2.1.1. Statistical approaches for anomalous vessel behaviour detection

The main concept of any statistical anomaly detection method is: “An anomaly is an observation which is suspected of being partially or wholly irrelevant because it is not generated by the stochastic model assumed” (Anscombe and Guttman, Reference Anscombe and Guttman1960).

Statistical anomaly detection techniques are based on the assumption that normal data instances occur in high probability regions of a stochastic model, while anomalies occur in the low probability regions of the stochastic model (Chandola et al., Reference Chandola, Banerjee and Kumar2009).

Statistical approaches to anomalous vessel behaviour detection fit a statistical model representing normal vessel behaviour to the given historical vessel movement data and then apply a statistical inference test to determine whether a new vessel observation belongs to this model or not. Observations that have a low probability of being generated from the learned model, based on the applied test statistic, are declared as anomalous behaviours. The given historical vessel movement data are assumed to be Independent and Identically Distributed (IID) observations, and reflect vessel normal behaviour.

Some recent research works have adopted statistical approaches to address automatic maritime vessel anomalous behaviour detection. These research works are summarised below.

Anneken et al. (Reference Anneken, Fischer and Beyerer2015) have used a non-simulative anomalies dataset based on real data, to provide an evaluation and comparison of maritime anomaly detection algorithms, specifically the Gaussian Mixture Model (GMM) and the Kernel Density Estimator (KDE). According to the result of their experiment, the rate of false alarm as well as the rate of anomalies which are not found is high for both algorithms.

Kowalska and Peel (Reference Kowalska and Peel2012) combined Gaussian Processes and an Active Learning approach to deal with anomalous vessel behaviour detection. In their approach, a model of normal vessel behaviour is created from historical AIS data using Gaussian Processes (GPs), and to deal with the high computational complexity in training, the authors used the Active Learning approach.

Smith et al. (Reference Smith, Reece, Roberts and Rezek2012; Reference Smith, Reece, Roberts, Psorakis and Rezek2014a) have introduced an abnormality detection technique using a combination of Gaussian Processes, extreme value theory and divergence measurement, to identify anomalous vessel behaviour in both streaming and batch data.

Mascaro et al. (Reference Mascaro, Nicholso and Korb2014) have addressed the anomalous vessel behaviour detection issue using Bayesian Networks. By training Bayesian Networks with real world AIS data combined with additional real world contextual information such as weather and time, as well as vessel interactions, they have taught two Bayesian Network-based models at two different time scales, namely in the form of the time series and track summary models. As a training tool, the authors used a machine learner named CaMML (Causal discovery via Minimum Message Length). The authors have found that adding further real world attributes helped to create a better model of normalcy.

To preserve port safety by classifying the movements of different ships in the scene, Castaldo et al. (Reference Castaldo, Palmieri, Regazzoni, Bassis, Esposito and Morabito2015) have applied Bayesian Networks to the analysis of vessel behaviour and ship-to-ship interactions in port areas.

2.1.2. Machine learning and data mining approaches to anomalous vessel behaviour detection

The main concept of the use of machine learning or data mining approaches for automatic anomalous maritime vessel behaviour detection is to create a model of normal vessel behaviour by applying machine learning or data mining techniques (such as unsupervised or supervised clustering algorithms) to vessel movement data. This normal model is used to detect anomalous vessels, which are vessels that deviate from the learned normal model.

Depending on the format of input data, machine learning and data mining approaches for anomalous vessel behaviour detection can be divided into two main classes, namely point-based anomalous behaviour detection approaches and trajectory-based anomalous behaviour detection approaches. Point-based anomalous behaviour detection approaches highlight individual anomalous points while trajectory-based anomalous behaviour detection approaches, receive as their input entire vessel trajectories and automatically classify them as anomalous or not (Pallotta and Jousselme, Reference Pallotta and Jousselme2015).

In the following we present some machine learning and data mining approaches that have been recently proposed for automatic anomalous maritime vessel behaviour detection. These approaches are summarised in Table 1.

Table 1.

Summary of machine learning and data mining approaches to anomalous vessel behaviour detection.

Vessel location is composed of longitude and latitude; Used attributes of vessel motion data refers to the vessel attributes that are used as the parameters for determining vessels' moving pattern and anomalous behaviour detection; Approach type refers to the input format of the data used in the approach; Point-based approach considers individual vessel observations as input data; Trajectory-based approach considers the entire vessel trajectory as input data; Recorded AIS data refers to historical vessel motion data provided by the Automatic Identification System.

Wang et al. (Reference Wang, Liu, Liu, De Souza and Matwin2014) have performed vessel route anomaly detection using Density-Based Spatial Clustering of Applications with Noise considering Speed and Direction (DBSCANSD) (Liu et al., Reference Liu, De Souza, Matwin and Sydow2014) and parallel meta-learning algorithms on the Hadoop MapReduce environment cluster. According to their experiment, the authors have mentioned that the vessel route anomaly detector accuracy and execution time improves linearly with the number of nodes in the cluster.

