A Formal and Visual Data-Mining Model for Complex Ship Behaviors and Patterns

The successful emergence of real-time positioning systems in the maritime domain has favored the development of data infrastructures that provide valuable monitoring and decision-aided systems. However, there is still a need for the development of data mining approaches oriented to the detection of specific patterns such as unusual ship behaviors and collision risks. This research introduces a CSBP (complex ship behavioral pattern) mining model aiming at the detection of ship patterns. The modeling approach first integrates ship trajectories from automatic identification system (AIS) historical data, then categorizes different vessels’ navigation behaviors, and introduces a visual-oriented framework to characterize and highlight such patterns. The potential of the model is illustrated by a case study applied to the Jiangsu and Zhejiang waters in China. The results show that the CSBP mining model can highlight complex ships’ behavioral patterns over long periods, thus providing a valuable environment for supporting ship traffic management and preventing maritime accidents.


Introduction
Maritime transportation has long been a vital mode of international trade, accounting for more than 80% of worldwide exchanges. The continuous increase in maritime traffic and flows has led to critical stakeholder navigation monitoring and security challenges in many overcrowded maritime areas [1]. This entails the need for data mining approaches that can provide decision-aided solutions for extracting unusual and dangerous ship behaviors. Ship behavior pattern mining is an important means to ensure the safety of the navigation environment, but the existing ship behavior pattern mining models are mostly limited to one or several data mining algorithms when conducting trajectory mining research, such as clustering, classification, outlier analysis, or frequent patterns. So, the excavated behavior patterns are not comprehensive enough, not accurate enough, and lack a certain correlation between the behavior patterns; thus, it is difficult to fully grasp the navigation status of ships. In order to improve the situational awareness of maritime supervisors, deter illegal and criminal acts at sea, and maintain the safety of maritime navigation, it is necessary to study the theory and method of situational analysis that can mine the complex behavior patterns of ships. Based on this, this paper introduces a dynamic model in which, first, ship trajectory data is used to summarize ship trajectory characteristics, including temporal and spatial properties. Moreover, ship behaviors are expressed from the macrolevels to the microlevels according to the above characteristics. Secondly, basic ship behaviors are combined by minimum and combination operators to derive complex behaviors, which are mathematically expressed and then visualized. The objective of the modeling approach is to provide a decision-aided system to supervisors when grasping complex ship behaviors, reducing the difficulty of supervision and improving navigation safety.
The spatial characteristics of several ship trajectories that can then be studied are as follows [25]: if there is a time t of its spatiotemporal trajectory point sequence in which the neighbourhood of its trajectory point is NH d (P o i (t)) and that it is not in the proximity of other moving objects, then we say that the moving object o i is in positional deviation at time t.

Ship's Basic Behaviors
A basic ship behavioral pattern can be expressed as a triple <N, E, T> where N denotes an event (i.e., a basic behavior), E is the event object, and T is the time of the event. We identify a difference between the microlevel where the basic movement of a moving object is analyzed from trajectory data and the macrolevel where moving object trajectories are globally mined.

Microlevel Basic Behavior Patterns
At the microlevel, the basic behavior patterns of ships include the mobile behavior pattern, stay behavior pattern, jumping behavior pattern, and deviation behavior pattern.
(1) Mobile behavior pattern [26] (<Mobile, o i , (t a , t c )>) An object o i is likely to move at a certain speed, and its trajectory can be either a straight line or a curve composed of a series of spatial points. A mobile behavior pattern is expressed as a sequence of spatiotemporal trajectory points: Given a short time interval threshold g, a duration threshold L, a low-speed movement threshold ε low , and a high-speed movement threshold ε high , the following conditions should be satisfied: (1) time series; (2) short time interval; (3) time duration; and (4) speed stability. The mathematical expression is shown as follows: (2) Stay behavioral pattern (<STAY, o i ,(t a , t c )>) Maritime objects are likely to move at a relatively low speed, thus leading to potential low-speed running areas. A stay pattern highlights a comprehensive behavioral pattern, which not only shows the approximate stillness of motion but also the dense motion of objects in a given area [27]. A stay behavior pattern is expressed as a sequence of spatiotemporal trajectory points: Given the low speed threshold ε low, the following conditions are met: (1) time series; (2) short time interval; (3) time duration; and (4) low speed retention. The mathematical expression is as follows: (3) Jumping behavioral pattern (<Jump, o i , (t a , t c )>) During the movement of the ship, the AIS equipment is turned off for a long time [28], and a long track point disappears on the track, and the track that is originally a whole segment is divided into two segments. A jumping behavioral pattern is expressed as a sequence of spatiotemporal trajectory points as follows: Given the long-time interval threshold h, the following conditions are met: (1) time series; (2) long-time interval; and (3) time duration. The mathematical expression is shown as follows: A deviation behavioral pattern is defined to convey that a ship motion deviates from most ship motion routes, which is manifested by the distance from the track point of the target object to a typical track exceeding a certain threshold, that is, the track point is outside the main route. The deviation behavioral pattern is expressed as a sequence of position deviation trajectories: Given the quantity scale threshold m, the following conditions are met: (1) time series; (2) short time interval; (3) time duration; and (4) position deviation. The mathematical expression is given as follows:

