Improving Maritime Security via Automatic Navigational Monitoring

Introduction

Water covers approximately 70 per cent of the earth’s surface. Seas and oceans contain a lot of natural resources for people to harvest. Each year, roughly 30–40 per cent of the world’s total natural oil and gas are harvested offshore. A large quantity of various types of minerals are also harvested from seas and oceans. Additionally, these areas provide a huge portion of food for the world’s population. Another important use of the maritime area is for transportation; it is estimated to account for roughly 90 per cent of international trade (UNCTAD, 2020).

South-East Asia has a substantial maritime area. This maritime area is very important for people in this region, providing countries with many benefits and resources. Here, some of the figures and aspects of maritime areas in South-East Asia will be discussed. In 2014, there were approximately 42 million megatons of fisheries, and this keeps increasing every year (SEAFDEC, 2014). The maritime area is one of the main sources of food production for people in this area. Fishery production in this region accounts for 11 per cent of world production (SEAFDEC, 2014). Oil and gas production in South-East Asia is continuously increasing (US Energy Media, 2019), with most coming from offshore facilities. It can be seen that this maritime area still holds a reasonably high amount of energy resources, which people in the region heavily rely on.

Using maritime areas is the most cost-effective means of global trade transportation. Ships normally carry larger quantities than other means of transport. Consequently, 90 per cent of trade transportation companies rely greatly on maritime trade routes (OECD, 2021). Around one-third of all maritime trade vessels pass through the South-East Asia region. This region is situated in the middle of Europe, Africa, South-Asia and East Asia, which consist of more than half of the world’s population. Therefore, it is crucial to maintain safety and security for all the maritime areas in South-East Asia.

Given the vast benefits and resources provided by maritime areas, many people try to find loopholes and conduct illegal activities to unlawfully exploit further benefits. There is increasing concern in maritime security worldwide about many types of illegal activities, such as terrorism, hijacking, drug smuggling and human trafficking, as well as illegal, unreported and unregulated fishing (IUU). Since maritime areas are vast and consist of many sea and ocean areas, it becomes almost impossible for authorities to monitor all suspicious activities. Accordingly, much research has been conducted and many developments have been made to improve maritime safety and security. However, there are still persistent risks in many aspects. Here are some of the ongoing concerns in South-East Asia.

IUU is ongoing in South-East Asia. Overharvesting and illegal fishing can drive many types of marine species to extinction and could be a significant problem for food supply in the future. It also damages the environment and ecosystem. Therefore, there has been a significant push to regulate fishing to sustain these marine resources. In January 2019, Poseidon Aquatic Resource Management and the Global Initiative Against Transnational Organised Crime published the IUU Fishing Index (ASEAN Information Center, 2019).

This article demonstrates the use of a time series model to filter suspicious behaviours of vessels via the automatic identification system (AIS) data. This work is based on Patmanidis et al. (2016), which used an autoregression moving average (ARMA) model to predict the navigational trajectory of vessels. The present article improves the prediction by using the autoregression integrated moving average (ARIMA) model. Both ARMA and ARIMA models can be used to predict vessels’ future positions and conditions based on past data combined with errors of past forecasts. We show that within the context of navigational trajectories of ships, the ARIMA model provides an accurate predicted value, which is then compared with the actual value from the dataset. If the values do not match, the behaviour of the ship is suspicious and a warning is triggered based on a preset criteria, which are initially decided by the user. Such criteria can be shaped or trained ‘on the fly’ to produce more accurate decisions as more similar cases are detected. This study illustrates an alternative method for maritime monitoring and warning that is fast and easy to implement.

The automatic identification system (AIS)

To monitor all activities in the maritime domain, new technologies have been introduced, one of which is AIS. AIS data can be continually collected from various kinds of transceivers from vessels, as well as ground stations, airborne stations and satellites.

In 2022, the International Convention for the Safety of Life at Sea included a mandate to install AIS on most vessels that weigh over 300 gross tons (International Maritime Organization, 2014). The mandate also includes all passenger and fishing vessels over 45 metres. The idea is to use AIS signals for many purposes, such as collision avoidance, aid of navigation, maritime security, search and rescue, accident investigation, fleet and cargo tracking, fishing fleet monitoring and control, ocean currents estimation, statistics and economics, infrastructure protection and more.

The AIS system uses a transceiver to automatically broadcast data every 2–10 seconds, depending on vessel type. The data is broadcast via a carrier radio wave operating at a very high frequency (VHF) band. Normally, the radius covered is approximately 20 nautical miles for ship-to-ship communications and approximately 40 nautical miles for ship-to-shore communications. However, this VHF signal can also be received by unmanned aerial vehicles, aircraft and satellites at great distances (Eriksen et al., 2006; Høye et al., 2008).

