A novel anomaly detection approach to identify intentional AIS on-off switching

- An anomaly detection algorithm to identify AIS on-off switching is proposed.
- The algorithm exploits the AIS message Received Signal Strength Indicator.
- Machine Learning algorithms are used to build normality models.
- AIS reception is characterized by using real word data.
- The methodology is scalable from one station to a network of receivers.

The Automatic Identification System (AIS) is a ship reporting system based on messages broadcast by vessels carrying an AIS transponder. The recent increase of terrestrial networks and satellite constellations of receivers is making AIS one of the main sources of information for Maritime Situational Awareness activities. Nevertheless, AIS is subject to reliability and manipulation issues; indeed, the received reports can be unintentionally incorrect, jammed or deliberately spoofed. Moreover, the system can be switched off to cover illicit operations, causing the interruption of AIS reception. This paper addresses the problem of detecting whether a shortage of AIS messages represents an alerting situation or not, by exploiting the Received Signal Strength Indicator available at the AIS Base Stations (BS). In designing such an anomaly detector, the electromagnetic propagation conditions that characterize the channel between ship AIS transponders and BS have to be taken into consideration. The first part of this work is thus focused on the experimental investigation and characterisation of coverage patterns extracted from the real historical AIS data. In addition, the paper proposes an anomaly detection algorithm to identify intentional AIS on-off switching. The presented methodology is then illustrated and assessed on a real-world dataset.