PaperlayerView exact revision on arXiv

Source-linked AI summary

GeoTrackNet-A Maritime Anomaly Detector using Probabilistic Neural Network Representation of AIS Tracks and A Contrario Detection

Duong Nguyen, Rodolphe Vadaine, Guillaume Hajduch, René Garello, Ronan Fablet

arXiv:1912.00682v5cs.LGcs.AIstat.ML

TL;DR

AIS anomaly detection is difficult because AIS data are noisy and lack quality metadata and representative ground truth. GeoTrackNet uses a probabilistic VRNN representation of AIS tracks with geospatial a contrario detection; in one reported set of 25 flagged tracks, experts identified one as a false alarm.

  • Problem

    AIS anomaly detection is difficult because AIS messages are noisy, lack quality metadata, and have no representative ground-truth dataset for supervised learning.

    Source: §I · p. 1

  • Method

    GeoTrackNet uses VRNNs to represent AIS tracks probabilistically and applies a geospatial a contrario detector to evaluate track likelihood.

    Source: §I · p. 1, C. A contrario detection · p. 4, §V · p. 10

  • Results

    Among 25 tracks flagged as abnormal in the reported case, AIS experts identified one as a false alarm.

    Source: B. Experiments and results · p. 6

  • Takeaways & Limitations

    The authors present the approach as opening research directions to complement or outperform DBSCAN-based methods.

    Source: §V · p. 11

    Unsupervised detections are statistically unusual events that may not involve suspicious actions; expert assessment and reference ground truth are needed for operational evaluation and quantitative benchmarking.

    Source: §V · p. 11

Abstract

from arXiv · show

Representing maritime traffic patterns and detecting anomalies from them are key to vessel monitoring and maritime situational awareness. We propose a novel approach -- referred to as GeoTrackNet -- for maritime anomaly detection from AIS data streams. Our model exploits state-of-the-art neural network schemes to learn a probabilistic representation of AIS tracks and a contrario detection to detect abnormal events. The neural network provides a new means to capture complex and heterogeneous patterns in vessels' behaviours, while the \textit{a contrario} detector takes into account the fact that the learnt distribution may be location-dependent. Experiments on a real AIS dataset comprising more than 4.2 million AIS messages demonstrate the relevance of the proposed method compared with state-of-the-art schemes.

I. INTRODUCTION

AIS anomaly detection matters for maritime surveillance but is difficult because AIS data are noisy and lack metadata and representative ground truth. GeoTrackNet combines a VRNN-based probabilistic model of AIS tracks with geospatial a contrario detection, and its relevance is evaluated on more than 4.2 million AIS messages.

I. INTRODUCTION

  • AIS-based anomaly detection is difficult because messages are noisy, lack quality and uncertainty metadata, and have no representative ground-truth dataset for supervised learning.Trajectory data also combine geographic, temporal, and geographic-temporal features that methods from other domains do not address.Source: §I · p. 1
  • GeoTrackNet uses a VRNN to learn a probabilistic representation of vessel movement patterns, with stochastic factors modeling variations and uncertainty in AIS tracks.The authors note that AIS signal quality and environmental conditions can contribute to observed variation.Source: §I · pp. 1–2
  • Its geospatial a contrario detector accounts for location-dependent pattern complexity and vessel occurrence and movement variability when evaluating track segments.The paper argues that the model representing AIS trajectories should also be geospatially dependent.Source: §I · p. 2
  • The proposed neural-network representation aims to highlight route-related characteristics of trajectory data.The paper presents this as a contribution alongside its normalcy model and geospatially dependent detection method.Source: §I · p. 2
  • GeoTrackNet is evaluated against state-of-the-art approaches on a real dataset comprising more than 4.2 million AIS messages.The paper focuses on trajectory-based anomaly detection.Source: §I · p. 2

II. RELATED WORK

Prior maritime anomaly-detection approaches include rule-based methods and learning-based methods, with learning-based methods generally relying on unsupervised learning because representative ground truth is unavailable. GeoTrackNet is presented as addressing limitations in normalcy extraction and deviation detection.

