Detection of AIS Closing Behavior and MMSI Spoofing Behavior of Ships based on Spatiotemporal Data

: In marine transportation, many ships are equipped with AIS devices. The AIS data sent by AIS devices can help the maritime authorities and other ships obtain the navigation condition of the ship, thereby ensuring the safety of ships during navigation. However, when a ship is involved in illegal activities, the crew may close the AIS device or tamper with Maritime Mobile Service Identity (MMSI) in the AIS data. To detect these two kinds of behaviors, this paper designs the AIS closing detection algorithm and MMSI spooﬁng detection algorithm based on the spatiotemporal data provided by AIS and radar. As the radar data does not include the ship’s identiﬁcation, the associated relationship between radar data and AIS data is difﬁcult to determine in the multi-ship scenario. To solve this problem, the D-TRAP is deﬁned in this paper, it is applied in the process of searching for the associated AIS points of radar trajectory points, when the number of effective AIS points is reduced caused by the above two behaviors, the association method used in the paper has better performance. In addition, real data and simulation data are used to verify the two algorithms. The veriﬁcation results show that when the ship is simultaneously monitored by radar and AIS, and the monitoring process continues for a period of time, the AIS closing detection algorithm has good performance. When the ship is monitored by AIS and radar before and after MMSI spooﬁng, and both monitoring processes continue for a period of time, the MMSI spooﬁng algorithm has good performance.


Introduction
Nowadays, marine transportation plays an important role in international trade. In marine transportation, many ships are equipped with Automatic Identification System (AIS), which can continuously send the dynamic and static information of the ships. This information mainly includes Maritime Mobile Service Identity (MMSI) number, type, position, speed over ground, and course over ground of the ship [1]. Through the AIS data, the maritime authorities can obtain the navigation status of ships in certain sea areas, thus facilitating the management of maritime traffic.
During navigation, in addition to normal activities, some ships may participate in illegal activities, such as smuggling, pollution, piracy, and unauthorized fishing in protected areas [2]. These ships may pose a threat to maritime traffic safety and national sovereignty. Therefore, timely detection of dangerous ships with illegal behaviors is an important task in maritime management. In the current researches, the dangerous ships are identified mainly by detecting the abnormal trajectories of ships. The main basis of these researches is that the trajectories of dangerous ships are often out of the ordinary. The authors of [3] studied the abnormal fishing vessel behavior based on vessel trajectories. The authors of [4] trained a behavior/interaction model based on trajectory data of ships, and identified abnormal and possibly dangerous situations through the model. The authors of [5] considered that the vessel trajectory points that did not follow the traffic pattern are anomalous vessel behaviors, and detected anomalous vessel behavior by creating a vessel trajectory predictor. The authors of [6] proposed a framework named MT-MAD for maritime trajectory modeling and anomaly detection. The authors of [7] judged whether the ship's trajectory was abnormal based on type of ship, traffic direction, speed, course, number of stop points, and number of phase changes. The authors of [8] used trajectory kernels with one-class SVMs to find outlying trajectories. The authors of [9] proposed a multi-class hierarchy framework to detect anomalous trajectories. However, in these researches, the abnormal trajectories are often defined subjectively, or the detected distinctive trajectories are regarded as abnormal trajectories. There is no uniform standard for the definition of the abnormal trajectory, which also limits the scope of application of related researches.
AIS is a self-reporting system; any self-reporting system is prone to "spoofing" or the intentional reporting of incorrect information [10]. Therefore, in illegal activities, on the one hand, AIS data transmitted by the ship can be spoofed, on the other hand, the AIS transponder in the ship can be turned off [11]. Therefore, from another perspective, the correct detection of AIS closing and spoofing can help maritime authorities to detect illegal activities of ships in time, so that the safety of the relevant sea areas can be guaranteed. The authors of [12] demonstrated the feasibility of radiolocation of AIS emissions, which is the basis for future anti-spoofing and AIS verification applications. The AIS data spoofing mainly includes ship identity (MMSI) spoofing and position spoofing. At this stage, there are some researches on the detection of position spoofing, the authors of [10] studied this problem with the help of radar measurements and information from the tracking system, but the research was mainly aimed at the single-target case. The authors of [13] mainly solved the problem of position spoofing by comparing the estimated AIS emitter position and position reported in AIS data, but it required related domain knowledge. The authors of [14] calculated the speed based on the distance and duration between two AIS points, and determined whether a spoofing event occurred based on the speed, this method was suitable for resolving spoofing events with large changes in position. However, there is less research on MMSI spoofing and AIS closing detection, and it is easier for ships to perform these two behaviors in illegal activities. The authors of [15] provided an idea for MMSI spoofing and AIS switch-off detection, but no further research has been done. The authors of [11] determined whether a shortage of AIS messages represented an alerting situation by exploiting the received signal strength information; however, this method relied on ship-related features, like the height of the transmitting antenna, and when the number of ships in a certain sea area is large, it is difficult to obtain the height of the transmitting antenna of each ship. This paper mainly studies the AIS closing and MMSI spoofing problems in multi-ship scenario. In this research, the spatiotemporal data provided by AIS and radar are used without the need for ship-related features, radar is an alternative sensor for maritime surveillance near the ports [16]. The work of this paper is mainly carried out by finding the association between AIS data and radar data, and analyzing the characteristics of AIS closing behavior and MMSI spoofing behavior. The authors of [17][18][19] studied the association between spatiotemporal data of ships provided by different sensors, which provided the basis for our work. The main contributions of this paper are as follows.
(1) We define the D-TRAP, with the help of D-TRAP, the accuracy of the association between trajectory points can be improved, so as to solve the problem that the associated relationship between AIS data and radar data in the multi-ship scenario is difficult to determine.
(2) We design the AIS closing detection algorithm and MMSI spoofing detection algorithm by establishing the associated AIS trajectory map of radar trajectory. The construction of the associated AIS trajectory map can break the limitation of one-to-one association of trajectories, which can expand the scope of application based on trajectory association, and also increase the robustness of the trajectory association algorithm.
(3) We simulate the AIS closing behavior and MMSI spoofing behavior using real data and simulation data, and verify the effectiveness of the proposed algorithms accordingly.