Macrolevel Basic Behavioral Patterns
At the macrolevel, basic ship behavior patterns can be extracted at the target location of a ship's arrival, by multi-ship aggregation, and other behaviors [29]. We identify a difference between the gathering and origin destinations and turn back behavioral patterns.
(1) Gather behavioral pattern [30] A gather behavioral pattern combines nearby ships from a space-time perspective through density-based clustering, with objects connected by density for a continuous period [31,32] with all ships remaining at low speed. A gather behavioral pattern is represented as a sequence of snapshot clusters, which is composed of multiple objects o i , o j , . . . from a valid snapshot cluster, i.e., <c t a , c t b . . . , c t c >, C = c t a , c t b . . . , c t c is the set of effective snapshot clusters, and T= { t a , t b , . . . , t c } is the timestamp set of effective snapshot clusters, and which meets the following conditions: (1) time series; (2) short time interval; (3) time persistence; (4) density connectivity, and its characteristics are mapped in effective snapshot clusters; (5) mobility stability; and (6) low speed retention. The mathematical expression is shown as follows: (2) Origin destination behavioral pattern [33] (<OD(place1,place2), o i , (t a , t b )>) A behavioral pattern of the starting and destination points is considered from a macro perspective. Let T = { t a , t b } represent the set of time stamps when the moving object reaches the target location, P o i t j represent the position of the moving object o i at t j , and the following conditions are met: (1) time series; (2) time interval; and (3) spatial nearest neighbor. The mathematical expression is shown as follows: (3) Turn back behavior pattern (<Tback(place1,place2 . . . ), o i , (t a , t q )>) A turn back behavioral pattern is when a ship moving in a given direction is returning in the reverse direction after reaching a given position, and then turns back on the track. The turn back behavioral pattern is expressed as a target position reaching sequence, i.e., Table A1 in the Appendix A summarizes the ship's trajectory characteristics and behavioral patterns.

Behavioral Pattern Combination
As far as basic trajectory patterns are identified at the individual levels, they can be combined to denote behavioral patterns.

Minimum Operation Subset
Combination operations are categorized into logic-based operators, time series-based operators, and other types of operators.
Logic-based operators include logical "and", "or", and "none" operations. Time series-based operator: Time-series relationships are divided into timestamps and interval timestamps operations. As most ship behaviors generally last for a period of time, we consider temporal intervals [34,35]. Thirteen kinds of interval timestamp relationships can be identified according to a temporal algebra. Overall, this identifies a difference between intervals that overlap and do not overlap using different combinations (Table A2 in the Appendix A).
When the interval timestamps of two events do not overlap completely, the sequence of events can be determined. When the interval timestamps of two events overlap completely, the two events are concurrent within the interval timestamp. When the interval timestamps of two events overlap partially, it is difficult to determine whether the events occur in chronological order or whether the events are concurrent, so let us cut the interval timestamps. Figure 1 shows the time series relationship of the two events after cutting. C2 precedes C1 at t 1 -t 2 ; C1 is concurrent with C2 at t 2 -t 3 ; and C2 follows C1 at t 3 -t 4 . In this case, C1 during C2 is selected for analysis. Other events with partial overlapping time can be cut using this method to determine the sequence of events using similar principles. Table A1 in the Appendix A summarizes the ship's trajectory havioral patterns.

Behavioral Pattern Combination
As far as basic trajectory patterns are identified at the indivi combined to denote behavioral patterns.

