Ship Anomalous Behavior Detection Using Clustering and Deep Recurrent Neural Network

Abstract

In this study, we propose a real-time ship anomaly detection method driven by Automatic Identification System (AIS) data. The method uses ship trajectory clustering classes as a normal model and a deep learning algorithm as an anomaly detection tool. The method is divided into three main steps: (1) quality maintenance of the original AIS data, (2) extraction of normal ship trajectory clusters using Density-Based Spatial Clustering of Applications with Noise (DBSCAN), in which a segmented improved Dynamic Time Warping (DTW) algorithm is used to measure the degree of trajectory similarity, (3) the clustering results are used as a normative model to train a Bi-directional Gated Recurrent Unit (BiGRU) recurrent neural network, which is used as a trajectory predictor to achieve real-time ship anomaly detection. Experiments were conducted using real AIS data from the port of Tianjin, China. The experimental results are manifold. Firstly, the data pre-processing process effectively improves the quality of raw AIS data. Secondly, the ship trajectory clustering model can accurately classify the traffic flow of different modes in the sea area. Moreover, the trajectory prediction result of the BiGRU model has the smallest error with the actual ship trajectory and has a better trajectory prediction performance compared with the Long Short-Term Memory Network model (LSTM) and Gated Recurrent Unit (GRU). In the final anomaly detection experiment, the detection accuracy and timeliness of the BiGRU model are also higher than LSTM and GRU. Therefore, the proposed method can achieve effective and timely detection of ship anomalous behaviors in terms of position, heading and speed during ship navigation, which provides insight to enhance the intelligence of marine traffic supervision and improve the safety of marine navigation.

1. Introduction

1.1. Intelligent Maritime Traffic Supervision

As the density of marine vessels increases, maritime accidents occur frequently and marine traffic safety faces challenges. Traditional maritime monitoring is conducted by manual monitoring of Vessel Traffic Service (VTS), which is limited by complex and heterogeneous data, information overload, personnel fatigue, inattention, etc., and cannot achieve a good monitoring effect. Intelligent maritime traffic supervision based on maritime data and computer technology can provide valuable information on the traffic situation in the sea area and assist in hazard supervision, so as to discover potential abnormal behavior of ships in time, reduce the occurrence of maritime accidents and violations, and guarantee the safety and economy of maritime navigation.

In the 19th century, the field of statistics began to study outliers in data sets, and then “anomaly detection” was applied and developed in various fields. The Automatic Identification System (AIS) [1] provides navigation information to ships and other receivers in real-time and provides ship dynamic information, static information and voyage-related supplementary information to other ships, shore bases, satellites, etc. The International Convention for the Safety of Life at Sea requires merchant ships of 300 GT or more on international routes to be equipped with AIS, and the use in smaller ships and lifeboats is gradually becoming more common. With the continuous promotion of intelligent marine traffic supervision, more and more AIS base stations, VTS and various monitoring networks are gradually covering the global coastal areas. While the maritime supervision network with ship data sensing as its core provides auxiliary supervision, the volume of maritime traffic data collection is growing exponentially from gigabytes to terabytes. It is an inevitable developing trend in the maritime supervision field, in the era of big data, to research and analyze the maritime traffic law hidden in AIS data, discover the maritime traffic abnormalities in time, and improve the supervision and efficiency of maritime departments.

1.2. Abnormal Behavior of Ship

The abnormal behavior of a ship can be summarized as actions that do not conform to the predefined normal behavior model of a ship in the sea area [2], for example, a ship changing speed for abnormal reasons, changing course, deviating from the route, appearing in an inappropriate area, etc. These behaviors may also often be related to maritime accidents, illegal smuggling, pirate hijacking, terrorist activities, etc. [3]. Iphar [4] believes that several types of anomalies can be distinguished: the point, contextual and collective anomalies. Roy [5] defines the specific manifestations of abnormal ship behavior as position anomalies and motion anomalies and specifically subdivides them into 16 types of anomalous behavior. On this basis, Riveiro et al. [6] summarize the anomalous behavior of ships related to the situational context (ships involved in drug smuggling, human smuggling, terrorism, etc.). Wolsing [7] defines five general abnormal behaviors derived from the ship’s trajectory, which are a deviation from the standard course, unexpected AIS activity, unexpected port arrival, too close to other ships, and prohibited areas entry.

It can be seen from the above relevant research that the definitions of ship abnormal behavior are different according to different research emphases. However, essentially these anomalous behaviors will be identified in the ship’s location, speed and course.

1.3. Ship Anomaly Detection

In the study of anomaly detection, a normative model should be defined based on the dataset, which is generated by predictable repeated events, and anomalies that do not match this normal model [8]. Data-driven anomalous ship behavior detection consists of two steps [9]: (1) learning from historical ship trajectory data to build a model representing normal ship behavior, which is generally represented as a statistical distribution or clusters of behavioral features; (2) anomaly detection by matching and comparing the deviation between the normal behavior model and the ship’s motion data to be detected, and recognized as anomalous if the deviation exceeds a certain threshold. According to the design method of the normative model, the methods of detecting ship anomalous behavior can be divided into statistical analysis methods, machine learning methods, and prediction-based anomaly detection methods.

Statistical theory was the first method applied to the detection of abnormal ship behavior. Holst [10] proposed a ship trajectory model based on grid and velocity vectors and used two-dimensional Gaussian distribution to establish a probability distribution model for normal ship trajectory. The model calculates the probability of the input trajectory points and identifies the trajectory points with a probability less than a certain threshold as anomalies. The method of Holst was improved by Laxhammar [3] combined with Expectation Maximization (EM) and the Gaussian Mixture Model (GMM). The algorithm can effectively identify some significant abnormal behaviors, but the method requires a high data distribution, and the anomaly detection results are less satisfactory when the data do not satisfy the Gaussian distribution. Ristic [11] extracted the ship motion patterns and valued the features of the data points by the Kernel Density Estimation (KDE) method to obtain the probability density functions of some different classes of motion patterns, and calculated the probability that the new trajectory points belong to the corresponding motion patterns to determine whether the trajectory points are anomalous or not. Xiao [12] analyzes some AIS dynamic information (lateral position, speed, course, time interval), and the values are presented in a statistical way to describe the characteristics of the ship traffic. Similar characteristics indicate that it is reasonable to use statistical methods to describe the behavior of ship traffic. Rong [13] proposed a nonparametric Bayesian probabilistic trajectory prediction model based on a Gaussian process to detect ship deviations. The model describes the uncertainty of a ship’s track position through a continuous probability distribution, and on this basis, the probabilistic model is updated iteratively using new AIS data.