Pallotta et al. (Pallotta et al. Reference Pallotta, Vespe and Bryan2013a; Pallotta et al. Reference Pallotta, Vespe and Bryan2013b) proposed an approach based on an incremental variant of the Density-Based Spatial Clustering of Applications with Noise (DBSCAN) algorithm (Ester et al. Reference Ester, Kriegel, Sander and Xu1996) to learn maritime traffic routes from vessel AIS data to detect anomalous vessel behaviours and predict vessels' future positions. The proposed approach is called Traffic Route Extraction for Anomaly Detection (TREAD). The same TREAD approach was used in Pallotta and Jousselme (Reference Pallotta and Jousselme2015) to perform track association to vessel traffic routes for hierarchical maritime anomaly detection. In their approach, a tool implementing the TREAD approach is first used to extract vessel traffic routes from historical AIS data of areas of interest.

Secondly for associating and classifying tracks (i.e., partial trajectories), the same authors have adopted a hierarchical reasoning, where new tracks are first associated to existing routes based on their positional information only, and “off-route” vessels are detected as vessels not following an existing route. Then, for on-route vessels (vessels following an existing route) further anomalies are detected such as speed anomaly and heading anomaly.

To provide a more complete and interactive Maritime Situational Picture (MSP) to operational authorities and policy-makers to support the decision-making process, Arguedas et al. (Reference Arguedas, Mazzarella and Vespe2015) have proposed a spatio-temporal data mining framework based on the TREAD approach for route-based anomalous vessel detection. In the proposed framework, the authors used the TREAD approach to build a synthetic representation of all maritime traffic routes; afterward they perform maritime traffic anomaly detection.

Lei (Reference Lei2015) proposed a framework for maritime trajectory modelling and anomaly detection. First, the author defines three outlying features of abnormal movement behaviours: spatial, sequential, and behavioural features extracted from the sequential occurrence in trajectory data collection, and then builds a maritime trajectory model for anomaly detection. Finally, the author develops an anomaly detection algorithm based on the learned trajectory model, in which an indicator is used to evaluate suspicious behaviour and scores trajectory behaviour according to the defined outlying features.

One of the issues in anomalous vessel behaviour detection is the high rate of false positive anomalies. Some research works have been focused on addressing this issue in anomalous vessel behaviour detection.

To reduce the rate of false alarm in anomalous maritime vessel behaviour detection, Radon et al. (Reference Radon, Wang, Glässer, Wehn and Westwell-Roper2015) have proposed an approach in two phases. In the first phase, the normal vessel movement patterns are extracted from historical vessel tracks (trajectories within a particular origin and destination) using trajectory partition, the DBSCAN and line segment clustering algorithms. In the second phase potential anomalies are detected and then real anomalies are filtered out from potential anomalies based on contextual verification. In the same line of false alarm rate reduction, Laxhammar and Falkman (Reference Laxhammar and Falkman2011; Reference Laxhammar, Falkman, Iliadis, Maglogiannis, Papadopoulos, Karatzas and Sioutas2012; Reference Laxhammar and Falkman2015) and Smith et al. (Reference Smith, Nouretdinov, Craddock, Offer, Gammerman, Iliadis, Maglogiannis, Papadopoulos, Sioutas and Makris2014b; Reference Smith, Nouretdinov, Craddock, Offer, Gammerman, Gammer man, Vovk and Papadopoulos2015) have used an anomalous vessel behaviour detection approach based on conformal predictors (Vovk et al., Reference Vovk, Gammerman and Shafer2005) known as conformal anomaly detection. The conformal anomaly detection approach assumes that all the training data are generated by the same probability distribution and makes no further assumptions about the distribution. For each new test data, the likelihood that it is coming from the same probability distribution as the training data is estimated. If this likelihood is below the specified confidence level, then the new object is declared as an anomaly. The advantage of the conformal anomaly detection approach is that the rate of false alarm is well-calibrated and it is at most equal to the specified confidence level.

Based on the result of their preview work presented in Liu et al. (Reference Liu, De Souza, Matwin and Sydow2014; Reference Liu, De Souza, Hilliard and Matwin2015) have proposed a clustering-based anomaly detection model for vessel movement data. In their approach, the authors have proposed three distance measures which are the core of the anomaly detection algorithm. The three distance measures are, Absolute Division Distance (ADD), Relative Division Distance (RDD) and Cosine Division Distance (CDD). ADD is used in the stopping points abnormality detection phase while RDD and CDD are used for the moving part. To evaluate the effectiveness of the proposed model, the authors have used a highly imbalanced data set from the Juan de Fuca Strait area.