Minimum Operation Subset
Combination operations are categorized into logic-based oper operators, and other types of operators.
Logic-based operators include logical "and", "or", and "none Time series-based operator: Time-series relationships are di and interval timestamps operations. As most ship behaviors gene time, we consider temporal intervals [34,35]. Thirteen kinds of in tionships can be identified according to a temporal algebra. Over ference between intervals that overlap and do not overlap using ( Table A2 in the Appendix A).
When the interval timestamps of two events do not overlap co of events can be determined. When the interval timestamps of tw pletely, the two events are concurrent within the interval timesta timestamps of two events overlap partially, it is difficult to determ occur in chronological order or whether the events are concurrent, timestamps. Figure 1 shows the time series relationship of the two precedes C1 at -t2; C1 is concurrent with C2 at -; and C2 this case, C1 during C2 is selected for analysis. Other events with p can be cut using this method to determine the sequence of events u Other types of operators are mainly negative operators and whose semantics are shown in Table 1. Other types of operators are mainly negative operators and time-limited operators, whose semantics are shown in Table 1.

Complex Behavioral Combinatorial Operations
Atomic events are combined based on the minimum operation subset to describe complex ship behavioral patterns, and logical combinatorial operations and temporal combinatorial operations are applied.
A logical combinatorial operation describes complex events through an "and", "or", and "non" operations, for example, (A ∧ B) ∨ C.
This example represents events A, B, and C. The following conditions must be met for complex events: events A and B exist, or event C exists.
The sequential combinatorial temporal operations include "before", "after", "concurrent", "negative", and "time limit". They are categorized into sequential combinatorial operations, potential sequential combinatorial operations, iterative combinatorial operations, embedded combinatorial operations, and composite operations. The semantics of these combinatorial operations are shown in Table A3 in the Appendix A.
Among these operations, the compound operation is the combination nesting of the above four combination operations: Example: These examples show the following: (1) within the time interval of event A, event B and event C occur successively; and (2) event D will not occur within T after the end of event A.  Atomic events are combined based on the minimum operation subset to describe complex ship behavioral patterns, and logical combinatorial operations and temporal combinatorial operations are applied.

Logical Combinatorial Visualization
A logical combinatorial operation describes complex events through an "and", "or", and "non" operations, for example, (A ∧ B) ∨ C This example represents events A, B, and C. The following conditions must be met for complex events: events A and B exist, or event C exists.
The sequential combinatorial temporal operations include "before", "after", "concurrent", "negative", and "time limit". They are categorized into sequential combinatorial operations, potential sequential combinatorial operations, iterative combinatorial operations, embedded combinatorial operations, and composite operations. The semantics of these combinatorial operations are shown in Table A3 in the Appendix A.
Among these operations, the compound operation is the combination nesting of the above four combination operations: Example: These examples show the following: (1) within the time interval of event A, event B and event C occur successively; and (2) event D will not occur within T after the end of event A.

Temporal Combinatorial Visualization
(1) Sequential combinatorial visualization Figure 3 shows the visualization diagram of the pattern sequential combination. There is a time series relationship between these patterns, and the sequential combinatorial operation is expressed as

Temporal Combinatorial Visualization
(1) Sequential combinatorial visualization Figure 3 shows the visualization diagram of the pattern sequential combination. There is a time series relationship between these patterns, and the sequential combinatorial operation is expressed as ≫ ≫ ≫ ≫ . (2) Potential sequential combinatorial visualization Figure 4 shows a visualization of a potential sequence of patterns, which have a time series relationship. Potential sequential combinatorial operations can be expressed as A ≫ * ≫ ≫ * ≫ , for unknown events, the symbol "*" is used to indicate, and the patterns of some objects can be omitted to determine the required complex patterns more intuitively. (3) Iterative combinatorial visualization Figure 5 shows the visual diagram of the pattern iteration combination. From the diagram, patterns A and B can be seen to repeat three times, which can be expressed as (2) Potential sequential combinatorial visualization Figure 4 shows a visualization of a potential sequence of patterns, which have a time series relationship. Potential sequential combinatorial operations can be expressed as A * B * C, for unknown events, the symbol "*" is used to indicate, and the patterns of some objects can be omitted to determine the required complex patterns more intuitively.