The principle of abnormal ship behavior detection based on the machine learning method is to get a normal navigation model from the historical track data and build an optimal learning model through training to achieve abnormality recognition. Most of these studies are based on a comparison with the inherent normal model to achieve anomaly detection. Vespe [14] uses AIS data and adopts an unsupervised learning algorithm to automatically learn a ship’s motion pattern. This algorithm can realize incremental learning, so as to dynamically adjust the model to adapt to environmental changes and realize ship trajectory anomaly detection. Mascaro [15] used AIS data with spatio-temporal contextual information of ships to learn to obtain dynamic and static two-layer Bayesian networks with different scales, which expanded the coverage of the model and thus improved the performance of ship anomalous behavior detection. Lei [16] used the space, sequence, and behavior of ship motion as the machine learning features of ship anomaly patterns, and evaluated the ship trajectory for the anomalous feature values. Souza [17] developed the Hidden Markov Model (HMM), data mining approach and a multi-layer filtering strategy based on vessel speed and operating time to detect and identify different behavioral patterns of fishing vessels. Toloue [18] proposed anomaly detection of ship trajectory based on the HMM, using ship speed, position and course as parameters, and the experimental results showed that the accuracy of anomaly determination was over 96%.

The method of ship trajectory detection based on prediction models aims at predicting the future state information (position, speed, course, etc.) of a ship’s trajectory by using a corresponding algorithm to build a prediction model and comparing the actual value with the predicted value to determine whether there is any abnormality. The main methods can be divided into conformal trajectory prediction and deep neural network-based trajectory prediction. A conformal anomaly detector is an application of conformal prediction, whose main idea is to estimate the p-value of new data based on the formulated non-conformity measure. If the p-value is lower than a predefined abnormality threshold, the data are classified as abnormal. Laxhammer [19] used the conformal prediction method to generate a set of predicted trajectories and used the Hausdorff distance to measure the trajectory similarity, and the data in the prediction range were considered as anomalous. Deep learning techniques are essentially network layers overlaid with multiple nonlinear mappings and are an extension of neural network research. Bomberger [20] proposed an unsupervised incremental learning algorithm through associative neural networks to predict the normal trajectory of a ship at future moments, and to consider an abnormal movement of the ship when the actual trajectory of the ship deviates from the predicted trajectory. Zhao [21] used the results of in-water trajectory clustering as a training sample set to train a recurrent neural network composed of Long Short-Term Memory (LSTM) units and used the neural network as a ship trajectory predictor to achieve real-time detection of ship trajectory anomalies. Tang [22,23] used LSTM to achieve the prediction of ship trajectory and combined it with the grid-based anomaly detection algorithm to achieve the detection of abnormal ship behavior.

In addition, the following properties of the relevant working detectors are summarized in

Table 1. Major features of preceding studies.

Method	Publications	Use Attributes of Ship Behavior Data	Detection Model
	Authors
Statistical Analysis	Holst [10]	Ship Location, Speed	Gaussian Distribution
	Laxhammar et al. [3]	Ship Location, Speed	GMM
	Ristic et al. [11]	Ship Location	KDE
	Xiao [12]	Lateral Position, Speed, Course and Time Interval	Statistical Distribution
	Rong et al. [13]	Ship Location, Speed and Timestamp	Gaussian Process
Machine Learning	Vespe [14]	Ship Location, Speed and Course	Unsupervised Learning
	Mascaro [15]	Ship Location, Speed, Course and Spatio-temporal Contextual Information	Bayesian Network
	Lei [16]	Ship Location	MT-MAD
	Souza [17]	Ship Location, Speed and Operating Time	Hidden Markov Model, Data Mining and Multilayer filtering Strategy
	Toloue [13]	Ship Location, Speed and Course	Hidden Markov Model
Prediction Based	Laxhammer [14]	Ship Location, Speed and Timestamp	Conformal Prediction
	Bomberger [15]	Ship MMSI, Location, Speed and Course	Associative Neural Network
	Zhao [16]	Ship MMSI, Location, Speed, Course and Timestamp	LSTM
	Tang [17,18]	Ship MMSI, Location, Speed, Course and Timestamp	LSTM
	This Study	Ship MMSI, Location, Speed, Course and Timestamp	BiGRU

. Firstly, basic research methods are classified according to different detection methods. Furthermore, the ship behavior parameters and detection model used in the detection process are also listed.

From this, we conclude that anomaly detection based on statistical methods is easy to implement, and the anomaly detection results are accurate and effective when the historical data is sufficient and the knowledge of the type of detection used is perfect. However, the disadvantage is that the definition of the anomaly threshold is very complicated, the method is limited to a specific problem, and the statistical method is ineffective when the anomalies are evenly dispersed in the samples. Machine learning methods face the challenges of insufficient high-dimensional feature space and sample size, model overfitting, local optimum, and poor interpretability in practical application. The deep neural network has strong autonomous learning ability and powerful feature extraction and abstraction ability. Many related studies have demonstrated the feasibility of using deep neural networks for ship trajectory prediction [2,7,24]. With the development of deep learning technology, a series of variants of Recurrent Neural Networks (RNNs) with better performance have been derived, which improve the operational efficiency and computational accuracy of neural network models. However, studies about maritime anomaly detection applying ship trajectory data in deep recurrent neural networks have been scarce. Combining the excellent modeling capabilities of machine learning with adaptive prediction methods will greatly improve the applicability of detectors at sea.

1.4. The Motivation of the Study

The motivation of this research is to explore innovative research methods for ship AIS data quality maintenance, ship normal trajectory modeling, and ship trajectory anomaly detection based on data science and deep learning technology, which is dedicated to improving maritime intelligence supervision efficiency maritime traffic safety, and providing scientific support to enhance maritime intelligent supervision capability.

