Anomaly Detection in Maritime AIS Tracks: A Review of Recent Approaches

: The automatic identiﬁcation system (AIS) was introduced in the maritime domain to increase the safety of sea trafﬁc. AIS messages are transmitted as broadcasts to nearby ships and contain, among others, information about the identiﬁcation, position, speed, and course of the sending vessels. AIS can thus serve as a tool to avoid collisions and increase onboard situational awareness. In recent years, AIS has been utilized in more and more applications since it enables worldwide surveillance of virtually any larger vessel and has the potential to greatly support vessel trafﬁc services and collision risk assessment. Anomalies in AIS tracks can indicate events that are relevant in terms of safety and also security. With a plethora of accessible AIS data nowadays, there is a growing need for the automatic detection of anomalous AIS data. In this paper, we survey 44 research articles on anomaly detection of maritime AIS tracks. We identify the tackled AIS anomaly types, assess their potential use cases, and closely examine the landscape of recent AIS anomaly research as well as their limitations.


Introduction
Freight transport via sea is one of the major backbones of our highly connected global economy today. Global demand for freight transportation is expected to more than double by 2050, with over 70% of goods shipped by sea [1]. In addition to commercial transport vessels, the world's oceans are traveled by a wide range of other ships, such as passenger ships, ferries, fishing vessels, or recreational crafts. Therefore, ensuring the safety and security of diverse maritime traffic is necessary for the continued functioning of the increasingly globalized market economy and the well-being of passengers and marine ecosystems.
To augment safety and security at seas, the International Maritime Organization (IMO) designed the Automatic identification system (AIS) [2] in the 1990s, providing a complementary system to high-frequency radar. Ships equipped with AIS transceivers broadcast their positions derived from the Global navigation satellite system (GNSS) periodically to vessels and authorities in their vicinity. While neighboring vessels may utilize positional data for collision avoidance, on-shore Vessel traffic services (VTSs) leverage AIS for traffic planning and guidance. According to the SOLAS (Safety of life at sea) agreement from 2002 [3,4], it is mandatory for ships above a certain size to be equipped with AIS. Together with this agreement, the use of satellite-mounted AIS receivers for increased reception coverage led to an abundance of AIS data today [5]. Thus, AIS has become a valuable system for maritime collision risk assessment [6,7] and surveillance, such as anti-piracy operations or the prevention of illegal fishing [8].
With over 1,490,776 ships tracked worldwide [9], a manual unveiling of suspicious ship activities is infeasible. Hence, in recent years, many different approaches for automated anomaly detection of maritime AIS tracks have been proposed [10][11][12][13][14][15]. These anomaly detectors utilize the fact that vessel traffic is to some extent predictable, especially within confined local regions, and that vessels cannot behave arbitrarily due to physical constraints or mandatory sea routes. Thus, such detectors often train a model of normal vessel traffic patterns. They mark outliers or violations as anomalies potentially indicating, e.g., accidents or criminal activities.
To provide a concise overview on this research field, existing methodologies and their applications, we review and compare recent approaches in this paper. Therefore, we first summarize the anomaly types that can be revealed by suspicious AIS activity and map these anomalies to their common use cases. Then, we present our literature survey on anomaly detection of maritime AIS track covering 44 publications. We find that most proposals focus on the detection of route deviation anomalies and are limited to a confined geographical region their models were trained on. While there are many AIS datasets and databases of real traffic freely available [14], one observation is that authors oftentimes evaluate against self-recorded, inaccessible, or private AIS samples. In particular, it is notable that there is no established dataset that also includes labeled anomalies as ground truth. Finally, we highlight emerging privacy concerns related to AIS in general and its implications for maritime AIS anomaly detection.
The paper is structured as follows: In Section 2, we provide an overview of AIS, including a brief technical background, its history, initial purpose, and today's applications. Afterward, we elaborate on the concept of anomalies in AIS tracks and provide the rationale for anomaly detection in Section 3. Section 4 presents our survey of recent research in detail. We discuss limitations and emerging privacy concerns regarding AIS in Section 5 and conclude the paper in Section 6.