Temporal Combinatorial Visualization
(1) Sequential combinatorial visualization Figure 3 shows the visualization diagram of the pattern sequential combination. There is a time series relationship between these patterns, and the sequential combinatorial operation is expressed as ≫ ≫ ≫ ≫ . (2) Potential sequential combinatorial visualization Figure 4 shows a visualization of a potential sequence of patterns, which have a time series relationship. Potential sequential combinatorial operations can be expressed as A ≫ * ≫ ≫ * ≫ , for unknown events, the symbol "*" is used to indicate, and the patterns of some objects can be omitted to determine the required complex patterns more intuitively.  (3) Iterative combinatorial visualization Figure 5 shows the visual diagram of the pattern iteration combination. From the diagram, patterns A and B can be seen to repeat three times, which can be expressed as (4) Embedded combinatorial visualization Figure 6 shows a visual diagram of the pattern embedded combination. From the figure, it can be seen intuitively that during the occurrence of pattern A, pattern B occurs three times in chronological order, which can be expressed as ( ≫ ≫ ) or ( ( )).  (4) Embedded combinatorial visualization Figure 6 shows a visual diagram of the pattern embedded combination. From the figure, it can be seen intuitively that during the occurrence of pattern A, pattern B occurs three times in chronological order, which can be expressed as ( ≫ ≫ ) or ( ( )).  Taking the behavioral pattern of a given ship for a given period of time as a case study, the CSBP visual analysis was carried out. Figure 8 shows the visualization diagram of the ships' CSBP. The abscissa is time and the ordinate is the six behavioral patterns previously described: STAY, OD, DEV, JUMP, Gather, and Tback. The different colors represent different behavioral patterns. The logical combination of operations can be expressed as:

STAY ∧ OD ∧ DEV ∧ JUMP ∧ Gather
This description indicates that the ship has stayed, then it is at an origin destination, and then a deviation, thus jumping over this period, while there is no turn back behavior pattern. The time series composite operation on the ship can be expressed as: Taking the behavioral pattern of a given ship for a given period of time as a case study, the CSBP visual analysis was carried out. Figure 8 shows the visualization diagram of the ships' CSBP. The abscissa is time and the ordinate is the six behavioral patterns previously described: STAY, OD, DEV, JUMP, Gather, and Tback. The different colors represent different behavioral patterns. The logical combination of operations can be expressed as: Taking the behavioral pattern of a given ship for a given period of time as a c study, the CSBP visual analysis was carried out. Figure 8 shows the visualization diagr of the ships' CSBP. The abscissa is time and the ordinate is the six behavioral patte previously described: STAY, OD, DEV, JUMP, Gather, and Tback. The different col represent different behavioral patterns. The logical combination of operations can be pressed as: This description indicates that the ship has stayed, then it is at an origin destinati and then a deviation, thus jumping over this period, while there is no turn back behav pattern. The time series composite operation on the ship can be expressed as: The above process shows a ship CSBP in a composite form. This method can ac rately and intuitively describe the process of ship CSBP and present in detail comp behavioral patterns during a given navigation. This description indicates that the ship has stayed, then it is at an origin destination, and then a deviation, thus jumping over this period, while there is no turn back behavior pattern. The time series composite operation on the ship can be expressed as: The above process shows a ship CSBP in a composite form. This method can accurately and intuitively describe the process of ship CSBP and present in detail complex behavioral patterns during a given navigation.

Visualization of a Ship Navigation Behavior
The approach was experimented in the Jiangsu and Zhejiang waters, using a cargo ship as an example, to highlight complex behaviors through the CSBP mining model and used the visual method to illustrate its navigation patterns in 2020. The static information of the cargo ship studied in this experiment is shown in Table 2.  Figure 9 shows the visualization of the complex behavior of the cargo during navigation and at different times. The abscissa is UTC (Coordinated Universal Time) time and the ordinate is the five basic ship behavioral patterns previously defined.

Visualization of a Ship Navigation Behavior
The approach was experimented in the Jiangsu and Zhejiang waters, using a cargo ship as an example, to highlight complex behaviors through the CSBP mining model and used the visual method to illustrate its navigation patterns in 2020. The static information of the cargo ship studied in this experiment is shown in Table 2.  Figure 9 shows the visualization of the complex behavior of the cargo during navigation and at different times. The abscissa is UTC (Coordinated Universal Time) time and the ordinate is the five basic ship behavioral patterns previously defined.