Data Provided by AIS and Radar
In maritime transportation, both radar and AIS can provide spatiotemporal information of ships. Each record provided by AIS is called an AIS point, this paper uses PA i = {MMSI, lon, lat, time} to represent the ith AIS point. Among them, PA i .MMSI is the MMSI number of the ship; PA i .lon and PA i .lat are the longitude and latitude of the ship, respectively; and PA i .time is the corresponding time.
Similarly, each record provided by radar is called radar point. In the original radar point, the position of the ship is represented by the angle and distance between the ship and the radar. To be consistent with AIS data, the position of the ship needs to be represented by longitude and latitude, so the angle and distance should be converted into the latitude and longitude of the ship, and these conversion formulas can be found in [20]. At this time, we use PR j = {lon, lat, time} to represent the jth radar point, which indicates that the longitude and latitude of the radar point at PR j .time are PR j .lon and PR j .lat.
AIS points and radar points can be displayed in figure according to their latitude and longitude. For example, in Figure 1a, the red points represent AIS points and the blue points represent radar points. In Figure 1, the horizontal axis represents longitude, and the vertical axis represents latitude. The units of longitude and latitude are degrees. The X and Y values of each red point represent the longitude and latitude of a certain ship at a certain moment provided by AIS device, respectively, and the X value and Y value of each blue point represent the longitude and latitude of a certain target (in most cases the target is a ship), respectively, at a certain moment provided by radar. Figure 1a shows latitudes and longitudes of targets provided by AIS and radar in a certain spatiotemporal range. Among them, the longitude range is [109.4600, 109.4848], the latitude range is [18.1770, 18.1917

Generation of AIS Trajectory and Radar Trajectory
These spatiotemporal data provided by AIS and radar can be combined in time series to generate trajectories. The generation of AIS trajectory is mainly based on MMSI and the time difference between adjacent AIS points. In this paper, the pth AIS trajectory is represented by TRA p , TRA p = {PA p(0) , PA p(1) , . . . , PA p(l) , . . . , PA p(m−1) }. PA p(l) is the (l + 1)th AIS trajectory point in TRA p . PA p(0) .MMSI = PA p (1) .MMSI = . . . = PA p(l) .MMSI = . . . = PA p(m−1) .MMSI, and for any 0 ≤ k < l < m, there is PA p(k) .time < PA p(l) .time. That is, the trajectory points in the AIS trajectory all belong to the same ship, and the trajectory points are ordered in time.
The generation of radar trajectory is mainly based on the distance and time difference between adjacent radar points. Similarly, in this paper, the qth radar trajectory is represented by TRR q , TRR q = {PR q(0) , PR q(1) , . . . , PR q(t) , . . . , PR q(n−1) }. PR q(t) is the (t + 1)th radar trajectory point in TRR q . For any 0 ≤ s < t < n, there is PR q(s) .time < PR q(t) .time. That is, the trajectory points in the radar trajectory are ordered in time. These two trajectory generation algorithms can be found in [20]. After trajectory generation, each trajectory is given a unique identifier, which is called the trajectory ID.
Because the sampling interval of the radar is short and the performance of the radar is easily affected by weather and other factors, there are many inaccurate radar points, which will cause the "sawtooth" phenomenon of radar trajectory and affect the further analysis of radar trajectory. Therefore, the radar trajectory needs to be smoothed. During the smoothing process, every five points in the radar trajectory are merged into a new radar point, each attribute value of this new radar point is the average of the corresponding attribute values of the five points. Specifically, for a radar trajectory TRR q = {PR q(0) , PR q(1) , . . . , PR q(t) , . . . , PR q(n−1) }, the smoothed trajectory is represented by TRR q_smooth , TRR q_smooth = {PR q_smooth(0) , PR q_smooth(1) , . . . , PR q_smooth(t) , . . . , PR q_smooth( n/5 −1) }, . In Figure 1b, the red lines are the AIS trajectories generated by the AIS points in Figure 1a, and the blue lines are the smoothed radar trajectories generated by the radar points in Figure 1a.

AIS Closing Behavior and MMSI Spoofing Behavior
As stated in the introduction, AIS is a self-reporting system. When a ship is involved in illegal activities, to avoid supervision, the crew may close the AIS transponder or tamper with the ship's MMSI in the AIS data. Examples of AIS closing behavior and MMSI spoofing behavior are shown in Figure 2.    Figure 2b shows the AIS closing behavior during navigation. After the AIS device of the ship is closed, the AIS receiver cannot receive the data transmitted by the ship, the AIS trajectory is interrupted, as shown by AIS trajectory 0 in Figure 2b, the radar can still detect the ship that is sailing, and the radar trajectory continues to be generated, as shown by radar trajectory 0 in Figure 2b. Figure 2c shows the MMSI spoofing behavior during navigation. As the ship's MMSI has been changed, two AIS trajectories are generated during the ship's navigation, as shown by AIS trajectory 0 and AIS trajectory 1 in Figure 2c, the MMSI spoofing behavior has no effect on the radar, the trajectory detected by the radar is still the actual trajectory of the ship, as shown by radar trajectory 0 in Figure 2c. Through the analysis of AIS closing behavior and MMSI spoofing behavior, we find that it is difficult to detect the above two behaviors only by using AIS data; however, this problem can be solved by comparing radar trajectory with the associated AIS trajectory.