To achieve this goal, this paper proposes a real-time ship anomalous behavior detection method driven by AIS trajectory data. In our approach, the ship trajectory clustering algorithm is used to extract a model of the normal trajectory within the water and use Bi-directional Gated Recurrent Unit (BiGRU) deep neural network as the anomaly detection tool. Firstly, a set of data cleaning and repair methods is proposed for the data quality problems in the original AIS data, which effectively improves the experimental data quality. Secondly, in the process of modeling ship trajectory clustering using Density-Based Spatial Clustering of Applications with Noise (DBSCAN), the segmented improved Dynamic Time Warping (DTW) distance is used to measure the degree of similarity between trajectories; which effectively solves the problem that the DTW algorithm is insensitive to the shape features, start/stop point position, and trajectory direction features of ship trajectories. Finally, BiGRU is used as a constant predictor for real-time detection of ship navigation status. The advantage of the deep neural network-based ship abnormal behavior detection is that the method does not achieve abnormality detection simply by comparing with the normal model, but also by autonomously recognizing the normal trajectory state according to the learning characteristics of the deep neural network itself, so as to achieve more accurate abnormality detection.

The rest of the paper is structured as follows. Section 2 describes the ship normal trajectory modeling method, including the AIS data quality maintenance method and the ship trajectory clustering method based on DBSCAN and segmentation-improved DTW. Section 3 describes the BiGRU trajectory prediction model and the detailed method of ship trajectory anomaly detection. Section 4 discusses the experiments and results. Section 5 summarizes our research work and proposes future research plans.

2. Normal Trajectory Modeling Method

2.1. Data Preprocessing

The original AIS data will be anomalous in a series of processes such as generation, encapsulation, broadcasting, transmission, decoding, and storage, and a variable amount of noisy data will appear. Additionally, most of the AIS messages are externally timestamped as they are accepted for parsing by the receiving station. The quality of the timestamp information is related to the receiving station, which may not be an accurate indication of the actual time of the ship’s position report. Therefore, it is necessary to preprocess original data before carrying out the abnormal behavior detection of the ship based on the AIS data-driven information. By summarizing related studies and observing AIS data, we categorized the problems of the original AIS data into the following three aspects [25]:

• Insufficient trajectory data integrity;
• Insufficient accuracy of trajectory data;
• Too much meaningless redundant data.

Each field in the normal AIS dataset should be complete and meaningful. Insufficient trajectory data integrity is manifested in such aspects as missing trajectory segments, the inability to match dynamic and static information, and too few valid points. We will exclude these data because these issues will cause them to not fully characterize the ship’s motion. Additionally, some of the ship trajectories contain ship anchoring states, which essentially contain multiple voyages of the ship and need to be split. For the problem of insufficient trajectory integrity, the complete processing method is shown in Figure 1, and the processed ship trajectory dynamic data is expressed as Equation (1).

$$T_{\mathrm{rj}}=\left\{\begin{array}{ccccc}{t}_1& x_1& y_1& v_1& c_1\\ t_2& x_2& y_2& v_2& c_2\\ ⋮& ⋮& ⋮& ⋮& ⋮\\ t_i& x_i& y_i& v_i& c_i\\ ⋮& & & & ⋮\\ t_m& x_m& y_m& v_m& c_m\end{array}\right\}$$

(1)

where $i=1,2,\dots ,m$ is the number of track points contained in the trajectory; $t_i$ represents the time of the point, $x_i$ and $y_i$ is the longitude and latitude coordinates of the ship at the time $t_i$, $v_i$ and $c_i$ are the ship’s ground speed and track direction, respectively.

Trajectory data accuracy problems include data field errors and movement logic errors. The EMEA0183 protocol standardizes the format of the fields in AIS data. In our research, we mainly focus on the MMSI, longitude, latitude and course. The first three digits of MMSI are the flag country code, and the last six digits are the specific identification code of the ship. The normal longitude range of the track point is [−180°, 180°], the latitude range is [−90°, 90°], and the course range is [0°, 359.9°]. The track point data that does not meet the above requirements will be eliminated.

Due to the transmission failure between the AIS and the shore-based system or the improper maintenance of human beings, etc., motion logic errors such as abnormal ship position and speed often appear in the AIS data. As shown in Figure 2a, the speed change can be detected by calculating the average speed between track points by Equation (2).

$${\overline{v}}_i=\frac{\sqrt{{\left(y_i-y_{i+1}\right)}^2+{\left(x_i-x_{i+1}\right)}^2}}{t_{i+1}-t_i}$$

(2)

At this time, the ship’s speed should meet the condition given by

$$v_i-a^{\prime }\left(t_{i+1}-t_i\right)\le {\overline{v}}_i\le v_i+a\left(t_{i+1}-t_i\right),$$

(3)

where $a$ and $a^{’}$ are the forward and reverse acceleration when the ship is moving forward. Otherwise, the track point is detected as an abnormal speed point, and the average speed between the two points is used to replace the wrong speed data at this point as Equation (4). The repair effect is shown in Figure 2b.

$$v_i=\{\begin{array}{cc}{v}_i,& normalspeed\\ {\overline{v}}_i,& abnormalspeed\end{array}$$

(4)

For ship position data maintenance, when judging the sudden change of ship position as shown in Figure 3, we use Equations (5) and (6) to detect and repair.

$$\{\begin{array}{c}{\widehat{x}}_{t_{i+1}}=x_i+v_i\left(t_{i+1}-t_i\right)\\ {\widehat{y}}_{t_{i+1}}=y_i+v_i\left(t_{i+1}-t_i\right)\end{array}$$

(5)

$$\sqrt{{\left(x_i-x_{i+1}\right)}^2+{\left(y_i-y_{i+1}\right)}^2}\le 0.5a{\left(t_{i+1}-t_i\right)}^2,$$

(6)

where ${\widehat{x}}_{t_{i+1}}$ and ${\widehat{y}}_{t_{i+1}}$ are the estimated position at time $t_{i+1}$, If the ship’s position does not satisfy Equation (6), we use the estimated position to update it.

The average daily ship traffic in the port area can reach thousands, and the frequency of broadcasting AIS information is generally 2–30 s, depending on the speed and type of ship. The number of track points in the original data set often reaches millions, and the shipping speed in the port area is generally slow, which is the reason for too much redundant data. Compression of trajectory points is useful for saving data storage and computation costs. The Douglas–Poker (DP) algorithm [26] is commonly used for the compression of trajectory points with the advantages of translation and rotation without distortion. We use the DP algorithm to extract the location feature points and course feature points of a ship’s trajectory [27]. Meanwhile, we introduce the speed change rate as Equation (7) and keep the points whose speed change rate exceeds 0.1 kn/s as the speed feature points. Figure 4 shows the comparison before and after the compression of some sample trajectories.

$$CRS=\frac{\left|v_i-v_{i-1}\right|}{t_i-t_{i-1}}$$

(7)

2.2. Trajectory Clustering Method

This section introduces the trajectory clustering model based on the preprocessed AIS data, which divides the ship traffic flow in the sea area into different regular ship movement patterns.