2.1.3. Other data-driven approaches to anomalous vessel behaviour detection

Apart from statistical, machine learning, data mining, and visual analytics approaches, recently other approaches related to anomalous vessel behaviour detection have been proposed, and some of them are presented in what follows and are summarised in Table 2.

Table 2.

Summary of other data-driven approaches to anomalous vessel behaviour detection.

Vessel location is composed of longitude and latitude; Used attributes of vessel motion data refers to the vessel attributes that are used as the parameters for determining vessels moving pattern and anomalous behaviour detection; Recorded AIS data refers to historical vessel motion data provided by Automatic Identification System.

Osekowska et al. (Reference Osekowska, Johnson and Carlsson2014; Reference Osekowska, Johnson, Carlsson, Corman, Voß and Negenborn2015) used an approach based on potential fields to perform vessel anomalous behaviour detection. In their approach, every vessel generates potential charges, the value of which represents the vessel's behaviour, and drops the charges at locations it passes. Each AIS report is used to assign a potential charge at the reported vessel positions. A model of normal vessel behaviour (traffic patterns) is represented by the collection of potential fields created based on the recorded vessel motion data and behaviour history. Vessels whose current potential deviates from the local potential fields are flagged as anomalous vessels.

Soleimani et al. (Reference Soleimani, De Souza, Hilliard and Matwin2015) have proposed a new method for finding anomalies in ships' movements. The proposed method analyses the trajectory of ships from a geometrical perspective. The trajectory of the ship is compared with a near-optimal path that is generated by a graph search algorithm. To make this comparison the proposed method extracts some scale-invariant features from the real trajectory and from the optimal movement pattern, and then it compares the two sets of features to generate an abnormality score.

Venskus et al. (Reference Venskus, Kurmis, Andziulis and Lukošius2015) proposed an adaptive self-learning algorithm based on a bio-inspired virtual pheromone method for the detection of anomalous maritime traffic. The proposed algorithm first learns normal vessel traffic pattern grids from vessel movement data provided by the surveillance data fusion subsystem, then detects a potential incident where the moving vessel path does not match with learned pattern grids. The authors have verified that the algorithm provides rapid self-learning and fast adaptation characteristics.

2.1.4. Knowledge-based approaches to anomalous vessel behaviour detection

Knowledge-based anomalous vessel behaviour detection approaches refer to the generation of alerts based on a set of rules (Roy, Reference Roy2008), such as maximum speed allowed in a port, presence in areas restricted to navigation or inconsistencies between the ship's claimed and actual activity. These approaches are composed of two phases. The first phase consists of creating and specifying predefined patterns that one wants to detect using rules. These rules can be predicates or any type of logic. In the second phase the new data are matched to the predefined rules to detect predefined anomalies of interest, which are those data that deviate from the predefined rules.

Although most of the recent works on anomalous vessel detection are data-driven, some knowledge-based approaches have been proposed.

Maggi et al. (Reference Maggi, Mooij, van der Aalst, Van de Laar, Tretmans and Borth2013) have demonstrated the use of process mining for analysing the behaviour of vessels, and for detecting anomalies, i.e., deviations from the normal behaviour. To model the behaviour of vessels, the authors have used the Declare language which is a constraint-based language that can specify complex behaviour in terms of a couple of restrictions. Declare combines a formal semantics for analysis purposes with a graphical representation for users.

Brax et al. (Reference Brax, Andonoff, Gleizes and Jezic2012) have presented a Multi-Agent System (MAS) dedicated to anomalous behaviour detection and alerts triggering in the maritime surveillance area. Anomalies are detected based on the implementation of maritime regulation.

Vandecasteele et al. (Reference Vandecasteele, Devillers and Napoli2013) have proposed a semi-supervised learning framework based on spatio-temporal semantic events for maritime anomaly detection and behaviour analysis. For maritime anomaly detection, the authors have used spatial ontology for modelling a maritime operator's knowledge.

2.1.5. Hybrid Approaches to anomalous vessel behaviour detection

The hybrid approach combines the data-driven and knowledge-based approaches to perform anomalous maritime vessel behaviour detection. Recently, only limited effort has been devoted to the use of hybrid approaches for anomalous maritime vessel behaviour detection. Shahir et al. (Reference Shahir, Glasser, Nalbandyan and Wehn2014; Reference Shahir, Glasser, Shahir and Wehn2015) combined data-driven machine learning methods with maritime background domain knowledge to detect anomalous vessel interaction patterns. In Kazemi et al. (Reference Kazemi, Abghari, Lavesson, Johnson and Ryman2013) a hybrid framework for anomaly detection based on the use of open data (contextual information and background knowledge) is proposed. Based on the proposed anomaly detection framework and the algorithms implementing the expert rules, the Open Data Anomaly Detection System (ODADS) was developed.