AIS Closing Detection Algorithm
When a ship closes its AIS device, its AIS trajectory will be interrupted, and the range of the AIS trajectory will be smaller than the range of the ship's real trajectory. Therefore, the AIS closing behavior can be detected by comparing the AIS trajectory range with the ship's real trajectory range. The formula of trajectory range is as follows.
In the formula, the longitude and latitude of maxPoint are the maximum longitude and maximum latitude in the trajectory, and the longitude and latitude of minPoint are the minimum longitude and minimum latitude in the trajectory. Distance refers to the distance between two points expressed in latitude and longitude.
If the radar can detect the ship before and after the AIS device is closed, the radar trajectory can be considered to some extent as real trajectory. Therefore, it is feasible to detect the AIS closing behavior by comparing the AIS trajectory with the radar trajectory. Because there are many ships in a certain sea area, many radar trajectories and AIS trajectories will be generated. Therefore, the difficulty of the research is determining the radar trajectory and the AIS trajectory generated by the same ship at the same time period, that is, to determine the associated relationship between the radar trajectory and the AIS trajectory. When the ship has AIS closing behavior, the AIS trajectory is changed, and the radar trajectory is not affected. Therefore, the radar trajectory is used as a reference when determining the associated relationship. Algorithm 1 is the pseudocode of the AIS closing detection algorithm.
When looking for the associated trajectory of the radar trajectory, first, the radar trajectory is traversed to find the associated AIS point for each radar point. Due to the large number of AIS points, the search scope needs to be reduced, in this process, the start time and end time of the radar trajectory need to be acquired, which is represented by startTime and endTime, respectively, AIS points with timestamps between (startTime − timeInterval) and (endTime + timeInterval) are considered candidate AIS points, timeInterval is the set time interval (line 1, and line 2 in Algorithm 1). When judging whether two trajectory points are associated points, in addition to considering the distance between them, the directions of the two corresponding trajectories at the two points should also be considered. For example, as shown in Figure 3, take R_Point 2 in the radar trajectory as an example, if only the distance between the trajectory points is considered, A0_Point 1 in trajectory AIS0 should be the associated AIS point of R_Point 2. However, the direction of trajectory AIS0 at A0_Point 1 is significantly different from the direction of the radar trajectory at R_Point 2, the two points are not generated by the same ship. Therefore, when looking for associated AIS point, the directions of trajectories at trajectory points should be considered. To avoid the influence of detection error, the Direction of a TRajectory At a certain Point (D-TRAP) is defined as the direction of the vector from the first point successfully associated in the trajectory to the certain point. When determining whether the trajectory point P compare is the associated point of point P in trajectory TR, the D-TRAP of TR at P needs to be computed, and the formula can be expressed as D − TRAP(TR, P, P compare ) = Angle(the unit north vector clockwise rotation −→ P f irst_compare P). In the paper, D-TRAP is computed when determining whether two trajectory points are associated, that is, D-TRAP occurs in pairs. To improve the accuracy, when computing the D-TRAP value of trajectory TR at point P, in addition to TR and P, the point P compare to be compared with P also needs to be considered. According to P compare , the trajectory TR compare to which it belongs can be obtained, P f irst_compare is the first point associated with TR compare in TR, the angle of clockwise rotation from the north direction to the vector P f irst_compare P is the D-TRAP value of TR at P when compared with P compare . For example, in Figure 3, the associated point of R_Point 0 is A1_Point 0, and the associated point of R_Point 1 is A0_Point 0. Next, the associated point of R_Point 2 needs to be found. When judging whether A0_Point 1 is its associated point, first the direction of trajectory AIS0 at A0_Point 1 needs to be computed, the first point associated with the radar trajectory in trajectory AIS0 is A0_Point 0, the direction of the vector from A0_Point 0 to A0_Point 1 is the direction of trajectory AIS0 at A0_Point 1, this direction is represented by the angle of clockwise rotation from the north direction to the vector, as indicated by angle A in Figure 3. Then, the direction of the radar trajectory at R_Point 2 at this time needs to be computed, as A0_Point 1 to be judged belongs to trajectory AIS0, and the first point associated with trajectory AIS0 in the radar trajectory is R_Point 1, the direction of the vector from R_Point 1 to R_Point 2 is the direction of the radar trajectory at R_Point 2 at this time, as indicated by angle B in Figure 3, angle A and angle B are significantly different, so A0_Point 1 is not the associated point of R_Point 2.