Background, Regulations, and Requirements
AIS is an identification and localization system that is mainly used in the maritime domain. The development of AIS began in the early 1990s to provide an additional shipto-ship awareness system to supplement radar and visual observation [16]. AIS was designed for three primary purposes as specified by the IMO [2]: The first and foremost purpose is collision avoidance enabled by exchanging AIS messages between all vessels in a certain vicinity. These messages contain the vessels' identities, precise locations, and further relevant information to increase situational awareness and assist navigation. The second purpose is to support on-shore VTS for improved guidance and assistance through heavily trafficked areas or particularly dangerous passages, such as ports or sea routes [17]. Furthermore, traffic services can use special AIS messages to inform vessels about those areas. For this purpose, specific stationary Aids to navigation (AtoN) transceivers are used, e.g., installed on buoys. Similarly, AIS transceivers attached to survival crafts or even life jackets greatly enhance Search and rescue (SAR) operations. Finally, littoral states have the ability to identify ships and their cargo that are traveling in their territorial waters. As an amendment to the SOLAS agreement of 1974, the IMO mandated that all ships on international voyages above 300 gross tonnages must use AIS [3,4]. Many countries have specified stricter rules, such as the United States (vessels above 65 feet) or the European Union (fishing vessels above 15 m).
AIS messages are periodically broadcasted by transceivers onboard vessels and received by nearby ship-or land-based receivers. The system uses two VHF radio bands around 162 MHz and is based on Time-division multiple access (TDMA), allowing it to be used simultaneously by multiple participants [4,18,19]. In the horizontal direction, AIS has an effective communication range up to 50 km, which is limited by the geodetic visibility, i.e., the fact that communication entities will be hidden by the horizon due to the earth's curvature. The effects on the reception range are evaluated in great detail by the work of Mazzarella et al. [20]. In line-of-sight, AIS signals can however travel hundreds of kilometers [21] mostly affected by radio interference and attenuation only. This is leveraged by satellite-mounted receivers that nowadays provide Satellite-based AIS (S-AIS), enabling global monitoring and a tracking extension addressing the gaps of terrestrial AIS in ocean observations [22,23].
The actual reporting interval of AIS messages lies in the range of 2-12 s (3 min for ships at anchor) and depends on the vessel's velocity as specified in the IMO Resolution 74 (69) [2]. According to this resolution, the reporting frequencies allow for accurate tracking of positions and maneuvers by maritime authorities and other vessels. Moreover, further AIS requirements are specified: AIS electronics onboard vessels must automatically transmit information. On the other hand, they must be able to receive and process corresponding information automatically. Furthermore, high-priority and safety-related calls must be answered with a minimum delay. There should be a separate system with a user interface for displaying, accessing, and selecting information for human operators. Positional data of ships is generally obtained via one of the available GNSSs, such as GPS or Galileo [24].
While the AIS requirements in Resolution 74 (69) state that cyber security mechanisms should be implemented, it is important to note that the AIS protocol itself is not secured and publicly accessible. In particular, neither authentication, encryption, nor integrity protection is considered. Hence, AIS is highly vulnerable to a wide range of different cyber attacks [25,26], e.g., false AIS message injection [27]. Unfortunately, the privacy issues of ship crews, passengers, owners, and other associated persons are not addressed at all. This has severe consequences, which will be considered in Section 5.2.

Data Format of AIS Messages
Information announced by AIS consists of so-called static, dynamic, voyage-, and safety-related data [2]. All required information to be transmitted via AIS is shown in Table 1. Besides the call name, call sign, and general information about the ship type, the static information consists most importantly of the Maritime mobile service identity (MMSI) number. The MMSI is uniquely assigned to each vessel and serves as the primary identifier for ships in AIS [27]. Since this paper is focussed on anomaly detection of AIS tracks, the dynamic part of the AIS record is of most interest. Foremost, it includes the vessel's position (latitude and longitude), its course (COG), speed (SOG), heading (HE), and rate of turn (ROT) along with a timestamp. Voyage-related information, such as the destination port with the expected time of arrival, or in rare cases, specific information about vessels' draught or possible hazardous cargo, may be suitable for anomaly detection as well.

AIS-Based Surveillance
The use of AIS as a surveillance tool for authorities has steadily increased since its introduction, especially with the advent of satellite-based AIS that enabled an effective global tracking of vessels [5]. With the increased desire by authorities to enhance maritime security after the September 11 attacks, AIS has been recognized as a valuable tool for identifying vessels approaching coasts and ports and, thus, for preventing possible terrorist attacks [28]. Both civil and military research that focus on ship surveillance have been steadily increased with surveillance approaches developed for a wide variety of different domains [29]. They can be used, e.g., to investigate criminal activities [30], to monitor fishing activities [8], or to optimize maritime logistics and supply chains [29].