Analysis of Complex Ship Behavior
The CSBP mining model can visualize the navigation behavior of a ship during the whole navigation process, which should denote a true reflection of the navigation status of the ship.
As shown in Figure 9, the cargo ship showed five behavioral patterns during navigation: stay, origin destination, deviation, jumping, and gather. Regarding the jumping behavioral pattern, this occurred before period 7 and between two adjacent origin destination behaviors, indicating that the cargo ship was in a suspended state and had closed AIS during this period. Several short-time jumping behavioral patterns between the origin

Analysis of Complex Ship Behavior
The CSBP mining model can visualize the navigation behavior of a ship during the whole navigation process, which should denote a true reflection of the navigation status of the ship.
As shown in Figure 9, the cargo ship showed five behavioral patterns during navigation: stay, origin destination, deviation, jumping, and gather. Regarding the jumping behavioral pattern, this occurred before period 7 and between two adjacent origin destination behaviors, indicating that the cargo ship was in a suspended state and had closed AIS during this period. Several short-time jumping behavioral patterns between the origin destination behaviors indicate that some obstacles may have blocked the AIS signal during the journey of the ship. The ship showed two gather behavioral patterns, and the occurrence time was outside the occurrence period of the origin destination behavior. Therefore, one can infer that the cargo ship could have berthed with the assistance of a tug or overtaken other ships. The ship showed many stay behaviors. One can infer that this location may be an anchor within the period when the behavioral pattern of the origin destination occurred. The speed of the ship was low or zero at this location, and the ship was in the state of anchoring. If the stay behavior was outside the period when the origin destination behavioral pattern occurred, the ship may have berthed at the wharf. From the complex behavioral pattern diagram of the ship, the starting point and arrival point of the cargo ship are clear, no turn back behavior and no other abnormal behavior during navigation was shown, so one can infer that the cargo ship was sailing normally on the planned route. Figure 10a,b are separate representations of the basic behaviors at the microlevel of the cargo ship. Compared with the complex behaviors denoted in Figure 9, the separate jumping behavior and stay behavior lack comparison with the other behaviors and cannot clearly show the state of the ship in time and space, which is not convenient for the overall grasp of the behavior of the ship during navigation.

Instance Application
The application of the CSBP mining model mining and visualization, combined wit a frequent pattern mining algorithm, suspected ships with illegal behaviors might be un covered.

Instance Application
The application of the CSBP mining model mining and visualization, combined with a frequent pattern mining algorithm, suspected ships with illegal behaviors might be uncovered.

Visual Analysis of Complex Ship Behaviors
Taking Zhejiang and Fujian waters as the case study, we selected a refined oil smuggling ship. The CSBP mining model visually showed the navigation process of the ship in 2020 and traced the origin of the ship's smuggling process, combined with the evidence found by the maritime police border guards, which can provide corresponding evidence for the conviction of offenders. The static information of the ships involved in this experimental study is shown in Table 3.  Figure 11 shows the visualization of the complex ship behavior detected during its navigation, which intuitively shows its behaviors at different times. The abscissa is the UTC of the ship navigation while the ordinate is the six basic ship behavior patterns previously identified. The red straight line represents that the ship passed through stay and gather behavioral patterns at a given time in the navigation process, indicating that two behaviors occurred simultaneously. Shifting the red line from left to right represents the behavioral pattern of the ships in turn over time.