Radar trajectory
At this time, the next candidate point A1_Point 2 is judged whether it is the associated point of R_Point 2. Similarly, the direction of trajectory AIS1 at A1_Point 2 needs to be computed, the first point associated with the radar trajectory in trajectory AIS1 is A1_Point 0, the direction of the vector from A1_Point 0 to A1_Point 2 is the desired direction, as indicated by angle D in Figure 3. Then, the direction of the radar trajectory at R_Point 2 at this time needs to be computed, as A1_Point 2 to be judged belongs to trajectory AIS1, and the first point associated with trajectory AIS1 in the radar trajectory is R_Point 0, the direction of the vector from R_Point 0 to R_Point 2 is the desired direction, as indicated by angle C in Figure 3, angle C and angle D are basically equal, and the distance between A1_Point 2 and R_Point 2 is the smallest, therefore, A1_Point 2 is the associated point of R_Point 2.
According to the above process, as the AIS points to be judged belong to different AIS trajectories, and the first radar point associated with the different AIS trajectories may not be the same, the direction of the radar trajectory at the same point may change with the different AIS points to be judged; this also applies to the direction of the AIS trajectory at the same point.
In line 3 with algorithm 1, the primary key of associatedMap is the AIS trajectory ID, and the value is the number of associated AIS points from the corresponding AIS trajectory. The primary key of associatedRadarMap is the AIS trajectory ID, the value is the sequence of radar points associated with the corresponding AIS trajectory, associatedRadarMap is mainly used to compute the direction of the radar trajectory at a certain radar point. The primary key of associatedAISMap is the AIS trajectory ID, and the value is the sequence of AIS points associated with the radar trajectory in the corresponding AIS trajectory, associatedAISMap is mainly used to compute the direction of the AIS trajectory at a certain AIS point.
After defining the D-TRAP, the associated AIS point of each point in the radar trajectory can be found in the candidate AIS points. For each radar point, when determining whether a candidate AIS point is its associated point, first, the AIS trajectory to which the candidate AIS point belongs is recorded, and this AIS trajectory is called belonging AIS trajectory. Then, the first point associated with the radar trajectory in the belonging AIS trajectory and the first point associated with the belonging AIS trajectory in the radar trajectory are obtained. Next, the direction of the belonging AIS trajectory at the candidate AIS point and the direction of the radar trajectory at the current radar point are computed, if the difference is small enough, that is, the two directions are basically the same, the distance between the candidate AIS point and the current radar point is computed. If the distance is the shortest distance and meets the set threshold, the candidate AIS point is regarded as the associated AIS point of the current radar point, and update associatedMap, associatedRadarMap, associatedAISMap (lines 4-12 in Algorithm 1).
When all associated AIS points of the radar trajectory have been found, associatedMap is sorted by value from big to small, and the AIS trajectory with the largest number of associated AIS points is used as the primary associated trajectory of the radar trajectory (line 13 and line 14 in Algorithm 1). At this time, the timestamp of the earliest AIS point associated with the radar trajectory in the primary associated trajectory is obtained, and the range of the primary associated trajectory after the timestamp is computed, and the result is used as the AIS trajectory range of the ship. Similarly, the timestamp of the earliest radar point associated with the primary associated AIS trajectory in the radar trajectory is obtained, the range of the radar trajectory after the timestamp is computed, and the result is used as the radar trajectory range of the ship (lines 15-18 in Algorithm 1). If the ratio of the AIS trajectory range to the radar trajectory range is less than threshold, it means that the AIS trajectory is interrupted and the corresponding ship has AIS closing behavior (lines 19-21 in Algorithm 1).

Algorithm 1 AIS closing detection algorithm.
Input: Radar Trajectory, RT; Parameter when searching for candidate AIS points, timeInterval; threshold to determine whether AIS closing behavior occurs, threshold. Output: AIS trajectory ID with AIS closing behavior. 1

MMSI Spoofing Detection Algorithm
As the generation of the AIS trajectory is based on the MMSI number, if the ship changes the MMSI number in the AIS data during navigation, two different AIS trajectories will be generated before and after the MMSI spoofing, and the two AIS trajectories do not overlap in time, so the MMSI spoofing detection algorithm can be designed based on these features. The pseudocode of the algorithm is shown in Algorithm 2. end if 12: end for 13: Sort associatedMap by value from big to small. 14: priAISTrId ← getPriKey(associatedMap) 15: for each AIS trajectory ID AISTrId in the sorted associatedMap do 16: if isIndependent(AISTrId, priAISTrId) then 17: if trajectory AISTrId is earlier than trajectory priAISTrId then 18: be f oreAISId ← AISTrId; In the MMSI spoofing detection algorithm, it is also necessary to find the associated AIS point of each point in the radar trajectory, all associated AIS points are counted according to their belonging AIS trajectories, and these associated AIS trajectories are sorted according to the number of associated AIS points. The AIS trajectory with the largest number of associated AIS points is used as the primary associated trajectory of the radar trajectory, these steps are the same as the corresponding part in the AIS closing detection algorithm (lines 1-14 in Algorithm 2). After obtaining the primary associated AIS trajectory, the AIS trajectory that is independent of the primary associated AIS trajectory in time needs to be found from the associated AIS trajectories, and this AIS trajectory is named the independent AIS trajectory. If the independent AIS trajectory exists, the chronological order of the independent AIS trajectory and the primary associated AIS trajectory need to be determined, the earlier trajectory is recorded as be f oreAISId, and the later trajectory is recorded as a f terAISId (lines 15-26 in Algorithm 2). Then, it is determined whether trajectory be f oreAISId has AIS closing behavior, and this process is consistent with the corresponding part in the AIS closing detection algorithm. If the trajectory has AIS closing behavior, it means that trajectory be f oreAISId is interrupted, and the corresponding radar trajectory is still continuing. It is known that trajectory a f terAISId appears after the end of trajectory be f oreAISId, and trajectory a f terAISId is also the associated trajectory of the radar trajectory. At this time, it can be judged that the corresponding ship has MMSI spoofing behavior, trajectory be f oreAISId is the trajectory generated before MMSI spoofing, and trajectory a f terAISId is the trajectory generated after MMSI spoofing (lines 27-35 in Algorithm 2).