Available Datasets
By design, AIS is an entirely open protocol. Since its communication is done by radio broadcast, anyone in range can record and interpret AIS data with a suited receiver. Nowadays, AIS equipment has become steadily more affordable [27] and viable for private entities, research institutes, or companies to place AIS receivers along coastlines. Even the costs of satellite-based receivers that enable tracking of vessels around the globe have been significantly reduced and commercialized [5], which leads to a plurality of available AIS datasets. In this context, Tu et al. [14] explored different AIS data sources and assessed the data quality among different providers.
There is also a wide range of commercial providers that readily provide AIS data to paying customers via publicly available websites. Other providers can be considered non-commercial offering available data free of charge. Generally, large differences between the providers exist in terms of pricing, data availability, and data quality. According to [31], most providers generally do not fully provide all information carried via AIS (cf. Table 1). Whereas AIS's static information is never available in full detail, the available content of dynamic or voyage-related data depends on the individual provider. In addition, shipping tracks that can only be recorded by satellites, e.g., away from coasts on open oceans, may be excluded by non-commercial providers. Furthermore, data validity, such as the accuracy of ships' heading information, is severely limited for most providers. Some providers sell only live data but do not offer historical data, and vice versa. For scientific purposes, it is also possible to directly request AIS data from maritime authorities like the European Maritime Safety Authority (EMSA) [31].

AIS Anomaly Detection
In this section, we first elaborate on the possible types of anomalies in AIS tracks to classify current research in the later sections. We will then focus on applications of anomaly detection methods in the maritime domain, which aim to increase safety and security at sea.

Anomalous AIS Behaviors
The concept of anomalies in AIS tracks can be described as a behavior that is not "normal" or, more specifically, not expected to occur during regular operation [32]. For example, in the field of vessel traffic, it is expected that the velocity of ships does not change too rapidly or that they usually travel along common sea routes. The latter can be observed in visualizations of historical AIS tracks, as depicted in Figure 1. Regarding different anomaly types, Lane et al. [33] defined five general anomalous behaviors derived from AIS ship tracks. In this paper, we will use these anomaly types to classify recent research. Examples for each of the five categories are sketched in Figure 2 including (a) deviation from standard route, (b) unexpected AIS activity, (c) unexpected port arrival, (d) close approach, and (e) zone entry. Deviation from standard routecan be considered the most elementary anomaly. Ships, especially cargo or passenger ships on repetitive routes, generally take the most direct path possible between the origin and the destination during travel (cf. Figure 1), with the origin and destination usually being seaports. In open waters, a deviation from a straight route may then indicate an anomaly. In areas where landmasses or narrow sea lanes restrict traffic, ships can be expected to travel in relatively straight paths between common waypoints. At the entrance of seaports or in canals, ships should be expected to take very similar routes, particularly when guided by VTS. Unexpected AIS activity encompasses two types. The first type is AIS signal loss in areas where reception is usually adequate. Such outages may indicate intentional on-off switching of AIS equipment. Unexpected continuations of routes after an AIS outage represent the second type and might obfuscate malicious actions. Unexpected port arrival can be investigated using the voyage-related data of the AIS tracks, i.e., information about the destination port and waypoints. This anomaly could occur, for example, when an illegal fishing catch is offloaded at different ports. Long-lasting close approaches between vessels should generally be rare, except, e.g., in case of emergencies. Otherwise, they might be an indication of illegal activity such as the exchange of contraband and/or drugs. Finally, zone entry anomalies can be defined as vessels entering an area for a significant amount of time they are not expected or allowed to be in, such as marine protected areas or other exclusion zones.
One of the main drawbacks of AIS is its inherent unreliability, i.e., AIS tracks of ships often show large blank spots [20]. This may be due to unintentional technical problems, radio interference, attenuation, or actual tampering with equipment, such as intentionally turning off AIS transceivers [34]. Moreover, as mentioned before, AIS signals can be easily spoofed and manipulated by attackers or parties willing to obscure their locations [27], which has been reported in practice [35]. Even if AIS tracks are complete, the detection of vessel movements, which indicate emergencies, dangerous or illegal behaviors, is often not feasible to be performed manually because the total number of ships to consider is simply too large. For this purpose, a lot of research effort has been put into so-called automated anomaly detection, which autonomously identifies anomalous behaviors, possibly acting on the knowledge of data that represents the norm [32].