ER REVIEW
14 of 21 2020 and traced the origin of the ship's smuggling process, combined with the evidence found by the maritime police border guards, which can provide corresponding evidence for the conviction of offenders. The static information of the ships involved in this experimental study is shown in Table 3.  Figure 11 shows the visualization of the complex ship behavior detected during its navigation, which intuitively shows its behaviors at different times. The abscissa is the UTC of the ship navigation while the ordinate is the six basic ship behavior patterns previously identified. The red straight line represents that the ship passed through stay and gather behavioral patterns at a given time in the navigation process, indicating that two behaviors occurred simultaneously. Shifting the red line from left to right represents the behavioral pattern of the ships in turn over time. The most prominent suspicious behavior is to stay at a certain place for a long time and frequently turning the AIS system on and off during the stay of the ship. According to the stay behavioral pattern, the ship stayed in the sea area near Zhoushan for nearly 45 days while 81 jumping behavioral patterns occurred during the stay behavioral pattern. This complex behavior pattern can be expressed as ( ( )). Accordingly, the characteristics of this suspicious ship are set as follows: (1) the ship showed a stay behavioral pattern, and the stay period was more than 30 days; (2) there were multiple jumps between the behavioral patterns of the ship during this stay period, and the threshold of The most prominent suspicious behavior is to stay at a certain place for a long time and frequently turning the AIS system on and off during the stay of the ship. According to the stay behavioral pattern, the ship stayed in the sea area near Zhoushan for nearly 45 days while 81 jumping behavioral patterns occurred during the stay behavioral pattern. This complex behavior pattern can be expressed as STAY Itr 81 (JUMP) . Accordingly, the characteristics of this suspicious ship are set as follows: (1) the ship showed a stay behavioral pattern, and the stay period was more than 30 days; (2) there were multiple jumps between the behavioral patterns of the ship during this stay period, and the threshold of the number of jumps was set to 10. The judgement basis of suspicious ships chosen above is subjective, which is analyzed here as an example. In practical applications, it will be necessary to combine such patterns with professional knowledge and the relevant evidence of marine police and supervisors to more accurately determine the behavioral characteristics of such suspicious ships.

Frequent Behavior Patterns Uncover Suspicious Ships
First, the frequent behavior patterns of a group of ships were mined using the PrefixSpan algorithm. Then, the frequent behavioral pattern was set into the frequent behavior pattern of the ship, the frequent behavioral patterns of other ships were matched with the frequent behavior of the ship involved, and the ships that highly matched with the behavior of the ship involved were uncovered. Figure 12 shows the overall process framework.

Frequent Behavior Patterns Uncover Suspicious Ships
First, the frequent behavior patterns of a group of ships were mined using th fixSpan algorithm. Then, the frequent behavioral pattern was set into the frequent ior pattern of the ship, the frequent behavioral patterns of other ships were matche the frequent behavior of the ship involved, and the ships that highly matched w behavior of the ship involved were uncovered. Figure 12 shows the overall process work. The frequent behavioral patterns of the other ships were matched with the fr behavioral patterns of the ship involved. If the frequent behavior item set of the sh and the frequent behavior item set of the ship involved is Q, the calculation formula matching degree is as follows: Figure 13 shows the histogram of the matching degree of the frequent behavi terns between other ships and the ship involved. Due to the limited cases, the selec the threshold is relatively subjective. In this case, we selected the threshold M = 0.6. the selection of the matching threshold could be combined with the actual situa different cases to achieve the better results. With the increase in the case datab threshold value is automatically obtained through intelligent algorithm learning, is also a valuable further research direction. The frequent behavioral patterns of the other ships were matched with the frequent behavioral patterns of the ship involved. If the frequent behavior item set of the ship is S and the frequent behavior item set of the ship involved is Q, the calculation formula of the matching degree is as follows: Figure 13 shows the histogram of the matching degree of the frequent behavior patterns between other ships and the ship involved. Due to the limited cases, the selection of the threshold is relatively subjective. In this case, we selected the threshold M = 0.6. In fact, the selection of the matching threshold could be combined with the actual situation of different cases to achieve the better results. With the increase in the case database, a threshold value is automatically obtained through intelligent algorithm learning, which is also a valuable further research direction. Sensors 2022, 22, x FOR PEER REVIEW 16 of 21 Figure 13. Histogram of the degree of matching of frequent behavioral patterns between the ships and the ship involved.

Uncovering Suspicious Ships
The mining of the suspected ship requires the illegal and criminal ship behavior as a reference, and the CSBP mining model was used to visually analyze the behavior of the involved ship and uncover the suspicious behavior of the ship. The PrefixSpan algorithm was used to mine the ships closely matching the behavior of the ships involved in the case. Combined with the above two points, suspicious ships can be uncovered. Finally, three ships in this experiment met the above suspicious ship identification requirements, and their visualization results are shown in Figure 14. The complex behavior visualization of the three ships corresponds to Figure 14a-c.
(a) Figure 13. Histogram of the degree of matching of frequent behavioral patterns between the ships and the ship involved.