Dataset
The experiment mainly uses two datasets. The first dataset is real AIS data and real radar data. The second data set is real AIS data, and radar data generated based on these AIS data.

Real AIS Data and Real Radar Data
Real AIS data and real radar data were collected in the sea area near Sanya, China from 4 January 2017 to 6 January 2017. These data were collected by inverse synthetic aperture radar and land-based AIS receiver built on land. The inverse synthetic aperture radar can actively obtain the position, radial speed, and other data of moving targets. The land-based AIS receiver can accept AIS data sent by AIS devices on ships. In this dataset, there are 412,786 AIS points and 95,823 radar points. The area where the data is collected is shown by the red rectangle in Figure 4a. Its longitude range is [108.9689, 110.3278] and latitude range is [17.7792, 18.3998].
Based on these points, a total of 1113 AIS trajectories and 794 radar trajectories are generated. According to the definition of trajectory range in Chapter 3, the average range of AIS trajectories is 8594 meters and the average range of radar trajectories is 1754 meters. Histograms of the radar trajectory range and the AIS trajectory range are shown in Figure 4b and Figure 4c, respectively. From the two histograms, it can be seen that the ranges of most radar trajectories are within 5000 meters, and the ranges of most AIS trajectories are within 20,000 meters. The ranges of the radar trajectories are generally smaller than the ranges of the AIS trajectories, which is caused by the insufficient detection capability of the radar used in the experiment.

Real AIS Data and Simulated Radar Data
During the data collection process, due to the limitation of radar detection capability, the amount of effective radar data obtained is small. Therefore, to further verify the effectiveness of the algorithms proposed in this paper, in addition to the real radar data, some radar data are also generated through a radar simulation program based on real AIS data. The radar simulation program simulates the working process of the radar. In the simulation program, the minimum scanning angle of the radar is 61.7, the maximum scanning angle is 307.6, and the radar scans 5 degrees per second. When scanning to the boundary, the scanning direction is changed. The specific steps are as follows.
(1) The current time is represented by currentTime, and the current angle of the radar is represented by currentDegree.
(2) The AIS data are organized into trajectories, for each AIS trajectory, a new AIS point is generated based on the two points of the trajectory before and after the current time. Each attribute of the new AIS point is a weighted sum of the corresponding attributes of the two points, and the weight of the point closer to the current time is greater.
(3) The angle between the new AIS point and the radar is computed. If the difference between the angle and currentDegree is less than the set threshold, a radar point is generated based on the new AIS point, the position of the radar point is the position of the new AIS point plus random noise. The distance between the radar and the radar point is computed, if the distance is within the radar scanning range, it means that the generated radar point meets the requirements and saves it.
(4) currentTime and currentDegree are updated. Continue (1)-(4) until the currentTime is greater than the set threshold or the timestamps of all AIS trajectory points.
These AIS data used to generate radar data were collected in the sea area near Sanya, China from 1 January 2017 to 3 January 2017. Through the radar simulation program, a total of 25,225 effective radar points were generated.

Evaluation of Algorithms
In the experiment, F1 score is used to evaluate the AIS closing detection and MMSI spoofing detection algorithms. The formula of F1 score is as follows.
Among them, P is precision, P = TP TP+FP , R is recall, and R = TP TP+FN . It can be seen from the formula that the F1 score takes precision and recall into consideration, which can evaluate the algorithms more comprehensively.
In the evaluation of the AIS closing detection algorithm, TP indicates that the AIS trajectory generated by the ship that close the AIS transponder is detected to have AIS closing behavior, FP indicates that the AIS trajectory generated by the ship that do not close the AIS transponder is detected to have AIS closing behavior, and FN indicates that the AIS trajectory generated by the ship that close the AIS transponder is not detected to have AIS closing behavior. In the specific use process, it is known that the number of trajectories with AIS closing behavior is N_close. Assuming that the number of trajectories with AIS closing behavior detected by the AIS closing detection algorithm is D_close, and the number of correctly detected trajectories is C_close, TP = C_close, FP = D_close − C_close, FN = N_close − C_close.
In the MMSI spoofing detection algorithm, the correct detection of MMSI spoofing mainly includes two parts, one is that the MMSI spoofing behavior is found, and the other is that the trajectory ID after MMSI spoofing is correctly detected. In the evaluation of the MMSI spoofing detection algorithm, TP indicates that the AIS trajectory with MMSI spoofing is detected correctly, FP indicates that the detected MMSI spoofing behavior does not conform to the real MMSI spoofing behavior, and FN indicates that the AIS trajectory with MMSI spoofing is not detected correctly. In the specific use process, it is known that the number of trajectories with MMSI spoofing behavior is N_spoo f .
Assuming that the number of trajectories with MMSI spoofing behavior detected by the MMSI spoofing detection algorithm is D_spoo f , and the number of correctly detected trajectories is C_spoo f . Similarly,