Applications of AIS-Based Anomaly Detection
Initially developed for safety purposes, the focus of AIS has shifted towards a surveillance and security tool for maritime authorities AIS [5,16,28]. In this context, anomaly detection can be an efficient tool for identifying conspicuous, dangerous, or even illegal behavior at sea across a wide range of applications that are summarized in Table 2. These use cases can be broadly categorized in monitoring criminal activities, supporting safety activities, and environmental monitoring, which we explain in the following.
A lot of anomaly detection research focuses on monitoring criminal activities, such as drug smuggling or piracy. Similar efforts are likely pursued in the military domain. For instance, AIS transceivers of Iranian-flagged tankers were tampered with to disguise the identity of the vessels in order to evade sanctions on oil exports [27]. Some of the proposed anomaly detection methods have focused on concrete activities, such as the rendezvous of ships (close approach) on the open ocean for the purpose of smuggling or drug trade [36]. Others have focused on more general anomalies, such as on-off switching of AIS transceivers [37] (unexpected activities) or route deviations [38], which are used to detect pirate attacks, for example.
The majority of anomaly detection research considered in this review confirms the use of the proposed methods with respect to safety activities. In the context of safety, AIS anomaly detection may identify zone entering, where travel is considered dangerous [39]. It can also be effectively utilized to evaluate the vessel's collision risks (close approach) [40] and, thus, supports traffic surveillance [7] and also collision risk prediction [6]. It may even be possible to decrease the coast guards' or other responders' rescue times by identifying when and where SAR missions are occurring from the anomalous AIS tracks (route deviation) of the involved vessels [41]. AIS anomaly detection can further increase the efficiency of marine traffic management and planning [42]. Deploying these methods could reduce the environmental impact and overall costs of shipping due to a lowered risk of accidents or a decreased fuel consumption. Similarly, the identification of sea routes where many close approach anomalies occur could provide engineers with insights to improve the design of canals and traffic lanes.  Figure 2. References given in the Applications column address the individual use case.

Route Deviation Unexpected
Port Arrival Close Approach Zone Entry

Applications
Monitoring criminal activities • drug trade/smuggling [27,36] • piracy [38] • cloak the vessels' identities [27] Support for safety activities • collision risks [39,40] • Search and rescue (SAR) [41] • traffic monitoring [42] Environmental monitoring • (over)fishing [8] • illegal fishing [37,43] Finally, AIS anomaly detection can be beneficial for environmental monitoring to prevent or reduce the degradation of the marine environment. The depletion of the oceans' fish populations due to overfishing poses an immense risk to a large part of humanity that relies on seafood consumption. Pauly and Zeller [44] report that catch estimates have been severely under-approximated for many years and that decreasing catch volumes already indicate the decimation of fish populations. This disruption of the fragile remaining ecosystems endangers all other marine wildlife. Data analyses of AIS tracks have already helped to map fishing efforts in Europe [8]. AIS anomaly detection could supplement existing methods, identifying illegal fishing and, thus, properly managing resources and preventing overfishing. Interesting approaches have been suggested to identify illegal fishing operations, such as the ability to detect intentional off switching of AIS on fishing boats [43]. Other risks could also be reduced and the location of potential environmental incidents identified.
In summary, AIS anomaly detection enables a variety of applications across the maritime domain. In the future, there will likely be more applications in the field of AIS that can undoubtedly increase the effectiveness of AIS data utilization.

Classification of AIS Track Anomaly Detection Approaches
With the advent of increasing demand for freight transportation in the following years [1] and millions of vessels tracked worldwide [9], methods to automatically unveil anomalous ship behaviors become increasingly necessary, e.g., to assist VTSs. To provide a comprehensive overview of existing techniques, we present the results of our literature survey regarding approaches for automated AIS anomaly detection in this section. We begin by consulting related work (Section 4.1) and deriving the methodology of the survey (Section 4.2). Afterward, we classify the examined literature and successively discuss them along their properties (Sections 4.3-4.7). Table 3 summarizes the results of the survey. Table 3. Summarized survey results of the 44 anomaly detection approaches for maritime AIS tracks. While the methodologies are quite diverge, we observe large commonalities regarding the anomaly type with route deviation being the most prominent one. Furthermore, the majority of detectors focus on a specific region and thus require re-training in order to be applied in other regions. Moreover, most publications refer to private datasets and struggle to find ground truth of known anomalies for their evaluation.

Related Work
The interest in anomaly detection in the maritime domain experienced steady attention over the past years and resulted in several scientific publications in this field. Related to our work, there are surveys with similar intentions, which we discuss briefly. The first publication from 2008 [82] derived a taxonomy for the term anomaly within the maritime domain. It is followed by a summary of a few selected approaches in 2011 [11]. Sidibé and Shu [13] conducted the first systematic review covering literature published from 2011 until 2016. Their review focuses on the individual detection methodology, approach type, AIS attributes, and used dataset. Another extensive literature survey was conducted by Riveiro et al. [12], yet many of the considered approaches are either very generic or focus on other technologies besides AIS. The survey of Tu et al. [14] paid special attention to differentiating between approaches that are geographically confined (map dependent) or universally applicable (map-independent). The most recent study [10] covers only 18 publications found in a systematic literature review and discusses high-level research questions. Finally, Zissis et al. [15] developing methods for modeling maritime routes also performed an extensive literature review.
However, while there have been extensive studies in that area, most of them lack a clear differentiation between methods developed primarily for detecting anomalies of AIS tracks and those originally addressing related problems. Some approaches, for instance, predict vessel trajectories [83] or their time of arrival [84]. Although deviations from these predictions might indicate anomalies, the authors evaluated their approaches only in terms of predictive quality and not its anomaly detection capabilities, as the papers in our review do. Similar reasons for exclusion hold for related methods that investigate the signal strengths of AIS [20] or optimize visualizations in human-machine interfaces [85], which both can contribute to anomaly detection as well, but only as a secondary use case. Thus, in our literature survey, we focus on publications specifically designed for anomaly detection in AIS tracks, which allows, among others, to assess and compare their evaluation methodologies qualitatively.