II. RELATED WORK

  • Rule-based methods are interpretable, but defining an exhaustive list of abnormal behaviours is difficult and terms such as “fast” or “slow” are relative..Source: §II · p. 2
  • Unsupervised learning is preferred because representative anomaly ground truth is unavailable, and learning can avoid requiring an exhaustive list of normal and abnormal behaviours.The passage describes this category as dominant in maritime anomaly detection.Source: §II · p. 2
  • Waypoint-based approaches may be sensitive to clustering hyperparameters, fail to link some tracks to graph edges, and may not transfer from cargo and tanker vessels to other types.Unreliable AIS metadata can also require preprocessing to filter vessel types for operational systems.Source: §II · p. 2
  • Prior deep-learning approaches may struggle with noisy AIS trajectories and external factors, while a geospatially homogeneous model overlooks differences in data and pattern complexity across regions.GeoTrackNet is introduced as using probabilistic neural representations and a contrario detection to address normalcy extraction and deviation detection for vessel types.Source: §II · pp. 2–3

III. PROPOSED APPROACH

GeoTrackNet builds on the Embedding layer introduced for MultitaskAIS. The section first introduces this architecture and then presents the anomaly-detection formulation.

III. PROPOSED APPROACH

  • GeoTrackNet relies on the Embedding layer introduced for the MultitaskAIS network.Source: §III · p. 3
  • The approach section introduces the network architecture before detailing the anomaly-detection method.Source: §III · p. 3
  • The proposed anomaly-detection formulation is presented after the architecture introduction.Source: §III · p. 3

A. Data representation

The paper represents each AIS message with a four-hot vector formed by concatenating one-hot encodings of latitude, longitude, speed, and course. It argues that this representation better exposes route-related structure than a continuous real-valued vector.

A. Data representation

  • A four-hot AIS-message vector concatenates one-hot vectors for latitude, longitude, SOG, and COG.The paper contrasts this with the common four-dimensional real-valued representation of position and velocity.Source: A. Data representation · p. 3
  • In the illustrated route junction, four-hot Bernoulli modeling assigns higher probability to the two observed turns and makes the unobserved straight-ahead position unlikely.The caption contrasts this with Gaussian modeling of real-valued positions, which gives the unobserved position a better score than the observed turns.Source: Figure 3 · p. 3
  • The four-hot encoding is intended to expose geometric and phase patterns and emphasize route-related characteristics in AIS trajectories.The authors expect the model to learn specific routes and flag deviations from them as abnormal.Source: A. Data representation · p. 3
  • Bin resolution trades computational size and possible overfitting against information loss; the experiments suggest 0.01° for coordinates, 1 knot for SOG, and 5° for COG work well most of the time.Source: A. Data representation · p. 3

B. Probabilistic Recurrent Neural Network Representation of AIS Tracks

GeoTrackNet models AIS tracks with a variational recurrent neural network, adding latent stochastic variables to represent trajectory uncertainty. It trains the track distribution by maximizing an evidence lower bound on sequence likelihood.

B. Probabilistic Recurrent Neural Network Representation of AIS Tracks

  • For each contiguous AIS track, the model interpolates and samples a sequence of four-hot message vectors, then learns its sequence likelihood.The sequence distribution is factorized across time steps.Source: B. Probabilistic Recurrent Neural… · p. 4
  • VRNNs add latent stochastic variables to recurrent models to represent variations and uncertainties that deterministic RNNs struggle to capture.The passage relates those uncertainties to AIS variation and discretization, including vessel types, weather, and message corruption.Source: B. Probabilistic Recurrent Neural… · p. 4
  • The variational objective replaces an intractable likelihood with an evidence lower bound using an approximate posterior over latent variables.The approximation is q(zt|xt, ht) for the true posterior p(zt|xt, ht).Source: B. Probabilistic Recurrent Neural… · p. 4
  • Training maximizes the ELBO, combining the expected log emission under the approximate posterior with a KL divergence between distributions.The objective is optimized with stochastic gradient ascent.Source: B. Probabilistic Recurrent Neural… · p. 4

C. A contrario detection

GeoTrackNet replaces global thresholding with geospatial a contrario detection because the learned model’s probability scores can vary by location. It evaluates low-probability message runs within track segments using a false-alarm criterion.