Simulation of AIS Closing Behavior
In the experiment, AIS closing behavior should be simulated. Due to the limitation of radar detection capability, on the one hand, the AIS trajectory often lasts for a period of time before it is associated with the radar trajectory, as the lack of associated relationship, the trajectories before association are meaningless to our research, therefore, only the trajectories after association are studied, as shown in Figure 5; on the other hand, when the ship is sailing normally, the range of the primary associated AIS trajectory after association is larger than the range of the radar trajectory after association, that is, there is no AIS closing behavior. Therefore, to simulate the AIS closing behavior, the primary associated AIS trajectory needs to be truncated, that is, the ship closes the AIS device at the truncation time of the AIS trajectory. Truncation ratio is expressed by tr_ratio, tr_ratio = AIS_range radar_range , among them, radar_range is the range of the radar trajectory after association and AIS_range is the range of the AIS trajectory between association and the truncation time, as shown in Figure 5. The AIS trajectory points after truncation time are deleted, so that the AIS closing behavior is simulated, and by changing the value of tr_ratio, the behavior of the ship closing the AIS device at different times can be simulated. The simulation steps are as follows. (1) A new AIS trajectory named temp_AISTra is created. The points of the AIS trajectory are added to temp_AISTra in order starting from the earliest AIS point associated with the radar trajectory.
(2) The range of temp_AISTra is computed, and the result is represented by ais_range. If ais_range < tr_ratio * radar_range, new AIS point needs to be added to temp_AISTra, and if ais_range ≥ tr_ratio * radar_range, the newly added AIS point need to be deleted from temp_AISTra.
(3) The timestamp of the last point in temp_AISTra is obtained, and the timestamp is represented by lastPtTime.
(4) Points in the AIS trajectory that are later than lastPtTime are deleted, that is, the ship generating the AIS trajectory closed the AIS device at lastPtTime.
Through the above steps, the AIS closing behavior can be simulated. At this time, the range of the truncated AIS trajectory is less than tr_ratio * radar_range, and it is the AIS trajectory with the largest range under this condition.
If the threshold for detecting AIS closing behavior is set to a value greater than or equal to tr_ratio (in this experiment, the threshold is set equal to tr_ratio), the simulated AIS closing behavior can be detected according to Algorithm 1. In this experiment, we set tr_ratio to 95%, 90%, 85%, 80%, 75%, 70%, 65%, 60%, 55%, 50%, 45%, 40%, 35%, 30%, 25%, 20%, 15%, 10%, and 5%, respectively, to evaluate the performance of AIS closing detection algorithm under different truncation ratios. The effect of simulating AIS closing behavior is shown in Figure 6, the blue lines are radar trajectories, and the red lines are AIS trajectories, for the convenience of explanation, the trajectories in Figure 6 are the trajectories that can be effectively associated. Figure 6a shows the AIS trajectories and radar trajectories of ships during normal navigation. Figure 6b shows the AIS trajectories and radar trajectories when tr_ratio is 80%. At this time, the range of the AIS trajectory is less than 80% of the range of the corresponding radar trajectory, that is, the ship turns off the AIS device when the range of the AIS trajectory is about to reach 80% of the range of the corresponding radar trajectory. Figure 6c shows the AIS trajectories and radar trajectories when tr_ratio is 40%. The figures of other truncation ratios are not listed here.

Experimental Results
In the AIS closing detection experiment, the two datasets mentioned above are used, the first dataset contains real AIS data and real radar data, among them, 50 AIS trajectories that can be identified as the primary associated AIS trajectories are used for the experiment, and the second dataset contains real AIS data and simulated radar data, among them, 100 AIS trajectories that can be identified as the primary associated AIS trajectories are used for the experiment. First, the primary associated AIS trajectory is truncated according to different ratios, that is, the behavior of the ship closing AIS device at different times is simulated, and then the performance of the AIS closing detection algorithm at different truncation ratios is tested. The experimental results are shown in Table 1; the numbers without brackets are the test results of the first dataset, and the numbers with brackets are the test results of the second dataset.
The trend of F1 scores of the AIS closing detection algorithm under different truncation ratios is shown in Figure 7. Among them, the horizontal axis represents the truncation ratio and the vertical axis represents the F1 score. The blue line is the trend of the F1 scores of the algorithm in the first dataset, and the red line is the trend of the F1 scores of the algorithm in the second dataset.

Result Analysis
As can be seen from Table 1 and Figure 7, when tr_ratio ≥ 55%, the F1 scores of the AIS closing detection algorithm are all greater than 0.8, the algorithm has good performance. The F1 score of the algorithm decreases as tr_ratio decreases. This is because if tr_ratio is small, that is, the range of the remaining AIS trajectory is small, which means that the AIS device of the ship is closed prematurely, and the number of corresponding AIS points will also be small. This may result in the AIS trajectory not being recognized as the primary associated trajectory, and it is impossible to detect whether the ship generating the AIS trajectory has AIS closing behavior. Therefore, when using this algorithm to detect the AIS closing behavior, the range of the AIS trajectory after association cannot be too small, that is, the process of the ship being monitored by the radar and AIS at the same time should last for a period of time.

