IEEE - Aerospace and Electronic Systems - October 2023 - 13

Soldi et al.
as the detection ofillegal diving and other anomalous activities
[56], and the modeling of maritime piracy situations
[57] and anomalous behaviors [58], i.e., deviation
from nominal route, unexpected AIS activities, unexpected
port arrival, close approach, and zone entry.
Current research on maritime anomaly detection considers
the aforementioned types of anomalies. The deviation
from a standard route is the most prominent anomaly
type that research addresses by extracting frequently traveled
sea routes from historical AIS data, e.g., via clustering.
Unknown AIS tracks can then be compared in order to
investigate whether they are similar enough to the extracted
routes, or in the case of clustering, belong to one of the
identified route clusters. These approaches work very well
in areas where many ships take similar routes [59], [60],
[61]. A different approach [32], [62] faces the same anomaly
within a stochastic framework by combining the available
context data with a parametric model of the vessel's
kinematic behavior and running a hypothesis testing procedure
to make decisions on the existence ofanomalous deviations
relying upon the available measurements (e.g., AIS,
radar, SAR). This statistical framework for anomaly detection
has also been applied in the context of real major
events, such as the grounding of the container vessel Ever
Given in the Suez Canal on 23 March 2021 [62]. Further
stochastic strategies address the joint problem ofsequential
anomaly detection and tracking of a target subject to
switching anomalous deviations in a Bayesian framework
[63], [64], [65]. Other approaches particularly consider
deviations from standard routes in the presence of
unexpected AIS activity. Indeed, AIS tracks of ships are
often characterized by large blind spots, and this may be
due to unintentional technical problems, radio interference,
attenuation, or actual equipment manipulation, such as
intentionally turning off AIS transceivers [32], [66], [67].
Moreover, AIS signals can be easily spoofed by external
attackers or the crew itself willing to obscure their locations
[33], [68]. The AIS intentional interruption or spoofing
could indicate a will to hide some illegal activities,
such as smuggling on coast or with other ships, or entry in
unauthorized areas. Zone entry as an anomaly type is considered
only marginally [53], [69]. Restricted zones with
entry ban are learned implicitly as part of the general shipping
routes and trajectories [69], whereas more elaborate
methods, such as predicting whether a zone entry is likely
to occur soon are proposed in [53]. Anomalous port arrival
is taken into account in [70] looking at ferries that run regular
routes according to a fixed schedule, while close
approach anomalies are investigated in [53], [71], [72].
REASONING FOR SITUATION AWARENESS
Besides the data-driven approaches described earlier, there
exist situations where higher level reasoning needs to be
OCTOBER 2023
considered. This can be useful for aligning highly heterogeneous
information sources, which range from HUMINT
and OSINT descriptions of the vessels' current and projected
behavior, through contextual information to MTT
tracks and anomaly reports. This is in line with the activitybased
intelligence [73], [74] paradigm that has been in use
since the war in Afghanistan and has brought a new vision
of intelligence pushing forward the development of multiintelligence
(multi-INT) capabilities, which aim at considering
in an exhaustive way all sources of information. In
order to make sense of this kind of data, each source needs
to be corrected to account for its reliability and possibly
contextual information. In cases where different sources
provide reports on the same target property, these reports
can be aligned in accordance to an appropriate correction
model; if the reports refer to different properties, instead,
they are used as inputs to a reasoning system that verifies
their consistency. For example, consider source A that
reports a particular vessel as a tanker, and a source B that
reports it to be a cargo vessel. Given that the reports are
concerned with the same property with different degrees of
semantic granularity, this information can be readily
aligned. On the other hand, a source may report on the vessel
type, and the other on its speed. In this case, the properties
can be aligned using a reasoning system verifying the
consistency of the speed given the vessel type. This can
highlight conflict between the sources, which can further
lead to conclusions about spoofing or another anomaly,
depending on the exact scenario.
Tackling hybrid threats is particularly challenging as it is
necessary to predict an event, which, above all, is rare and
can be essentially considered a black-swan event. As such, it
is unlikely to provide an analysis based on data and machine
learning only; in these cases it is possible to leverage expert
information using rule-based systems. One such approach,
which allows a degree of semicausal reasoning, involves
using valuation-based systems with the Dempster-Shafer
theory [75] (also known as the theory of belief functions).
Such systems are also known as evidential networks. The
information provided by the myriad of sources described
earlier is corrected and aligned with a common vocabulary
using a mechanism, such as contextual beliefcorrection [76],
behavior-based correction [77], or its context-aware extension
[10]. A set of rules elicited from the experts is used to
construct a valuation network, which is defined by a set of
variables (some of which may be directly mapped to the
observations provided by the sources whereas the others are
inferred) and the relations between them [78].
Possible uses of such rule-based approaches range from
trivial to significantly more complex ones. A trivial illustration
could be reasoning about a vessel's inconsistent AIS status.
For example, a trajectory classifier can be considered
one source, and the vessel's AIS navigational status the
other. If the navigational status is inconsistent with the type
of trajectory provided by the classifier, the AIS information
IEEE A&E SYSTEMS MAGAZINE
13
IEEE - Aerospace and Electronic Systems - October 2023

Table of Contents for the Digital Edition of IEEE - Aerospace and Electronic Systems - October 2023