Survey Methodology
To identify publications that are explicitly concerned with the detection of anomaly in AIS tracks, we conducted a literature review. We considered papers found according to the keywords "AIS", "anomaly detection", "maritime", and "tracks". In addition, we also considered publications covered by previous reviews [10][11][12][13][14][15]. The main reason for excluding papers was that they do not fit the topic or do not focus exclusively on anomalies in AIS tracks. This way, we obtained a selection of 44 papers, which encompass the years 2007 until 2021, cf. Table 3 summarizing our selection. For each publication, similar to related work [13,14], we extracted the following properties of the detectors: First, the underlying detection method is highlighted, which groups similar detection methods. Furthermore, we list the anomaly types each method addresses (cf. Figure 2), the used AIS features (cf. Table 1), or whether these use external non-AIS features (referred to as EXT in Table 3). We display the scope of each approach with respect to a fixed region or scaling independently of a trained region, following to the notion of map-dependency used by Tu et al. [14] (cf. Section 4.1). Similarly, the vessel scope indicates whether the approach distinguishes between different vessel types announced via AIS (cf. static in Table 1), and the time scope whether temporal relationships are incorporated. Finally, the survey lists the dataset type, e.g., public or private, and whether the evaluation compares to a ground truth of known anomalies.

Methods for AIS Anomaly Detection
Regardless of the specific method, what most AIS anomaly detectors have in common is that they require learning an underlying model by using normal and sometimes anomalous AIS training data. Based on this model, detectors can decide whether new data classifies as normal or anomalous behavior. Among the considered research, only a few approaches are model-free, e.g., the approach by d'Afflisio et al. [66]. The authors deterministically verify if trajectories could have occurred during an (intentional) AIS outage, considering data before the individual outage. The scope of the models is discussed in the later Section 4.6.
Our survey identified ten groups of utilized detection methods, which are further categorized in Figure 3. One major group accounts for machine learning, either with neural networks or clustering. In particular, DBSCAN is the primary method for the latter. It finds wide use across the domain of AIS anomaly detection because it is an algorithm that appropriately clusters similar regions such as maritime vessel tracks well and can incorporate course (COG) or speed (SOG) as additional features in addition to the position (cf. Section 4.5). Tracks outside of the clustered regions then indicate anomalies. Another large group of works accounts for stochastic methods such as gaussian mixture models, which assume that the properties of AIS tracks underlay probabilistic variations. Complementing these fundamental methodologies, which are applied in other domains of intrusion detection as well [86], further specialized approaches utilizing geometric properties exist. Such approaches, for instance, calculate the convex hull of tracks in a certain region [15] or model each AIS message as a potential electrical charge decaying over a larger distance [60]. Finally, there are approaches that do not rely on a single anomaly detection method but rather incorporate multiple methods into a comprehensive framework. We therefore assigned them to a separate category (framework) in our survey.