DBSCAN [28,29] is a simple and effective density-based spatial clustering algorithm with noise. It can identify clusters of any shape in noisy spatial data without setting the number of clusters in advance and can solve the problem that similar trajectories are spatially disjoint, which is very suitable for clustering of unlabeled data such as ship trajectories.

The DBSCAN algorithm uses two parameters:$\mathit{MinTrs}$ and $\mathit{eps}\left(\mathsf{\epsilon }\right)$. $\mathit{MinTrs}$ indicates the minimum number of data (a threshold) clustered together for a region to be considered dense. $\mathit{eps}\left(\mathsf{\epsilon }\right)$ is a distance measure that will be used to locate objects in the neighborhood of every data. The algorithm proceeds by arbitrarily picking up an object in the dataset $S$ (until all objects have been visited). If there are at least $\mathit{MinTrs}$ objects within a radius of $\epsilon$ to the object then we consider all these objects to be part of the same cluster. The clusters are then expanded by recursively repeating the neighborhood calculation for each neighboring object. The steps of the DBSCAN-based ship trajectory clustering algorithm are shown in Figure 5.

The traditional DBSCAN algorithm performs density clustering in terms of data points. When applying it to ship trajectory clustering, how to calculate the degree of similarity between trajectories is an issue of concern. The broadcasting principle of ship AIS trajectory data leads to different sampling time stamps and sampling quantities, which is a typical kind of unaligned discrete time series data. In this study, we adopted the DTW algorithm to measure the distance between ship tracks. As shown in Figure 6, the principle of DTW is to make the shape between the two sequences as consistent as possible by locally extending or zooming the time series on the time axis and calculating the minimum distance between points on the trajectory sequence to determine the matching combination of track points. In this process, some trajectory points are reused such as $q_2$ and $p_3$. Figure 7 shows all matching trajectory points expressed as a matrix, calculating the shortest Euclidean distance matrix between each point of two trajectory sequences, finding the shortest matching path from the upper left corner to the lower right corner of the matrix, and the sum of all weight values on the twisted path is the DTW distance.

In addition, we summarized the three shortcomings of the DTW algorithm in the ship trajectory similarity metric, namely, the inability to distinguish the local characteristics of the trajectory, the poor ability to distinguish the direction of the trajectory, and the lack of consideration of the starting and ending positions of the trajectory. In this regard, we propose a segmented improved DTW algorithm to solve the above problem. As shown in Figure 8, we improved the point-point matching between two trajectories in the traditional DTW distance to a trajectory sub-segment matching, to improve the ability to distinguish the local features of the ship’s trajectory and the direction of its trajectory. In addition, we adjusted the matching distance weight value of the first and last trajectory sub-segments to improve the sensitivity of the DTW to the position of the ship’s starting and ending trajectory. The steps of the improved algorithm are as follows:

Step 1: Input two trajectory sequences: query trajectory $T_1$ and compared trajectory $T_2$. Define the two trajectory sequences as $T_1=\left(p_0{,p}_1{,\dots ,p}_m\right)$ and $T_2=\left(q_0{,q}_1{,\dots ,q}_n\right)$. $p_i\left(x_i{,y}_i\right)$ and $q_j\left(x_j{,y}_j\right)$ to represent the trajectory points in the $T_1$ and $T_2$, and use $\left|T\right|$ to represent the length of the trajectory sequence.

Step 2: Connect each two adjacent discrete trajectory points in $T_1$ and $T_2$ respectively as trajectory sub-segments, and the sub-segments on $T_1$ and $T_2$ are respectively represented as

$$S_i\left(p_i{,p}_{i+1}\right) \left(1\le i\le m-1\right)$$

(8)

Step 3: Calculate the point–segment distance, If $p_i$ is a trajectory point on the trajectory $T_1$, the two ends of the sub-segment $S_j$ on $T_2$ are $q_j\left(x_j{,y}_j\right)$ and $q_{j+1}\left(x_{j+1}{,y}_{j+1}\right)$. Then, the point–segment distance from $p_i$ to $S_j$ is calculated by

$$d_{\mathit{ps}}\left(p_i{,S}_j\right)=\underset{q\in S_j}{\mathit{min}}{d}_{\mathit{ps}}\left(p_i,q\right),$$

(9)

where $d_{\mathit{ps}}\left(p_i,q\right)$ represents the Euclidean distance between the two points $p_i$ and $q$.

Step 4: The unidirectional segment–segment distance from $S_i$ to $S_j$ is defined as the sum of the point–segment distances from the two endpoints of $S_i$ to $S_j$ divided by the length of $S_i$.

$$d\left(S_i{,S}_j\right)=\frac{1}{\left|S_i\right|}\left({{\displaystyle \int }}_{p\in S_i}{d}_{\mathit{ps}}\left({p,S}_j\right)\right)$$

(10)

The segment–segment linear distance between $S_i$ and $S_j$ is equal to the average of the two unidirectional distances:

$$d_{\mathit{ss}}\left(S_i{,S}_j\right)=\frac{1}{2}\left(d\left(S_i{,S}_j\right)+d\left(S_j{,S}_s\right)\right)$$

(11)

Step 5: The angle $\theta \left(0^{\circ }⩽\theta ⩽{180}^{\circ }\right)$ between $S_i$ and $S_j$ is shown in Figure 9; it can be calculated by

$$\theta =\left|\mathit{arctan}2\left(y_{i+1}-y_i{,x}_{i+1}-x_i\right)-\mathit{arctan}2\left(y_{j+1}-y_j{,x}_{j+1}-x_j\right)\right|,$$

(12)

where the value domain of $\mathit{arctan}2$ is $[-\pi ,\pi ]$, and its input is not just the tangent, but two values, for example $x_1$ and $x_2;$ the tangent is their ratio $\frac{x1}{x2}$.