Simulation of MMSI Spoofing Behavior
In the experiment, MMSI spoofing behavior should also be simulated. AIS points with different MMSI numbers will generate different AIS trajectories: the AIS trajectories generated before and after MMSI spoofing are different. Therefore, the primary associated AIS trajectory can be truncated into two parts to simulate the MMSI spoofing behavior, the trajectory ID in the first half is unchanged, and the trajectory ID in the second half is changed to a new trajectory ID, that is, the ship has MMSI spoofing behavior at the truncation time of the AIS trajectory, the second half of the trajectory is the trajectory generated by AIS points after MMSI spoofing.
The steps for simulating MMSI spoofing behavior are similar to the steps for simulating AIS closing behavior, except that the last step is different. In the simulation program, instead of deleting the points in the AIS trajectory later than lastPtTime, the trajectory ID to which these trajectory points belong is updated to a new trajectory ID, In other words, the ship performed MMSI spoofing at lastPtTime, and the AIS points after lastPtTime generated a new AIS trajectory. Similarly, in this experiment, we also set tr_ratio to 95%, 90%, 85%, 80%, 75%, 70%, 65%, 60%, 55%, 50%, 45%, 40%, 35%, 30%, 25%, 20%, 15%, 10%, and 5%, respectively, to simulate the MMSI spoofing behavior of the ship at different times. The effect of simulating MMSI spoofing behavior is shown in Figure 8, the blue lines are radar trajectories, the red lines are the AIS trajectories before MMSI spoofing, and the black lines are the AIS trajectories after MMSI spoofing, for the convenience of explanation, the trajectories in Figure 8 are the trajectories that can be effectively associated. Figure 8a shows the AIS trajectories and radar trajectories of ships during normal navigation. Figure 8b shows the radar trajectories and the AIS trajectories before and after MMSI spoofing when tr_ratio is 80%. At this time, the range of the AIS trajectory before MMSI spoofing is less than 80% of the range of the corresponding radar trajectory, that is, the ship performs the MMSI spoofing behavior when the range of the AIS trajectory is about to reach 80% of the range of the corresponding radar trajectory, and a new AIS trajectory is generated based on the AIS points after MMSI spoofing. Figure 8c shows the radar trajectories and the AIS trajectories before and after MMSI spoofing when tr_ratio is 40%. The figures of other truncation ratios are not listed here.

Experimental Results
In the experiment, the two datasets mentioned above are also used. First, the primary associated AIS trajectory is truncated according to different ratios, and the trajectory ID in the second half is changed to a new trajectory ID, that is, the MMSI spoofing behavior of the ship at different times is simulated. Then, the performance of the MMSI spoofing detection algorithm at different truncation ratios is tested. The experimental results are shown in Table 2; the numbers without brackets are the test results of the first dataset, and the numbers with brackets are the test results of the second dataset. The trend of F1 scores of the MMSI spoofing detection algorithm under different truncation ratios is shown in Figure 9. Among them, the horizontal axis represents the truncation ratio, the vertical axis represents the F1 score. The blue line is the trend of the F1 scores of the algorithm in the first dataset, the red line is the trend of the F1 scores of the algorithm in the second dataset. 95% 90% 85% 80% 75% 70% 65% 60% 55% 50% 45% 40% 35% 30% 25% 20% 15% 10% 5%

Result Analysis
As can be seen from Table 2 and Figure 9, in the first dataset containing real AIS data and real radar data, when tr_ratio is between 65% and 25%, the F1 scores are all greater than 0.8, and the algorithm has good performance. When tr_ratio is greater than 65%, the F1 score of the algorithm decreases as tr_ratio increases, and when tr_ratio is less than 25%, the F1 score decreases as tr_ratio decreases. In the second dataset containing real AIS data and simulated radar data, the F1 score of the algorithm has a similar trend. This is because when tr_ratio is small, the range of the AIS trajectory before MMSI spoofing that can be associated with the radar trajectory is small, and the number of corresponding AIS points is also small. When looking for associated AIS points of the radar trajectory, due to the influence of noise and AIS points of other ships, these AIS points may not be considered as the associated points, and the AIS trajectory generated before MMSI spoofing is not considered as the associated trajectory. This will result in the inability to find two AIS trajectories that are independent in time, and thus the MMSI spoofing behavior cannot be detected. Similarly, when tr_ratio is large, the range of the AIS trajectory after MMSI spoofing that can be associated with the radar trajectory is small, and the corresponding number of AIS points is also small, and therefore the AIS trajectory generated after MMSI spoofing may not be considered as the associated trajectory, and the MMSI spoofing behavior cannot be detected. Therefore, when detecting MMSI spoofing behavior, the ship needs to be monitored by AIS and radar at the same time before and after MMSI spoofing, and both monitoring processes need to continue for a period of time.

Discussion on the Impact of AIS Packet Loss on the Algorithm
During the transmission of AIS data packets from the AIS device on the ship to the land-based AIS receiver, packet loss may occur. To test the impact of AIS packet loss on the algorithms, we delete each trajectory point in the AIS trajectory with a probability of p_loss, so as to simulate the situation where the packet loss rate increases p_loss, p_loss is set to 5%, 10%, 15%, 20%, and 25%, respectively. As the internal mechanism of the AIS closing detection algorithm and the MMSI spoofing detection algorithm are the same, the AIS closing detection algorithm is used as an example to test the performance of the algorithm under different packet loss probabilities. In the experiment, the first dataset containing real radar data and AIS data is used. When simulating AIS closing behavior, tr_ratio is set to 80%, 60%, 40%, and 20%, respectively. Similarly, the F1 score is used to evaluate the performance of the algorithm. The experimental results are shown in Table 3. It can be known from Table 3 that when p_loss ≤ 15%, the F1 scores of the algorithm under each tr_ratio drop by 0.06 at most, that is, when the packet loss rate of the AIS data increases within 15%, the performance of the algorithm is relatively stable and has a certain anti-interference ability.

