report Ri and a sequence of N previous position reports in the same vessel track (Ri-i, Ri-2,..., Ri-n).

[0187] At 506, the method 500 includes determining whether Ri is anomalous to Ri-1 using the method 400 of Figure 4.

[0188] At 508, the method 500 includes assigning a binary value based on whether Ri is anomalous to Ri-i. For example, anomalous = 1 and non-anomalous = 0.

[0189] At 510, the method 500 includes repeating 506-508 for all other position reports in the sequence of previous position reports.

[0190] At 512, the method 500 includes calculating a cumulative anomaly score. The cumulative anomaly score is calculated by summary all the binary values determined at 308 and dividing the sum by the number of previous position reports N.

[0191] At 514, the method 500 includes comparing the cumulative anomaly score from 512 to the threshold Tfrom 502.

[0192] At 516, the method 500 includes flagging the position report Ri as a persistent anomaly if the cumulative anomaly score meets or exceeds the threshold T. In some cases, if the cumulative anomaly score does not meet the threshold, the report Ri is flagged as a non-persistent anomaly.

[0193] While the above description provides examples of one or more apparatus, methods, or systems, it will be appreciated that other apparatus, methods, or systems may be within the scope of the claims as interpreted by one of skill in the art.

Claims

Claims:

1. A computer-implemented method of detecting spoofing in automated identification system (“AIS”) data, the method comprising:storing, in a data storage device, a vessel track comprising a plurality of temporally ordered AIS position reports with the same vessel identifier;identifying, by a processor, an AIS position report in the vessel track for spoofing detection;executing, by the processor, an anomaly type classifier algorithm on the AIS position report to classify the AIS position report as a non-persistent anomaly or a persistent anomaly; andflagging, by the processor, the vessel track for spoofing when the output of the anomaly type classifier algorithm is a persistent anomaly.

2. The method of claim 1, wherein the anomaly type classifier algorithm classifies based on a comparison of the AIS position report to a sequence of temporally previous AIS position reports in the vessel track.

3. The method of claim 2, wherein executing the anomaly type classifier algorithm includes:computing, by the processor, a cumulative anomaly score for the AIS position report by comparing the AIS position report to the sequence of temporally previous position reports in the vessel track;comparing, by the processor, the cumulative anomaly score to the threshold cumulative anomaly score; andwhere the cumulative anomaly score meets the threshold cumulative anomaly score, flagging the vessel track for spoofing.

4. The method of claim 1, further comprising:classifying, using a report classifier algorithm executed by the processor, the AIS report as anomalous prior to executing the anomaly type classifier algorithm;wherein the report classifier algorithm is configured to classify a given AIS report as anomalous or clean.

5. The method of claim 4, wherein the report classifier algorithm classifies based on a comparison between locations and timestamps of the AIS report and an immediately temporally previous AIS position report in the vessel track.

6. The method of claim 5, wherein the report classifier algorithm determines whether the AIS position report is within a physically possible distance from the immediately temporally previous AIS position report based on a maximum speed.

7. The method of claim 6, wherein the maximum speed is a user-defined parameter set by a user through a graphical user interface.

8. The method of claim 1, further comprising:when the output of the anomaly type classifier algorithm is a persistent anomaly, separating, by the processor, the vessel track into two or more vessel tracks, wherein each of the two of more vessel tracks have different vessel identifiers, and storing the two or more vessel tracks in the data storage device.

9. The method of claim 8, further comprising assigning the AIS position report a new vessel identifier prior to separating the vessel track.

10. The method of claim 1, further comprising:storing, in the data storage device, a field or regard or a reception range of an AIS receiver that received the AIS position report;comparing, by the processor, a reported vessel position in the AIS report to the field of regard or the reception range of the AIS receiver; andflagging, by the processor, the AIS position report for spoofing when the reported vessel position is outside the field of regard or the reception range of the AIS receiver.

11. The method of claim 1, further comprising generating, by the processor, an alert in response to flagging the AIS position report for spoofing and reporting the alert in a graphical user interface.

12. The method of claim 1, further comprising, when the AIS position report is classified as a non-persistent anomaly:classifying, by the processor, the non-persistent anomaly into one of at least two classes of bit flip type anomalies.

13. The method of claim 12, wherein the at least two classes include MMSI bit flip, position bit flip, and timestamp bit flip.

14. The method of claim 13, further comprising:classifying, by the processor, the non-persistent anomaly as an MMSI bit flip;determining, by the processor, whether the AIS position report could belong to a different vessel stored in the data storage device within a certain confidence level; andassigning, by the processor, a new vessel identifier to the AIS position report corresponding to the different vessel track when the confidence level is met.

15. The method of claim 13, further comprising:classifying, by the processor, the non-persistent anomaly as a position bit flip; andrectifying, by the processor, the AIS position report by fixing or placing the AIS position report into correct latitude and longitude coordinates.

16. The method of claim 1, further comprising:receiving, by the processor, an area of interest (AOI) defined by a user through a graphical user interface; anddetermining that the vessel track is within the AOI.

17. The method of claim 1, further comprising:receiving, by the processor, a time limit defined by a user through a graphical user interface; andflagging, by the processor, the vessel track for a self-reporting interruption when:the vessel track has two AIS position reports spaced further in time than the time limit; orthe vessel track has a time difference between a last received AIS position report and a current time that is greater than the time limit.