C. A contrario detection

  • A global log-probability threshold can be poorly relevant where the model assigns low probabilities broadly, even to tracks in variable or data-limited regions.In regions with well-defined patterns, normal tracks are expected to have high probabilities, making low values informative.Source: C. A contrario detection · p. 4
  • Geospatial a contrario detection models the distribution of log probabilities separately within geographical grid cells, accounting for location-dependent model performance.Each cell Ci has a distribution pCi of message log probabilities.Source: C. A contrario detection · p. 4
  • The detector marks an AIS message abnormal when its log probability falls below the cell-specific lowest p quantile.The probability of an abnormal message under pCi is p.Source: C. A contrario detection · p. 4
  • Assuming message-level abnormality events are independent, the probability that at least k of n messages in a segment are abnormal is a binomial tail.A contrario detection uses the Number of False Alarms (NFA) to assess whether a segment is abnormal.Source: C. A contrario detection · pp. 4–5
  • A segment is abnormal when its NFA is below ε, and a track is abnormal if any segment is flagged.ε is the allowed false-alarm expectation; the detector models cell log-probability distributions with either a Gaussian approximation or KDE.Source: C. A contrario detection · p. 5

A. Experimental set-up

Experiments use AIS data from an Ushant station across two three-month periods, with time-ordered training, validation, and test splits. Because no ground-truth dataset is available, evaluation focuses on anomaly types and expert inspection rather than quantitative accuracy or false-alarm benchmarking.

A. Experimental set-up

  • Each study period contains more than 4.2 million AIS messages, split chronologically into training, validation, and test sets.Training uses data through the 10th of the final month, validation the 11th–20th, and test the 21st through month-end.Source: A. Experimental set-up · p. 5, Figure 4 · p. 5
  • The offline experiments preprocess voyages by removing erroneous position or speed messages, truncating SOG at 30 knots, resampling to 10-minute intervals, and splitting long tracks into 4–24-hour segments.Voyages with gaps longer than two hours are split into contiguous tracks.Source: A. Experimental set-up · p. 5
  • The comparison includes TREAD, LSTM, and VRNN baselines alongside GeoTrackNet.TREAD uses the suggested settings minPts = 10 and eps = 2000, with a 3 km radius for each small area.Source: A. Experimental set-up · p. 6
  • Without a reference ground-truth dataset, the study does not quantitatively benchmark accuracy or false-alarm rate; it analyzes detected anomaly types and has AIS experts inspect GeoTrackNet detections.Source: A. Experimental set-up · p. 6

B. Experiments and results

GeoTrackNet’s experiments compare location-aware anomaly detection with several alternatives and examine its representation, vessel coverage, seasonal consistency, and memory requirements. Experts judged only one of 25 tracks flagged by KDE GeoTrackNet a false alarm, while the method detected both spatial and kinetic anomalies.