Discussion
This research focuses on the detection of AIS closing and MMSI spoofing during ship navigation. Before designing the corresponding algorithms, the associated relationship between AIS data and radar data needs to be determined. In the multi-ship scenario, this problem is difficult to solve, and when the ship has AIS closing behavior and MMSI spoofing behavior, the corresponding AIS data volume will be reduced, which makes the problem more difficult. Therefore, we introduce the concept of the D-TRAP. According to the aforementioned, this will improve the association accuracy between points, and accordingly, the association accuracy between radar trajectories and their primary associated AIS trajectories will also increase.
Here, we prove it experimentally. The experiment use 175 radar trajectories generated from simulated radar points, and three methods are used to find their associated AIS trajectories. The first two methods are to achieve trajectory association by finding associated AIS points of radar trajectory points, among them, the first is the method proposed in the paper (distance +D-TRAP), and the second is the method based only on distance (only distance). The third is the traditional trajectory association method by computing the distance between trajectories (trajectory-to-trajectory). The simulated radar points are generated based on the AIS points, the associated relationship between them is determined, and therefore the associated results can be measured.
In the experiment, we first obtain AIS trajectories corresponding to these 175 radar trajectories, and then truncate these AIS trajectories according to different ratios, so as to test the associated results of the three methods under different AIS data volumes. When truncating AIS trajectories, we define the truncation ratio as tr_ratio = AISLe f t_Range/AIS_Range, where AIS_Range is the range of the original AIS trajectory, and AISLe f t_Range is the AIS trajectory range after truncation. In the experiment, we set tr_ratio to 100%, 80%, 60%, 40%, and 20%, respectively. In the experiment, F1 score is used to evaluate the three trajectory association algorithms, among them, TP is the number of radar trajectories correctly associated, FP is the number of radar trajectories with incorrect association, and FN is the total number of radar trajectories minus TP. The experimental results are shown in Table 4. According to Table 4, the F1 scores of the method proposed in this paper are all greater than or equal to the F1 scores of the method based only on distance, which shows that with the help of D-TRAP, the accuracy of the association between trajectory points can be improved. When the amount of AIS data is reduced (20% ≤ tr_ratio ≤ 80%), the proposed method has better performance than traditional trajectory association method, which shows that the proposed method has stronger robustness for reduction of effective AIS data. When a ship has AIS closing behavior and MMSI spoofing behavior, the number of corresponding AIS points will decrease. Therefore, it is necessary to use the method proposed in the paper when determining the associated relationship between trajectories.
Based on real data and simulation data, this research simulates the AIS closing behavior and MMSI spoofing behavior of ships at different times, and tests these two algorithms. The test results show that the AIS closing detection algorithm has good performance when the ship does not close the AIS device prematurely; when the ship does not perform the MMSI spoofing behavior too early or too late, the MMSI spoofing detection algorithm has good performance. The test results are consistent with the actual situation. When the ship closes the AIS device prematurely, the amount of AIS data of the ship is small, which will result in the failure to form an AIS trajectory, or it is difficult to obtain the associated relationship between the AIS trajectory and the radar trajectory. At this time, only the radar trajectory can be observed, the ship to which the radar trajectory belongs cannot be determined, and the AIS closing behavior of the ship cannot be detected. When the ship performs MMSI spoofing behavior prematurely, the number of AIS points of the ship before the MMSI spoofing is small, which may also lead to the failure to form an AIS trajectory, or the associated relationship between the AIS trajectory before MMSI spoofing and the radar trajectory is difficult to obtain. At this time, only the AIS trajectory after the MMSI spoofing and the corresponding radar trajectory can be associated, and the MMSI spoofing behavior of the ship cannot be detected. Similarly, when the ship performs MMSI spoofing behavior too late, only the AIS trajectory before the MMSI spoofing and the corresponding radar trajectory can be associated, which will also cause the MMSI spoofing behavior of the ship to be undetectable. Therefore, in the following research, when looking for the associated AIS points of radar points, the accuracy of the association can be improved by comparing other attributes of trajectory points, such as speed in trajectory point, so that the application range of the AIS closing detection algorithm and the MMSI spoofing detection algorithm can be expanded.
The research in this paper can be applied to the ship data service system of the maritime authority. The maritime authority can establish radar, AIS receiver, and other data acquisition devices to obtain multisensor data of ships within its jurisdiction. At this stage, the multisensor data in most ship data service systems is often isolated, and the systems do not take full advantage of the multisensor data to achieve functions that cannot be achieved by using single-sensor data. This paper mainly uses the radar data and AIS data of ships to detect AIS closing behavior and MMSI spoofing behavior through D-TRAP and related algorithms, and these two types of illegal behaviors are difficult to detect through single-sensor data.

Conclusions
This research focuses on the detection of AIS closing and MMSI spoofing in multi-ship scenario. In this research, the associated relationship between the radar trajectory and the AIS trajectory is determined based on the distance between trajectory points and the directions of trajectories at trajectory points, and the AIS closing detection algorithm and the MMSI spoofing detection algorithm are designed by establishing the associated AIS trajectory map of radar trajectory. This study simulates AIS closing behavior and MMSI spoofing behavior based on real and simulated data, and tests the two algorithms. The test results show that the algorithms proposed in this paper can detect AIS closing behavior and MMSI spoofing behavior under certain conditions.
In AIS spoofing, in addition to MMSI spoofing, there is also position spoofing, but in the multi-ship scenario, the AIS points after position spoofing will affect the determination of the associated relationship between the radar trajectory and the AIS trajectory. Therefore, in future research, to detect the position spoofing behavior in the multi-ship scenario, first, the trajectory can be partitioned into trajectory segments, and then the trajectory segment with a small range can be used as a reference to further determine the associated relationship between trajectories.