18. The method of claim 1, wherein the vessel identifier is a maritime mobile service identity (“MMSI”) number.

19. A system for detecting spoofing in automated identification system (“AIS”) data, the system comprising:a data storage device that stores a vessel track comprising a plurality of temporally ordered AIS position reports with the same vessel identifier;a processor in communication with the data storage device, the processor configured to:identify an AIS position report in the vessel track for spoofing detection;execute an anomaly type classifier algorithm on the AIS position report to classify the AIS position report as a non-persistent anomaly or a persistent anomaly; andflag the vessel track for spoofing when the output of the anomaly type classifier algorithm is a persistent anomaly.

20. The system of claim 19, wherein the anomaly type classifier algorithm classifies based on a comparison of the AIS position report to a sequence of temporally previous AIS position reports in the vessel track.

21. The system of claim 19, wherein executing the anomaly type classifier algorithm includes:computing a cumulative anomaly score for the AIS position report by comparing the AIS position report to the sequence of temporally previous position reports in the vessel track;comparing the cumulative anomaly score to the threshold cumulative anomaly score; andwhere the cumulative anomaly score meets the threshold cumulative anomaly score, flagging the vessel track for spoofing.

22. The system of claim 19, wherein the processor is further configured to:classify, using a report classifier algorithm executed by the processor, the AIS report as anomalous prior to executing the anomaly type classifier algorithm;wherein the report classifier algorithm is configured to classify a given AIS report as anomalous or clean.

23. The system of claim 22, wherein the report classifier algorithm classifies based on a comparison between location and timestamp of the AIS report and an immediately temporally previous AIS position report in the vessel track.

24. The system of claim 23, wherein the report classifier algorithm determines whether the AIS position report is within a physically possible distance from the immediately temporally previous AIS position report based on a maximum speed.

25. The system of claim 24, wherein the maximum speed is a user-defined parameter set by a user through a graphical user interface.

26. The system of claim 19, wherein the processor is further configured to:when the output of the anomaly type classifier algorithm is a persistent anomaly, separate the vessel track into two or more vessel tracks, wherein each of the two of more vessel tracks have different vessel identifiers, and store the two or more vessel tracks in the data storage device.

27. The system of claim 19, wherein the processor is further configured to:store, in the data storage device, a field or regard or a reception range of an AIS receiver that received the AIS position report;compare a reported vessel position in the AIS report to the field of regard or the reception range of the AIS receiver; andflag the AIS position report for spoofing when the reported vessel position is outside the field of regard or the reception range of the AIS receiver.

28. The system of claim 19, wherein, when the AIS position report is classified as a non-persistent anomaly, the processor is further configured to:classify the non-persistent anomaly into one of at least two classes of bit flip type anomalies.

29. The system of claim 28, wherein the at least two classes include MMSI bit flip, position bit flip, and timestamp bit flip.

30. A computer-implemented method of detecting spoofing in automated identification system (“AIS”) data, the method comprising:storing, in a data storage device, a vessel track comprising a plurality of temporally ordered AIS position reports with the same vessel identifier;executing, with a processor, a first anomaly detection algorithm to classify an AIS position report in the vessel track as anomalous or non-anomalous;where the AIS position report is anomalous, executing, with the processor, a second anomaly detection algorithm to classify the AIS position report as a non- persistent anomaly or a persistent anomaly; andwhere the AIS position report is classified as a persistent anomaly, flagging the vessel track for spoofing.

31. A system for detecting spoofing in automated identification system (“AIS”) data, the system comprising:a data storage device storing a vessel track comprising a plurality of temporally ordered AIS position reports with the same vessel identifier;one or more processors in communication with the data storage device, the one or more processors configured to:execute a first anomaly detection algorithm to classify an AIS position report in the vessel track as anomalous or non-anomalous;where the AIS position report is anomalous, execute a second anomaly detection algorithm to classify the AIS position report as a non-persistent anomaly or a persistent anomaly; andwhere the AIS position report is classified as a persistent anomaly, flag the vessel track for identity spoofing.

32. A computer-implemented method of detecting spoofing in automated identification system (“AIS”) data, the method comprising:storing, in a data storage device, a vessel track comprising a plurality of temporally ordered AIS position reports with the same vessel identifier and a threshold cumulative anomaly score;identifying, via a processor, an AIS position report in the vessel track for spoofing detection;computing, by the processor, a cumulative anomaly score for the AIS position report by comparing the AIS position report to a sequence of temporally previous position reports in the vessel track;comparing, by the processor, the cumulative anomaly score to the threshold cumulative anomaly score; andflagging, by the processor, the vessel track for spoofing where the cumulative anomaly score meets the threshold cumulative anomaly score.

33. The method of claim 32, further comprising, where the cumulative anomaly score does not meet the cumulative anomaly score threshold, flagging the AIS position report as a non-persistent anomaly.

34. The method of claim 33, further comprising classifying, by the processor, the non- persistent anomaly into one of at least two classes of bit flip type anomalies.

35. The method of claim 34, wherein the at least two classes include MMSI bit flip, position bit flip, and timestamp bit flip.

36. A system for detecting spoofing in automated identification system (“AIS”) data, the system comprising:a data storage device that stores a vessel track comprising a plurality of temporally ordered AIS position reports with the same vessel identifier and a threshold cumulative anomaly score;a processor in communication with the data storage device, the processor configured to:identify an AIS position report in the vessel track for spoofing detection;compute a cumulative anomaly score for the AIS position report by comparing the AIS position report to a sequence of temporally previous position reports in the vessel track;compare the cumulative anomaly score to the threshold cumulative anomaly score;where the cumulative anomaly score meets the threshold cumulative anomaly score, flag the vessel track for spoofing.

Images