The angular distance between $S_i$ and $S_j$ is defined as:

$$d_{\theta }\left(s_i{,s}_j\right)=\{\begin{array}{cc}\left|s_i\right|\times \mathit{sin}\theta ,& {\mathit{if}0}^{\circ }\le \theta \le {90}^{\circ }\\ \left|s_i\right|,& {\mathit{if}90}^{\circ }\le \theta \le {180}^{\circ }\end{array}$$

(13)

The segment–segment comprehensive distance can be calculated by

$$\mathit{dist}\left(s_i{,s}_j\right){=w}_1\cdot d_{\mathit{ss}}\left(S_i{,S}_j\right){+w}_2\cdot d_{\theta }\left(S_i{,S}_j\right)$$

(14)

where $w_1$, $w_2$ respectively represent the weight values of linear and angular distance, which are both set to 0.5 in this study.

Step 6: The $\mathit{dist}\left(s_i{,s}_j\right)$ is brought into the DTW algorithm instead of the traditional point matching method to obtain the dynamic time warping distance, which is the similarity degree between $T_1$ and $T_2$.

$$\mathit{DTW}\left(T_1{,T}_2\right)=\{\begin{array}{c}\infty ,\mathit{if}m=0\mathit{or}n=0\\ \mathit{dist}\left(\mathit{Head}\left(T_1\right),\mathit{Head}\left(T_2\right)\right)+\\ \mathit{minDTW}\left\{\left(\mathit{Rest}\left(T_1\right),\mathit{Rest}\left(T_2\right)\right),\left(\mathit{Rest}\left(T_1\right){,T}_2\right),\left(T_1,\mathit{Rest}\left(T_2\right)\right)\right\},\mathit{otherwise}\end{array}$$

(15)

where $m$, $n$ respectively represent the number of sub-segments on $T_1$ and $T_2$. Similar to the traditional DTW algorithm,$\mathit{Head}\left(T_1\right)$ represents the first sub-segment on $T_1$; $\mathit{Rest}\left(T_1\right)$ represents the remaining sub-segments after removing $\mathit{Head}\left(T_1\right)$ from $T_1$; $\mathit{dist}\left(\mathit{Head}\left(T_1\right),\mathit{Head}\left(T_2\right)\right)$ represents the segment–to–segment comprehensive distance between $\mathit{Head}\left(T_1\right)$ and $\mathit{Head}\left(T_2\right)$.

Step 7: Adjust the weights of the first and last sub-segments of the trajectory. Based on experience, these weight values are set to 2 in this study.

$${\mathit{Distance}}_{\mathit{weight}}{=\mathit{DTW}}_{\mathit{pair}}{\times \mathit{Weight}}^T=\left[\begin{array}{c}{D}_1{D}_2\cdots D_n\end{array}\right]\times \left[\begin{array}{c}2\\ 1\\ ⋮\\ 1\\ 2\end{array}\right]$$

(16)

where ${\mathit{Weight}}^T$ is the influence weight matrix of the track point combination. ${\mathit{Distance}}_{\mathit{weight}}$ is the combined distance matrix of the trajectory segment after the weight adjustment.

3. Anomalous Ship Behavior Detection Using Recurrent Neural Network

3.1. Bidirectional Gated Recurrent Unit Model

Deep neural networks have powerful extraction and abstraction capabilities that can use a large amount of data for training and learning, and perform deep mapping between input and output data. RNN is a deep learning algorithm specifically designed for spatiotemporal sequential data, but it has the shortcoming of rapid deterioration of neuron node memory. The LSTM model effectively improves this deficiency of RNN. Its memory module contains one or more autocorrelated core cells and three new cell gates for controlling the flow of information into the storage unit and from the unit to the network input gate, output gate and forget gate, which determine which information should be removed from the processor state, precisely through the concept of “gates”.

The Gated Recurrent Unit (GRU) is a variant of LSTM developed in recent years, which in essence replaces the hidden units of the RNN with GRU module units as shown in Figure 10, effectively solving the gradient disappearance problem caused by the short-term memory of the ordinary RNN. GRU combines the forget gate and input gate in LSTM into an update gate. The final model has fewer tensors and fewer parameters than the LSTM model, and it is faster than LSTM in terms of running speed and simpler training process.

The GRU module unit calculates the reset gating state $r_t$ and the update gating state $z_t$ through the input $x_t$ of the current node and the output $h_{t-1}$ of the previous node.

$$r_t=\sigma \left(W_r\cdot \left[h_{t-1}{,x}_t\right]\right)$$

(17)

$$z_t=\sigma \left(W_z\cdot \left[h_{t-1}{,x}_t\right]\right)$$

(18)

After getting the signal, first, get the reset data by multiplying $h_{t-1}$ and $r_t$, and then splice with the $x_t$, and use the $\tanh$ activation function to scale the data to the range of [−1, 1] to get the current hidden state $h$.

$${\tilde{h}}_t=tanh\left(W_{\tilde{h}}\cdot \left[r_t\cdot h_{t-1},x_t\right]\right)$$

(19)

“Update memory” is the core calculation step of GRU. Forgetting and memory are carried out at the same time. The previously obtained update gate $z$ is used as the forgetting gate, $1-z$ is used as the input gate, and the expression is updated as in Equation (20). This is the biggest difference from LSTM because GRU uses the same gate to control $z$, and accomplishes forgetting and memory at the same time. The gate control signal $z\in [0,1]$, the closer its value is to 0, the more the data is forgotten; conversely, the closer it is to 1, the more data it retains.

$$h_t=z_t\cdot {\tilde{h}}_t+\left(1-z_t\right)\cdot h_{t-1}$$

(20)

$W_z$, $W_r$ and $W_{\tilde{h}}$ denote the weight matrices of the GRU neural network training at time t. They consist of the following two weight matrices, respectively.

$$W_z=W_{zx}+W_{z\tilde{h}}$$

(21)

$$W_r=W_{rx}+W_{r\tilde{h}}$$

(22)

$$W_{\tilde{h}}=W_{\tilde{h}x}+W_{\tilde{h}\tilde{h}},$$

(23)

where $W_{\mathit{zx}}$, $W_{\mathit{rx}}$, and $W_{\tilde{h}x}$ are the weight matrix from the input value to the update gate, the reset gate, and the candidate value, respectively. $W_{z\tilde{h}}$, $W_{r\tilde{h}}$, and $W_{\widetilde{\mathit{hh}}}$ are the weight matrix from the last candidate value to the update gate $z_t$, the reset gate $r_t$, and the candidate’s value $\tilde{h}$ respectively.