Anomaly Types Addressed by Research
In this paper, research is classified according to the five categories proposed by Lane et al. [33] as introduced in Section 3.1 (cf. also Figure 2). Current research on AIS track anomaly detection considers all five types of anomalies. Yet, the proposed methods often identify a single anomaly type only.
The deviation from a standard route is the most prominent anomaly type that research addresses in 37 out of 44 publications. Many approaches extract frequently traveled sea routes from historical AIS data, e.g., via clustering. Unknown AIS tracks can then be compared in order to investigate whether they are similar enough to the extracted routes, or in the case of clustering, belong to one of the identified route clusters. These approaches work very well in areas where many ships take similar routes, which has been demonstrated by Wang et al. [46] and Zhen et al. [69] for bay areas and port entrances. The deviations from a standard route can also be used without a priori knowledge of common routes [64,66].
Seven approaches in our survey particularly consider unexpected AIS activity. The work of d'Afflisio et al. [66] aims to identify velocity changes occurring during AIS outages assuming that ships travel with similar velocity most of the time. They argue that intentional on-off switching is generally used to hide changes in the nominal velocity of vessels, which may occur when vessels change their course, for instance. The methodology suggested by Singh and Heymann [37] relies on known AIS tracks from other vessels and also addresses the detection of intentional on-off switching of the AIS equipment. It should be noted at this point that a plurality of other methods in the context of unexpected AIS activity aims to detect anomalies by monitoring radio signal strengths or outages occurring in specific areas. Suchlike approaches, most notably the work of Mazzarella et al. [20], are excluded from this paper due to its clear focus on AIS tracks. However, they represent promising complementary approaches that can be used alongside pure AIS-based methods to improve the detection capability.
We found three publications that explicitly consider anomalous port arrival. Zor and Kittler [77], for instance, look at ferries that run regular routes according to a fixed schedule. However, only a single ship is considered separately at a time. Hence, it is known a priori from where the vessel will (always) depart and where it is (always) expected to arrive. In general, the destination port is transmitted via AIS. As a result, it can simply be checked if the vessel's AIS track violates the port order.
Similarly, close approach anomalies can only be found in a few publications, namely in [33,36,76,80]. Mascaro et al. [76] consider the number of close interactions between ships, which may be used to indicate cargo handover, for example. In contrast, Terroso-Saenz et al. [80] forecast the closest point of arrival between two vessels. This approach could be beneficial for VTSs and enable safer and more effective navigational guidance.
Zone entry as an anomaly type is considered only marginally in the methods developed by Vespe et al. [39], Katsilieris et al. [64], and Lane et al. [33]. Restricted zones, which should not be entered, are learned implicitly as part of the general shipping routes and trajectories [39]. Zone entry in isolation may not be considered because it may be deemed too trivial to implement, i.e., the vessel's position being inside the zone constitutes an anomaly. However, one could imagine other, more elaborate methods such as predicting whether a zone entry is likely to occur soon [33].

Detection Features
As outlined in Section 2.2, AIS messages carry a wide range of different data (cf. Table 1). All anomaly detection methods generally only use a limited subset of the available features. Furthermore, they implicitly require the MMSI number to recover ship tracks from individual AIS data points. Thus, the MMSI is not explicitly listed in Table 3.
Because approaches based on AIS tracks are considered, it is not surprising that all methods use vessels' positions (PO). Whereas the speed over ground (SOG), heading (HE), or course over ground (COG) are often analyzed additionally, there exist approaches that utilize a minimum of different features only [60,61,73,78,81]. In contrast, others have seemingly adopted a maximalist approach [72,76]. Mascaro et al. [76], for instance, included most of the dynamic AIS information (cf. Table 1), as well as a vast range of external non-AIS features, such as information about weather or daytime. Similarly, although not including external features, Handayani et al. [68] argue that the usage of a wider range of features has the potential to further increase the precision. Only a few approaches use the port destinations (DST), vessel types (Vessel), or status information (STA) features. Sometimes, however, it remains unclear whether the authors obtain information about the destinations from the actual AIS data or other sources. Note that some approaches utilize the vessel type as a dedicated feature, whereas others already focus their scope on a specific vessel type beforehand (cf. Section 4.6).

Scope of Detection Methods
Besides the detected anomaly types and utilized AIS features, the scope of the detectors may differ largely regarding regions, vessel types, and time. Table 4 summarizes the regional and vessel type scopes, which are discussed in more detail in the following. Regarding the time scope, 31 publications incorporate temporal relationships. The remaining 13 publications operate time-independently and solely test, e.g., whether new AIS messages' speed vectors are similar to adjacent historic ones [32].
The survey assesses the regional scope, meaning whether the learned model is valid only in the confined region of the training data or whether it generalizes to unknown, not yet trained areas. As shown in Table 4, the majority of approaches (38) are region centric. Only six can be applied on a global scale. The geographical size the regional methods are constrained and can vary significantly from approaches focusing on bays and port entrances [46,69] to areas of continental scale [45]. A major disadvantage of local approaches is, however, that they strongly rely on historical AIS data of the region. Thus, they cannot be applied to regions from which there exists no or sparse information. Table 4. Overall, the majority of publications (38 out of the total 44 from the review) consider a given constrained region, as show in the table below. Only a few (6) are region independent and generally applicable, i.e., worldwide. Furthermore, the minority (16) differentiate between vessel-specific types prior to training. Overall, most approaches (27)  Approaches also differ in the way vessel types are considered for detection. The distinction made in this work is whether the methods aim to detect anomalies from one specific vessel type or if anomalies can be detected for any other (unknown) vessel types. It is apparent that many of the methodologies developed (28 papers) generalize to all other vessels. Yet, not insignificantly few work (16 papers) focuses on unique vessels and anomalies, such as Zor and Kittler [77] who consider route anomalies of ferries oscillating between two fixed ports. The method exploits the characteristics of ferry traffic, which always follows very similar and known paths. The models are then built from the individual routes of specific ferries. Present behavior can then be analyzed with respect to anomalies, but it remains questionable whether their approach can be applied to other ships traveling a similar route. A limitation when considering approaches specific for single vessels is that vessels involved in anomalous behavior have to be known in advance. Furthermore, a sufficient amount of regular non-anomalous AIS data would have to be recorded before anomaly detection could take place. While such approaches may be suitable for detecting anomalies of ferries, it seems too specific for most scenarios beyond that context. In securityand safety-related scenarios, such as terrorist attacks or emergencies, a meaningful selection of ships for which to train a vessel-specific detection model is challenging because it is not known in advance which ships are likely to be involved in an upcoming incident or illicit activities (cf. Table 2).