Uncovering Suspicious Ships
The mining of the suspected ship requires the illegal and criminal ship behavior as a reference, and the CSBP mining model was used to visually analyze the behavior of the involved ship and uncover the suspicious behavior of the ship. The PrefixSpan algorithm was used to mine the ships closely matching the behavior of the ships involved in the case. Combined with the above two points, suspicious ships can be uncovered. Finally, three ships in this experiment met the above suspicious ship identification requirements, and their visualization results are shown in Figure 14. The complex behavior visualization of the three ships corresponds to Figure 14a

Uncovering Suspicious Ships
The mining of the suspected ship requires the illegal and criminal ship behavior as a reference, and the CSBP mining model was used to visually analyze the behavior of the involved ship and uncover the suspicious behavior of the ship. The PrefixSpan algorithm was used to mine the ships closely matching the behavior of the ships involved in the case. Combined with the above two points, suspicious ships can be uncovered. Finally, three ships in this experiment met the above suspicious ship identification requirements, and their visualization results are shown in Figure 14. The complex behavior visualization of the three ships corresponds to Figure 14a

Discussion and Conclusions
This paper introduces a formal and visual framework for analyzing ship behaviors as derived from AIS trajectory data. Different behavior characteristics are modeled as basic patterns and are combined to denote complex ship behavioral patterns and visualize them using the CSBP mining model. The model method has broad application prospects. For example, by the maritime police, it can be used in the detection of smuggling and drug trafficking. After establishing a certain case database, it can be used to detect illegal

Discussion and Conclusions
This paper introduces a formal and visual framework for analyzing ship behaviors as derived from AIS trajectory data. Different behavior characteristics are modeled as basic patterns and are combined to denote complex ship behavioral patterns and visualize them using the CSBP mining model. The model method has broad application prospects. For example, by the maritime police, it can be used in the detection of smuggling and drug trafficking. After establishing a certain case database, it can be used to detect illegal activities such as ship smuggling through the judgment of the similarity model. For fishery administration, the corresponding illegal fishing behavior can be identified through the construction of an illegal fishing vessel behavior database and then through the judgment of the similarity model. For the maritime department, it can be used to detect the illegal anchoring and anchor walking behavior. The experimental results show that the CSBP mining model can clearly show ship behavioral patterns during navigation and efficiently uncover suspicious ships. The reliability analysis of the suspected ships uncovered has a higher degree of matching with the involved ship. The aim will be to combine such visual analysis with professional knowledge and maritime law enforcement to derive relevant evidence. A more restrictive study area can be identified before performing frequent behavior pattern mining to reduce the number of ships involved and facilitate the discovery of suspected ships. We also plan to implement the formal and visual principles of the CSBP mining model in a computing architecture and interface that will be specifically designed for maritime officers and experts. Indeed, the approach is still prone to some limitations. First, the quality of the AIS data affects the experimental results. If there is a lot of missing data in the data used in the experiment, some behavior models are difficult to mine, which will affect the analysis of the final experimental results. Secondly, some discontinuous patterns might appear due to AIS signal loss or shade. Last, although six behavioral patterns were identified at the macro-and microlevels, additional patterns might be formally defined; this is left to further work to extend the potential of our whole framework.

Data Availability Statement:
The data used to support the findings of this study are available from the corresponding author upon request.  Table A3. Sequential combinatorial operations.

Sequential combination operations
The sequential combinatorial operation requires that events that occur in the target object be sequenced in chronological order.

A
(B) T C E 1. In chronological order, events A, B, and C occur in the order of the event. 2. Event B occurs at least T for a period of time. 3. After event B occurs, event C and event E occur at the same time.
Potential sequential combinatorial operations The potential sequence combinatorial operation refers to the incomplete confirmation of the sequence of events that occur in the target object, represented by the symbol "*".
A * B Indicates that the complex event is triggered by the potential sequence of events A and B, and its combination operation expression semantics is as follows: 1. Event A occurs first to the target object in chronological order. 2. Subsequent event B. 3. After event A and before event B, there are none, one or more events.

Embedded combinatorial operation
The embedded combinatorial operation refers to the existence of an event with a large interval, during which other events occur.
A(B C D) Indicates that the complex event is composed of four events A, B, C, and D. Among these events, events B, C, and D are embedded in the time interval of event A. The embedded combination operation expresses the semantics as follows: within the time period of event A, event B, event C, and event D occur successively.

Iterative combinatorial operation
The iterative combinatorial operation refers to the events that occur in the target object, which occur iteratively in the time series, represented by Itr n ( * ).
Itr n (A B C) 1. Event A, event B, and event C occur in chronological order. 2. The whole process is iterated n times.