In the above-mentioned models such as LSTM and GRU, the states are transmitted unidirectionally, and the mapping output of the neural network in this case is only based on the forward information of the temporal data. In this study, we adopt the BiGRU to build a ship trajectory prediction model. The structure of the BiGRU neural network is shown in Figure 11, where each training sequence in the BiGRU layer passes through two networks, forward and backwards respectively, and both networks are connected to the same output. This structure not only relies on the above information to adjust the neural network, but also can use the following information to adjust the network with feedback to improve the efficiency of weight update, and thus effectively improve the ship trajectory prediction effect.

3.2. Method for Detecting Abnormal Ship Behavior

The basic principle of the method in this study is to train the RNN using the results from the DBSCAN algorithm. Based on the previous trajectory points and historical traffic patterns, the RNN can be used as a real-time predictor of the ship’s normal trajectory. By judging the deviation of the actual trajectory from the predicted normal trajectory, it can detect whether the ship is sailing abnormally. The advantage of this method is that it does not realize abnormality detection by comparing with the normal trajectory model but carries out autonomous normal trajectory state recognition based on the learning characteristics of the deep neural network itself, and thus achieves more accurate trajectory anomaly detection. At the same time, it becomes very sensitive to the inefficiency of its prediction for trajectories that do not fit the historical regular movement patterns in the sea area. This is the reason why the neural network is chosen as a predictor in this study, and it will also predict differently for different degrees of anomalous behavior.

The framework of a ship’s abnormal behavior detection model established in this study is shown in Figure 12. The realization of the trajectory state real-time detection method mainly includes the following steps:

Step 1: Collect the AIS historical trajectory data in the monitored sea area; use the method in Section 3.2 to preprocess the AIS data, and then use the DBSCAN to extract the ship trajectory normal model.

Step 2: The normal trajectory clusters obtained by DBSCAN are used as the training objects of RNN to realize the prediction of the normal state of the ship at the next moment. The trajectory data set includes longitude ($\mathit{lon}$), latitude ($\mathit{lat}$), speed ($\mathit{sog}$), heading ($\mathit{cog}$). For a single trajectory, its trajectory feature at t moment is expressed as:

$$Y\left(t\right)=\{\mathit{lon},\mathit{lat},\mathit{sog},\mathit{cog}\}$$

(24)

In the process of the RNN training and prediction result output, we use a sliding window method to generate the input and output set. The ship’s normal trajectory prediction model can be defined as

$$\begin{array}{c}{Y(t+1),\dots ,Y(t+m)=f}_2\left(\right\{Y(t-n+1),\dots ,Y(t-2),Y(t-1),Y\left(t\right)\left\}\right)\end{array}$$

(25)

where $n$ is the time step length of the input layer, and $m$ is the step length of the predicted output.

Step 3: Through the ship’s previous navigation status and historical data in the water area, the next stage of the ship’s normal navigation status is predicted. In the actual navigation situation, most of the abnormal behaviors of ships are manifested in the three aspects of the ship’s position, speed, and course. Therefore, this study sets the standard of anomaly detection as the deviation value of a ship’s position, course, and speed, which is defined as:

$$\mathit{deviation}\_\mathit{value}=\{\begin{array}{c}\mathit{GeoDistance}\left({\mathit{pos}}_{\mathit{pre}}{,\mathit{pos}}_{\mathit{act}}\right)\\ \left|v_{\mathit{pre}}-v_{\mathit{act}}\right|\\ \left|c_{\mathit{pre}}-c_{\mathit{act}}\right|\end{array}$$

(26)

As shown in Figure 13, for the abnormal detection alarm, users can determine the alarm threshold of the deviation values of the ship position, speed, and course according to the actual demand and the performance of the network training. In particular, we set high and low thresholds for position detection, because ship position is the most intuitive representation of a ship’s navigation status. Our model warns the maritime traffic supervisors when the real-time ship data deviates from the high level or continuously exceeds the low-level thresholds. On the contrary, if the prediction results of the ship’s trajectory are accurate, it is considered to be in normal sailing condition.

4. Experiment and Analysis

4.1. Experimental Data and Preprocessing

The data used in this study are the AIS data of China’s Tianjin Port area for two months in 2019. All of the AIS data from cargo ships and tankers were selected as experimental data. The original data content is shown in

Table 2. The size of raw data in the research area.

Number of Dynamic Information	Number of Static and Voyage-Related Information	Number of Ships	Number of Ships with Additional Information
1,059,741	376,333	3884	2556

. After preprocessing, 11,357 trajectories from 2608 different ships were retained out of the original dataset of 712,214 track points. In the original data, 30.3% of the data has insufficient integrity. In the process of trajectory accuracy repair, 1.76% of the trajectory points had character errors, and it was detected that 0.67% of the trajectory points had motion logic errors; The trajectory compression ratio is 62.46%, and the final output is 267,365 key feature points of the AIS trajectory. The detailed processing information is shown in

Table 3. Trajectory integrity repair results.

Quality Issues	Number of Points Removed	Percentage
Information mismatch	169,876	16.00%
Insufficient spatial integrity	151,553	14.30%

,

Table 4. Trajectory accuracy repair results.

Quality Issues	Number of Abnormal Track Points	Percentage
AIS data field error	18,910	1.76%
Location error	5452	0.51%
Speed error	1736	0.16%

and

Table 5. Trajectory simplicity improvement results.

Processing Method	Number of Track Points after Compression	Compression Rate
Feature point extraction	267,365	62.46%

.

The preprocessing effect is shown in Figure 14. It can be seen that the messy trajectory and trajectory drift in the original data have been eliminated, and some phenomena that obviously did not conform to the logic of kinematics and navigational practices (crossing the land, trajectory mutations, etc.) have been resolved. While effectively compressing the number of ship trajectory points, the original ship trajectory features are retained.

4.2. Clustering Analysis

In order to verify the accuracy and clustering effect of the segmented improved DTW algorithm, we conducted a clustering comparison experiment of the improved DTW, DTW and Hausdorff. The experimental data set contains 334 ship trajectories, as shown in Figure 15. These trajectories have obvious differences in shape, direction, and ship starting and ending points. They are pre-marked as 8 trajectory clusters.