Evaluation Datasets and Ground Truth
Besides proposing new anomaly detectors, evaluating their effectiveness and comparing them to existing state of the art is essential in scientific research. The usual procedure involves splitting a given dataset into training and test data containing (known) anomalies that are expected to be found.
Regarding dataset types, we differentiate between publicly available, self-recorded, private/closed, and synthetic AIS data. As shown in Table 3, the data sources vary widely between the different research approaches. While 7 publications revealed their data sources, unfortunately, 32 approaches are evaluated on closed data sets and 5 with unknown sources. As our survey shows, 22 of the 32 approaches are evaluated on private datasets, whereas eight publications are based on self-recorded and two are based on synthetic datasets. Many authors obtained data from (military) authorities or defense contractors, e.g., the Swedish navy [32] or BAE Systems [36], while others relied on commercial platforms, such as MarineTraffic [66,68]. Since inexpensive Commercial off-the-shelf (COTS) AIS equipment is available today, it is reasonable that some research groups self-recorded the needed AIS data [37,52,55,56,67,73,78,79]. However, not all researchers used real-world AIS data. Kong et al. [81], for instance, artificially generated a set of short AIS tracks that are claimed to be consistent with real-world AIS traffic and terrorist behavior.
Moreover, we observe that the lack of ground truth is a common challenge in this area of research. When using real-world data, many researchers struggle to find a valid ground truth [32,59,76] and resort to the artificial generation of AIS anomalies [55,66]. Besides the 8 publications with a decent ground truth derived, e.g., from real reported incidents in Europe [15] or suspected illegal fishing rendezvous [66], tracks labeled by domain experts [61], or situations with severe weather conditions [78], there are also 11 publications with makeshift ground truth (marked with in Table 3). These include drawing anomalies by hand [75], introducing random data, or adding synthetic anomalies, among others. Validation of methods with exclusively self-generated anomalies might limit the reliability of the developed methods in real-world scenarios, the credibility of the approaches, and hinders comparison in the research community.
Overall, this heterogeneous landscape of AIS data sources constraints science. A dedicated scientific database for regular AIS data might not necessarily be of much additional value because there is already a large number of sources available (cf. Section 2.4) [14]. However, having such a database including known and confirmed anomalous AIS tracks would be of great value. From a scientific view, there are three general requirements for such a dataset. First, it should be representative in terms of relevance and coverage. Second, accessibility is crucial, meaning the data must be made available and easily accessible. Most important, in the context of AIS anomaly detection, anomalous traces must be marked with an appropriate label. It should be noted that Mao et al. [87] have already laid the foundation for a scientific AIS database, but for evaluating trajectory prediction methods rather than anomaly detection.

Discussion
This section discusses the results of our review and classification of research approaches for anomaly detection in AIS tracks. First, limitations arising from the homogeneity of methods are mentioned (Section 5.1). We then outline the critical challenges related to privacy implications of AIS surveillance and anomaly detection (Section 5.2).