AIS data contain information about the host vessel, such as maritime mobile service identity (MMSI), position, speed, rate of turn, course, true heading, type and other parameters. The information is retrieved from the vessel’s navigational sensors—typically its global navigation satellite system receiver and gyrocompass.

Figure 1 shows over 280,000 AIS data points accumulated over 20 hours on 20 August 2020. The number of data points received daily is often larger. This large number of data points makes it almost impossible to properly monitor all the activities in this area. Therefore, some processes or algorithms are needed to handle this large dataset and effectively monitor the maritime areas.

Figure 1.AIS data points on 20 August 2020 (Spire Maritime, 2021).

Detecting suspicious behaviours from AIS signals

Several techniques and algorithms have been proposed to filter suspicious vessels. Once identified, authorities conduct a further investigation. The Bayesian network (Johansson & Falkman, 2007; Mascaro et al., 2010) is a method that uses a probabilistic graphical model for representing knowledge and uncertainty. Each node represents a random variable, whereas the edges correspond to the conditional probability for the corresponding random variables. To predict the behaviour of vessel movements, the method requires a large number of nodes and edges. As a result, the system is sophisticated and impractical for real-time maritime monitoring.

In recent years, there has been a push to use big data analytics in combination with artificial intelligence (AI) decision-making for maritime monitoring, which involves machine and deep learning methods (Dinariyana et al., 2019; Rhodes et al., 2007). These methods require a large dataset to train the AI to predict future behaviour. Since the majority of the dataset represents normal behaviour, these methods could effectively differentiate anomalies from abnormal behaviours. However, to effectively identify the specific type of anomaly, a reasonably large amount of data of each suspicious type is required for training the AI. Specifying the type of anomaly is necessary for operators to respond accordingly. However, we often do not have sufficient data that represents abnormal behaviours. Moreover, when adjusting and changing model criteria for different purposes and different regions of the oceans, the network has to be partially retrained, depending on the changing conditions, to fine-tune the network weights and parameters.

Although machine and deep learning methods can detect suspicious behaviour, a simpler and easy-to-implement model is also preferred. As a result, the use of the time series model is explored in the present study. The time series model is a mathematical algorithm that uses past data points to forecast future data. Time series models are widely used to predict future events and are commonly applied to forecast economic and business trends. These models require fewer data points as they start to predict using only 5–10 historical data points. Moreover, it is simple to add or adjust warning criteria manually. Another advantage is that time series models require little computational resources, which may be suitable for small systems. In this research, we focus on using this algorithm due to its robustness, ease of use and ability to provide warning of abnormal behaviours.

Patmanidis et al. (2016) used the ARMA model to analyse AIS navigational information and detect suspicious behaviours of vessels. AIS data contains timestamps, among others, and is a suitable format for time series model prediction. The ARMA consists of two terms:

(1) AR or autoregression term, M_t, which predicts future data from previous data, $X_{t - i}$, given by:

$$M_{t} = c + \sum_{i = 1}^{p}{\varphi_{i}X_{t - i} + \varepsilon_{t}}\tag{1}$$

(2) MA or moving average term, E_t, which relates to the error, $\varepsilon_{t}$, at time t from the forecasts of previous data as linear combination given by:

$$E_{t} = \mu + \sum_{i = 1}^{q}{\theta_{i}\varepsilon_{t - i} + \varepsilon_{t}}\tag{2}$$

where $\varphi_{i}$ and $\theta_{i}$ are coefficients; $c$ and $\mu$ are constants; and p and q are the number of previous data analysed. However, the values of p and q do not necessarily have to be the same.

To predict the future position, X_t, the two equations are combined to form a single equation:

$$X_{t} = C + \sum_{i = 1}^{p}{\varphi_{i}X_{t - i}} + \sum_{i = 1}^{q}{\theta_{i}\varepsilon_{t - i}} + \varepsilon_{t}\tag{3}$$

The ARMA model can be used to predict the future position and status of vessels. The predicted value and the next data from the AIS signal are compared to identify possible suspicious behaviours. In practice, if there are some suspicious behaviours detected by the algorithm, further investigation can be conducted by the relevant authorities.