The DBSCAN algorithm is very sensitive to the selection of the neighborhood and the density threshold. The choice of parameters will directly affect the accuracy of clustering results. Through the parameter combination adaptive method [30], $\epsilon =0.3\mathrm{nm}$, $\mathit{MinTrs}=3$ are determined, in which the clustering effect of the density clustering algorithm reaches a more desirable state.

Figure 16 shows the DBSCAN clustering effect based on three different distance measurement methods. The trajectory sets of different colors represent different clusters, and the noise trajectory is not shown.

We use the clustering error rate (ER) to evaluate the clustering results. The error rate is defined as

$$\mathit{ER}=1-\frac{1}{N}{\sum }_{c=1}^k{p}_c$$

(27)

where $N$ is the total number of all trajectories, $K$ is the number of correct trajectory clusters, and $p_c$ is the number of correct trajectories in cluster $c$. The lower the $\mathit{ER}$, the higher the accuracy of the clustering algorithm. The evaluation of trajectory clustering results is shown in

Table 6. DBSCAN clustering results of different trajectory similarity measurement methods.

Similarity Metric Method	Number of Class Clusters	Error Rate
Hausdorff	4	0.1790
DTW	6	0.0870
Improved DTW	8	0.0058

.

The experimental results show that the trajectory clustering result of the improved DTW is eight types of clusters, which is basically consistent with the pre-labeled trajectory clusters. The clusters with local shape feature differences (cluster 1 and cluster 2 and cluster 4) and the trajectory sets with different start and end positions (cluster 2 and cluster 3 and cluster 6, cluster 7 and cluster 8) are more accurately identified. The trajectory clustering result of DTW is six types of cluster, and the clustering error rate is 8.7%. Some local shape features and starting and ending location features are ignored, and cluster 1 and cluster 2 cluster 7 and cluster 8, are identified as the same cluster. The clustering effect based on Hausdorff is the worst. The clustering result is four clusters, and the clustering error rate reaches 17.9%. Some trajectories in the opposite direction and large local shape differences are not recognized.

4.3. Ship Abnormal Behavior Detection Experiment

4.3.1. Ship Navigation State Prediction

As described in Section 3.2, we divide the trajectory clusters obtained by the DBSCAN clustering algorithm at a ratio of 75% and 25% and use them as the training set and test set to train BiGRU. And the time interval of the trajectory points in the data set is regularized to 2 min. To reduce the prediction error caused by the difference in magnitude, all data values are normalized before training.

Table 7. Experimental environment in this study.

Environment	Detailed Information
CPU	Intel(R) Core(TM) i7-6700 CPU 3.41 GHz
Memory	8.00 GB
System	Windows 10 operating system
Platform	TensorFlow 2.0
Programming	Python

shows the experimental environment of this study. After comparative experiments and manual adjustments, the optimal parameter combination of the BiGRU was finally determined. The time step of the input data obtained by the sliding window method is 5, and the time step of the output is 1. This means that in our method, the state of the ship at the next moment is also measured based on the five previous trajectory points. In order to judge the prediction effect more intuitively, we use the deviation between the predicted ship’s position, speed, course and the actual value to evaluate the prediction model.

Figure 17 shows the detailed results of ship position predictions of two real historical trajectories selected from the test set. The black arrow represents the direction of the ship’s trajectory. It can be seen that the predicted trajectory is highly coincident with the actual situation, and the non-linear behavior of the ship such as steering and speed change can be accurately predicted.

Table 8. The prediction results of test trajectories based on GRU.

Characteristics	No. 1 Historical Trajectory		No. 2 Historical Trajectory
	Maximum Error	Average Error	Maximum Error	Average Error
Position (m)	153.00	47.45	144.00	70.07
Speed (kn)	0.35	0.11	1.24	0.39
Course (°)	5.30	1.59	25.2	2.83

and

Table 9. The prediction results of test trajectories based on LSTM.

Characteristics	No. 1 Historical Trajectory		No. 2 Historical Trajectory
	Maximum Error	Average Error	Maximum Error	Average Error
Position (m)	258.00	70.13	146.00	83.21
Speed (kn)	0.35	0.10	1.18	0.41
Course (°)	5.10	1.58	26.50	3.42

show the prediction error results of these two test trajectories based on BiGRU, GRU and LSTM respectively, and it can be seen that BiGRU performs better than GRU and LSTM in terms of the average and maximum error in predicting the trajectory position, course and speed characteristics.

Figure 18 compares the average prediction error of BiGRU, GRU and LSTM neural network models with a different number of iterations based on the test set data, and the prediction errors of LSTM and GRU fluctuate widely with the number of iterations, while the prediction error of BiGRU is relatively stable, and the average error of ship position is basically controlled under 90 m. The prediction accuracy of the three methods showed an overall trend of BiGRU > GRU > LSTM, and BiGRU reduced the average prediction error by 13.1% compared with GRU and 21.3% compared with LSTM.

4.3.2. Ship Abnormal Behavior Detection

In this study, we consider vessel trajectory states that do not comply with the traffic patterns in the water as vessel anomalous behaviour, and three aspects are monitored: position, speed and course. Following the method in Section 3.2, we set the low threshold for ship position detection to 100 m and the high threshold to 250 m, and the anomaly thresholds for both heading and speed to ±3% of the predicted normative values.

As shown in Figure 19, in this experiment four real trajectories were chosen to verify the anomaly detection capability of the proposed method, and the detailed descriptions of the four tracks are shown in

Table 10. Description of experimental trajectory.

Track No.	Voyage Duration (min)	Trajectory Anomaly Type Description
No. 1	120	Abnormal path, Abnormal steering and shifting
No. 2	46	Abnormal steering repeatedly crossing the channel
No. 3	30	Sudden stop in the channel
No. 4	90	Abnormal steering, Sudden stop

.

Figure 20 shows the abnormal detection detailed results for “Trajectory No.1”. The black arrow represents the direction of the ship’s trajectory. The real-time details of the anomaly warnings during the ship navigation are shown in

Table 11. Details detection results of trajectory abnormal based on BiGRU.