Limitations of Recent Approaches
The literature review reveals that research on anomaly detection in AIS tracks follows a relatively homogeneous path. Firstly, the bulk of research is aimed at detecting route anomalies (cf . Table 3), and thus, lacking diversity. Detection methods for zone entry and unexpected port arrival could be effortlessly implemented and successfully complement route deviation detection. Close approach anomalies may be more challenging to detect reliably, especially in high-trafficked areas, because they simultaneously require position, course, and speed information of multiple ships. Nevertheless, it is surprising, in particular with respect to the original safety goal of AIS (see Section 2.1), that there is not more research focused on the detection of close approaches. However, simple collision avoidance mechanisms are already built into existing AIS equipment [2] and are likely to be not covered by our survey due to their design (cf. Section 4.1).
The majority of research is concerned with modeling "normal" behavior specific to a geographically confined region (cf. Table 4). While these approaches seem to work very well, they may suffer from the following disadvantages: In areas where not sufficient data is available or it is not plentiful enough, these approaches can hardly be used. In addition, when entering AIS data or configuring AIS equipment, mistakes are often introduced [88] that can be unintentionally and wrongly incorporated as normal into the learned detection model. Finally, with the advent of upcoming autonomous vessels and ships [89][90][91], implementing AIS track anomaly detectors directly into moving vessels may be beneficial to enhance safe automated navigation. Again, region-specific approaches may not be fully applicable here because they require re-training for each region the vessel moves to. Thus, we deduce that these region-specific approaches are mostly only suitable for static use cases and stationary AIS receivers.
With respect to datasets that are used for the evaluation of proposed approaches, it turns out that in many cases AIS anomaly detection is funded or performed by researchers associated with maritime authorities or defense contractors. Thus, it is not surprising that these entities often also supply their datasets. Nevertheless, some researchers (8 papers) also recorded their own datasets, while only a few (seven papers) use publicly available sources. Unfortunately, there is a lack of known anomalous AIS situations that represent reliable ground truth. Hence, many researchers resort to simulating their own anomalies as substituted ground truth. Existing approaches range from manually drawing AIS tracks [75] to simulating data with rigid-hulled inflatable vehicles [36]. Overall, the lack of a common dataset heavily reduces transparency, hinders a replication of results, and makes it particularly impossible to evaluate and compare the effectiveness of different approaches in a sound and scientific manner. The development of an established and freely available AIS database, such as suggested by Mao et al. [87], is thus urgently necessary in order to advance science in this domain.
Still, as found out recently by Serra-Sogas et al. [92], only a minority of the total vessels contribute to AIS, and about 70% remain invisible. This severely limits the applicability of detection methods, especially to small recreational vessels, which account for 53% of the non-AIS-equipped vessels [92]. Thus, supplementary methods that can track vessels regardless of their AIS equipment, such as those based on radar, may be beneficial in the future in addition to AIS-based anomaly detection.

Privacy Considerations
With respect to information security, a problem already mentioned in Section 2.1 is the general openness of the AIS protocol because AIS information can be accessed by anyone at any time. The trade-off between the gain in security and safety through AIS and the loss of privacy for those traveling on vessels may be skewed in favor of the former. With AIS data readily available for anyone willing to pay (cf. Section 2.4), the location of known crews and passengers can be revealed in real time. In addition, AIS receivers placed around the globe are connected to the Internet, sometimes without any security mechanisms in place [93].
The IMO noted already in 2004 that freely available AIS data may undermine the initial safety and security goals [94]. The situation is so serious that the European Data Protection Supervisor has acknowledged that AIS may have infringed the EU's data protection regulation since its inception [95]. Similar considerations that AIS may violate the freedom of information act are made in the United States [96].
To the best of our knowledge, none of the anomaly detection research considers privacy issues. Existing work may be used to identify and track individuals involved in (suspected) illicit activities by anyone having the ability to obtain AIS data. However, this also means that these methods can be used by authorities and governments that violate basic human rights to, e.g., actively prohibit identified SAR missions and persecute individuals involved in such missions. These issues may be partially remedied by extending confidentiality and authentication protection to AIS as suggested by Goudossis and Katsikas [25], Aziz et al. [97], and Kessler [26].

Conclusions
To increase the safety and security of a globally growing maritime traffic, AIS was introduced by fitting transceivers to each vessel, primarily to suit as a digitized ship-toship collision avoidance system. With the ability to overhear AIS position broadcasts from ships worldwide, e.g., via satellite-based receivers, AIS became the leading tool to enable surveillance of the entire maritime domain. With plenty of available AIS datasets and vessels following predictable routes and maneuvers, automated anomaly detection promises to detect unintended or even malicious behavior, e.g., by learning frequent shipping routes.
In this paper, we performed a literature survey to classify academic anomaly detection approaches utilizing AIS tracks. Based on a detailed assessment of 44 publications, it reveals that most research tackles deviations from the expected or well-known shipping routes by focusing on confined regions rather than training universally applicable models. This may be suitable for stationary VTSs or vessels on repetitive routes, but hinders the adoption of new use cases such as future autonomous vessels operating on worldwide cargo routes. Moreover, an objective and sound comparison between approaches is hardly possible due to closed evaluation datasets and missing ground truth for anomalies.
With AIS being a powerful tool for worldwide surveillance, it contradicts the individual's rights to privacy, as already recognized by the IMO and also at state level [94][95][96]. Hence, we believe that awareness should be raised, especially for AIS tracking and automatic anomaly detection in the future. Extensions to AIS that provide both pseudonymity and confidentiality to vessels are needed to protect the privacy and data sovereignty of individuals at sea.

Data Availability Statement:
No new data were created or analyzed in this study. Data sharing is not applicable to this article.

Conflicts of Interest:
The authors declare no conflict of interest.

Abbreviations
The following abbreviations are used in this manuscript: AIS