Method

In this research, we use the ARIMA model (Box et al., 2015) to analyse AIS navigational information and detect suspicious behaviours of vessels. The ARIMA model includes an integrated term to estimate the change between each step of data. Since vessels can travel in any direction, the integrated term can be used to eliminate the non-stationary behaviour of the vessels, which results in better convergence of identifying coefficients. The equation is similar to ARMA, but in this case, we perform autoregression of the differences between each data point,${(X}_{t - i} - X_{t - i - 1})$, instead of the data points themselves, $X_{t - i}$. The ARIMA model equation is as follows:

$$\begin{aligned} {\mathrm{\Delta}X}_{t} &= C + \sum_{i = 1}^{p}{\varphi_{i}{(X}_{t - i} - X_{t - i - 1})}\\ & \quad + \sum_{i = 1}^{q}{\theta_{i}\varepsilon_{t - i}} + \varepsilon_{t} \end{aligned}\tag{4}$$

Noting that the parameters used in this equation are the same as those in equations (1)–(3).

Criteria for determining suspicious behaviours

The criteria for triggering a warning when vessels commit suspicious behaviours is dependent on the AIS information obtained from the ships (Patmanidis et al., 2016). Since the ARIMA model uses less data than most machine and deep learning methods, it is very amenable to adjusting the criteria for different purposes and different conditions in the future. AIS information includes a vessel’s details, such as the type of vessel and nationality, which can be used to verify other statuses and trigger a warning when a vessel is in a situation it should not be in. The AIS information also includes a vessel’s velocity and location, which builds up to a time series dataset and is used to find the coefficient of the ARIMA model for predicting a vessel’s future status and location. This information is compared with the next available AIS data to see whether there are some sudden changes or jumps in a vessel’s behaviour. Using this information, suspicious behaviours can be identified using the following criteria:

• Missing AIS data for certain periods. If the ARIMA model forecasts the location of vessels but could not obtain new actual AIS data for comparison for a period of time, this could indicate that the vessels have turned off their AIS transmitters. This can imply cases when some suspicious activities are being conducted and could trigger a warning.

• Trajectory changes. If the actual AIS data point shows that a vessel diverges from the predicted location, this could indicate potentially suspicious behaviour since vessels normally travel in a consistent manner and the change of their speed and direction is slow. A large difference between the predicted and actual data points could also indicate AIS spoofing. Drastic change in trajectory can also refer to emergency situations like piracy or accidents. As such, any change in trajectory could trigger a warning.

While we can define more criteria depending on the user requirements, these two criteria were considered initially as proof of principle. When historical data indicate some risky areas for certain suspicious behaviour, the warning criteria can be changed accordingly. For example, historical data indicate areas where vessels normally conduct illegal fishing. We can use this background knowledge to trigger a warning when some vessels travel close to or in those areas and when vessels turn off their AIS transmitter.

Workflow of ARIMA model prediction

The workflow starts by gathering the AIS data from a vessel’s transceiver and reconstructing the data in a time series with constant step size between each data point (see Figure 2). The initial set of data in the time series dataset is then used to find the coefficients ($\varphi_{i}$ and $\theta_{i}$) of the polynomial term in the ARIMA model (Eq. 4). Once the coefficients are identified, we use the ARIMA model (Eq. 4) to predict the future location (X_t+1 = X_t +∆X_t) and compare with the actual AIS data from the vessel. The comparison will be assessed with the preset criteria for the model to decide whether to trigger a warning. If a warning is triggered, further investigation or action is required by maritime authorities.

Figure 2.The algorithm workflow for predicting navigational trajectory.

Applying the technique using actual AIS data

To demonstrate the idea, actual AIS data was downloaded from the Spire Maritime security website (Spire Maritime, 2021). This company provides many services and solutions in data analysis, such as maritime security, weather, aviation, space and S observation. The time series data was reconstructed using the polynomial interpolation method to create consistent time steps between each data point.

We initially used p=q=10 historical data points to calculate all coefficients and constants of the ARIMA model in equation (4). If the accuracy of the ARIMA model is less than 90 per cent, then the number of historical data points is increased up to p=q=20. The calculation and plotting of trajectory plots were done using MATLAB. The result of the preliminary analysis and investigation are discussed in the next section.

The first example in this investigation is the AIS data from the vessel with an MMSI of 567445000. The vessel travelled on 20 August 2020 between 06:45 and 23:55. The vessel sailed under a Thai flag and travelled from Singapore to the North-East. The average speed was 2.86 knots, and there was a total of 191 data points during this period of time. The trajectory of this vessel is shown in Figure 3 (Left).

Figure 3.(Left) Trajectory of the vessel (MMSI: 567445000) on 20 August 2020. (Right) A zoomed-in image of the vessel’s (MMSI: 567445000) trajectory on 20 August 2020 (Yellow dot = actual location from AIS data, Green dot = predicted location from the ARIMA model).