Basic case study

  • Global thresholding concentrated detections in low-likelihood regions, whereas the a contrario detector compares each message with others in the same area.The local comparison addresses geographic variation: maritime routes often have high, stable likelihoods, while sparse or complex areas have lower, more variable likelihoods.Source: B. Experiments and results · p. 6, Figure 5 · p. 6, Figure 6 · p. 7
  • 25 tracks were flagged by KDE GeoTrackNet, and AIS experts judged only one a false alarm; detections included spatial and kinetic anomalies.The examples include deviations from routes, unusual turns, abnormal speed changes, and other unusual track patterns.Source: B. Experiments and results · p. 6, Figure 6 · p. 7

Relevance of the “four-hot” representation

  • Without the four-hot representation, GeoTrackNet missed small but unusual deviations; changing spatial resolution by a factor of five altered detections.The paper reports consistent performance for twofold resolution changes, while resolutions that are too fine or too coarse respectively require predicting positions within 200 meters or merge positions within a 5-kilometer radius.Source: B. Experiments and results · p. 7, Figure 10 · p. 9

Vessel types

  • GeoTrackNet can be applied to any vessel type, but complex patterns such as fishing behavior can be difficult to learn; all-vessel track distributions may also be non-unimodal.For those cases, the paper favors KDE over a Gaussian approximation, while noting that some statistically abnormal tracks are not suspicious.Source: B. Experiments and results · pp. 7–8, Figure 11 · p. 9, Figure 12 · p. 10

Comparison with TREAD

  • TREAD flagged a vessel moving at 19 to 20 knots on a route where vessels typically travel at 10 to 18 knots, while GeoTrackNet detected a sudden slowing-down.The paper notes that TREAD’s speed comparison may flag statistically unusual but nonsuspicious behavior; the slowing-down detection may relate to engine problems or abnormal sea/traffic conditions.Source: B. Experiments and results · p. 7, Figure 8 · p. 8

Comparison with DBSCAN-based methods

  • 13% of cargo and tanker test-set tracks could not be mapped to maritime routes, which DBSCAN-based methods cannot monitor.For such tracks, those methods must either flag all of them as abnormal or leave them unmonitored; the paper reports that route-less tracks typically account for 10% to 60% of ROI tracks.Source: B. Experiments and results · p. 7, Figure 9 · p. 8

Seasonal effects

AIS memory requirements

  • With an 8-hour maximum track duration, the cargo vessel’s voyage from port to sea and back was not detected; 16- and 24-hour limits gave the same outcomes.The experiments used a 24-hour limit because the available computational resources could store and process the resulting datasets.Source: Figure 7 · p. 8, B. Experiments and results · p. 10, Figure 14 · p. 10

V. CONCLUSIONS AND FUTURE WORK

GeoTrackNet models AIS tracks probabilistically with VRNNs and evaluates deviations using a geospatial a contrario detector. Its conclusions emphasize broad track coverage and anomaly types, while framing unsupervised detections as statistical flags requiring human judgment.

V. CONCLUSIONS AND FUTURE WORK

  • VRNNs learn probabilistic AIS-track distributions, then a geospatial a contrario detector compares message likelihoods within regions and flags tracks with many abnormal messages.The detector evaluates each message relative to others in the same region.Source: §V · pp. 10–11
  • The approach requires little prior knowledge, avoids key cluster-count or mixture-mode hyperparameters, and controls expected flagged activity through ε.Source: §V · p. 11
  • GeoTrackNet applies to all AIS tracks in the processed area, including tracks that do not follow maritime routes and cannot be monitored by DBSCAN-based models.Source: §V · p. 11
  • The model detects both geographic deviations, such as unusual turns, and kinetic anomalies involving abnormal speed or course changes.Source: §V · p. 11
  • The VRNN can condition its output on external forcing variables, so weather or ocean-current information could complement the model.Source: §V · p. 11
  • At 10-minute resolution, GeoTrackNet reduces processing and storage; after training, it needs no training-set storage, and its weights occupy about 40 MB.Source: §V · p. 11
  • Unsupervised detections are statistically unusual events, not necessarily suspicious actions; expert review and a reference ground-truth dataset would help assess operational consistency.Source: §V · p. 11
  • The neural representation is uninterpretable, so the authors consider the model more suitable for computer-assisted use than fully automatic decisions.Source: §V · p. 11
Loading 1912.00682v5…