Figure 3 (Right) shows the zoom-in trajectory of this vessel, with the vessel’s locations from both the AIS data (i.e., actual position; yellow dots) and forecasting data of the ARIMA model (i.e., predicted position; green dots) plotted together. In this analysis, we found that the coefficients and constants of the ARIMA model can be obtained easily from the AIS data with reasonable accuracy. The forecasted locations closely align with the actual locations/AIS data for the whole trajectory, with only slight difference. For this vessel, there was no suspicious behaviour detected.

Next, we use an example of a case where the algorithm was able to detect abnormal behaviour. In this case, the vessel’s MMSI is 567065500, and it sailed under a Thai flag. The vessel travelled from Singapore to the East with an average speed of 5.63 knots on 20 August 2020, between 00:00 (midnight) and 23:46. During this time period, there was a total of 120 AIS data points. The trajectory is shown in Figure 4 (Left), while Figure 4 (Right) shows a zoomed-in image of the trajectory with the vessel’s locations from both the AIS data (i.e., actual position; yellow dots) and forecasting data of the ARIMA model (i.e., predicted position; green dots) plotted together. In this case, the algorithm found it suspicious and triggered an alarm when the vessel (MMSI: 567065500) made a sharp left turn around 03:31 on 20 August 2020. Another suspicious behaviour was detected by the algorithm when the vessel made a reverse turnaround at 12:10 on the same day. These two events were considered unusual since the initial AIS data predicted that this vessel should have continued travelling in a straight line (shown by a blue dotted line in Figure 4 [Right]).

Figure 4.(Left) Trajectory of the vessel (MMSI: 567065500) on 20 August 2020. (Right) A zoomed-in image of the vessel’s (MMSI: 567065500) trajectory on 20 August 2020 (Yellow dot = actual location from AIS data, Green dot = predicted location from the ARIMA model).

Figure 5 presents another zoomed-in image of the vessel (MMSI: 567445000) on 20 August 2020. For this part of the vessel’s trajectory, the algorithm detected fulfilment of one of the warning criteria due to AIS data missing for a certain period of time. In this case, the vessel turned off its AIS transmitter from 16:38 to 23:46. There is significant ship traffic in this area; therefore, it is essential for AIS transmitters to be turned on. Upon the warning being triggered, further investigation is necessary to check for any suspicious events such as illegal fishing, illegal trade, accident or piracy.

Figure 5.A zoomed-in image of the vessel’s (MMSI: 567065500) trajectory on 20 August 2020 (Yellow dot = actual location from AIS data, Green dot = predicted location from the ARIMA model).

Conclusions and future work

Enhancing maritime security provides safety for seafarers, safeguards sea lines of communications and protects marine resources. However, detecting and responding to maritime threats (piracy, illegal fishing, drug smuggling, human trafficking, etc.) depend highly on the effective monitoring of traffic and activities in the maritime areas of interest. Vessels traversing in these areas carry AIS transmitters. The AIS data transmitted from these devices are used primarily for monitoring traffic. However, each day, millions of AIS data points are received, and it becomes almost impossible for authorities to manually go through all these data points to look for suspicious behaviours. It is also very challenging to monitor the vast maritime area. Hence, it is practical to develop an AI-based solution to analyse the AIS dataset and detect suspicious behaviours.

In this article, we followed and improved the technique proposed by Patmanidis et al. (2016) by using a time series model for monitoring navigational trajectories from AIS datasets. Our improved model introduces an integration term based on the ARIMA model. We demonstrated the feasibility of the ARIMA model to detect suspicious behaviours and issue warnings. This research has also shown that ARIMA is simple but robust enough to trigger an appropriate warning.

While the presented research provided initial proof of principle results, there are still many areas for improvement, such as exploring some methods to fine-tune the ARIMA coefficient for more accurate prediction. Another possible idea is to improve the performance and cycle of the algorithm to be able to calculate more accurately with fewer computational resources. Apart from forecasting vessels’ future position and status, the tested algorithm relies heavily on the warning criteria for potentially illegal activities; therefore, there is a need to define and automatically shape suitable warning criteria as more cases are detected. This can be done by analysing the historical AIS data in each area and finding suitable features of illegal activities in those areas.

One of the most important ventures that has gained much attention from many countries is the use of data fusion (Butler, 2005; Katsilieris et al., 2013; Kurekin et al., 2019; Li et al., 2021; Longépé et al., 2018; Zhao et al., 2014). Many countries and authorities have ventured into integrating data sources for monitoring activities in the maritime domain in all possible aspects. Such integration increases the ability to determine vessels’ behaviours in many ways but also results in a lot more data to handle. As a result, many authorities cannot effectively monitor these data and some abnormal behaviours can go undetected for quite some time. Therefore, it becomes crucial to have algorithms or other methods to properly and effectively process the outputs of data fusion, to properly monitor activities in the maritime domain and alert authorities when something needs further investigation.