Alert No.	Point No.	Time	Course (°)	Speed (kn)	Position Deviation (m)
Alert (1)	No.45	12:32	292.3	9.7	77
Alert (1)	No.44	12:34	288.5	9.7	159
Alert (1)	No.43	12:36	297.1	9.7	140
Alert (1)	No.42	12:38	284.2	9.7	70
Alert (2)	No.26	13:10	294.1	9.7	72
Alert (2)	No.25	13:12	306.1	9.5	263
Alert (2)	No.24	13:14	269.3	9.1	156
Alert (2)	No.23	13:16	249.1	9.3	246
Alert (2)	No.22	13:18	286.4	8.4	154
Alert (2)	No.21	13:20	287.9	8.9	293
Alert (3)	No.11	13:40	279.7	15.4	39
Alert (3)	No.10	13:42	279.8	18.1	169
Alert (3)	No.9	13:44	281.2	19.0	222
Alert (4)	No.6	13:50	280.8	14.9	133
Alert (4)	No.5	13:52	280.8	13.2	301
Alert (4)	No.4	13:54	280.8	12.4	283

. It can be seen that the trajectory does not follow the prescribed route at the channel turning point, but sails into a reverse route, and the change of the trajectory point heading is 292.3 at 12:32, which is beyond the predicted normal course range and triggers the trajectory heading anomaly warning, and then (12:34–12:36) the change of its course continues to cause a large deviation of the ship position from the real-time predicted normal trajectory. The low-grade trajectory position anomaly warning is triggered until 12:40 when the ship resumed normal sailing status and the anomaly Alert (1) ended.

During the navigation in the main channel, at 13:10, the ship turned to the right sharply, and then (13:12) the predicted normal position of the trajectory was still in the channel, while its real position had already sailed out of the channel, which triggered the high-grade trajectory position anomaly warning, and then, (13:12–13:20) the ship’s course was still in an unstable abnormal state, and the position anomaly warning was continuously triggered until 13:22 when the ship returned to the normal the abnormal Alert (2) ends. In addition, the abnormal fluctuation of ship speed caused by abnormal ship steering is also successfully detected and recognized in the abnormal Alert (1) and abnormal, Alert (2).

At 13:40, although the ship was traveling along a normal course in the channel, the normal trajectory speed predicted by the model was 12 kn at this time, its real speed increased abruptly by 3.2 kn in 2 min, triggering the abnormal speed warning. This abnormal variable speed behavior is against good seamanship and may affect the traffic flow across the channel, causing the potential danger of marine traffic accidents. Then, its speed continued to increase abruptly causing its trajectory to continuously deviate from the predicted normal position, triggering an abnormal trajectory position, Alert (3). Subsequently, at 13:50, the ship’s speed plummeted by 3.6 kn, triggering the abnormal Alert (4).

The results of the abnormal ship trajectory of “Trajectory No.1” above show that the proposed method can detect the abnormal navigation behavior of the ship in time and accurately from the three aspects of ship trajectory point position, speed and course.

We believe that the core goal of ship abnormal behavior detection is to accurately issue an alarm within the shortest time at the moment of abnormal occurrence, so as to prevent the dangerous situation from deteriorating as much as possible in a timely and effective manner. Therefore, we introduce three indicators to evaluate the experimental results: trajectory detection accuracy rate, trajectory detection false rate and alarm timeliness.

The detection accuracy rate (AR) refers to the ratio of the abnormal trajectory points detected by the algorithm to the actual abnormal trajectory points in the process of ship trajectory abnormality detection, which is calculated as Equation (28).

$$\mathit{AR}=1-\frac{N}{M}\times 100\%$$

(28)

where $M$ is the actual number of abnormal trajectory points in the ship navigation and $N$ is the number of undetected abnormal trajectory points.

The detection false rate (FR) alarm rate refers to the ratio of normal track points that are incorrectly identified as abnormal track points. It is calculated as Equation (29). $M_t$ indicates the number of normal trajectory points of the trajectory, and $N_f$ indicates the number of misidentified abnormal trajectory points.

$$\mathit{FR}=\frac{N_f}{M_t}\times 100\%$$

(29)

Detection timeliness refers to whether the ship trajectory anomaly detection algorithm can recognize the occurrence of trajectory anomaly in time and the computing time consuming of the algorithm, which can measure the real-time anomaly detection ability of the algorithm.

Table 12. Evaluation of ship trajectory anomaly detection results based on BiGRU.

Track No.	Time Consuming (ms)	AR	FR	Timeliness
				Abnormal Occurrences Times	Timely Identification Times
No.1	36.2	93.75%	6.66%	4	4
No.2	19.8	91.66%	0.00%	2	2
No.3	12.6	100%	0.00%	1	1
No.4	9.4	100%	0.00%	2	2
Average	—	96.35%	1.67%	—	—

,

Table 13. Evaluation of ship trajectory anomaly detection results based on GRU.

Track No.	Time Consuming (ms)	AR	FR	Timeliness
				Abnormal Occurrences Times	Timely Identification Times
No.1	25.8	81.25%	13.33%	4	3
No.2	12.3	91.66%	12.50%	2	2
No.3	9.7	100%	0.00%	1	1
No.4	5.2	100%	0.00%	2	2
Average	—	93.23%	6.46%	—	—

and

Table 14. Evaluation of ship trajectory anomaly detection results based on LSTM.

Track No.	Time Consuming (ms)	AR	FR	Timeliness
				Abnormal Occurrences Times	Timely Identification Times
No.1	29.1	87.50%	15.55%	4	3
No.2	16.5	83.33%	12.50%	2	2
No.3	10.9	100%	11.11%	1	1
No.4	8.3	81.81%	0.00%	2	2
Average	—	88.15%	9.79%	—	—

show the evaluation of the experimental results for the three models, respectively. It can be seen that in the detection process of four experimental trajectories, the average detection accuracy of BiGRU-based and GRU-based trajectory anomaly detection is higher at 96.35% and 93.23%, respectively. In addition, the LSTM-based fails to effectively identify some of the abnormal trajectory points, with an average detection accuracy of 88.15%.

In terms of detection false alarm rate, the BiGRU model only misidentified three trajectory points in “Track No.1”, while the average false alarm rates for GRU and LSTM were relatively high at 6.46% and 9.79%, respectively.

In terms of detection timeliness, a total of nine anomalous behaviors occurred in the four simulated voyages, and the number of timely recognitions was nine for the BiGRU trajectory anomaly detection model and eight for both GRU and LSTM. Moreover, as the number of experimental trajectory points increases, the Time Consuming of the BiGRU model increases less, and the real-time performance of trajectory anomaly detection is better.

The experiments show that the proposed method can detect the abnormal behavior of the ship in three aspects: position, speed and heading in a timely and effective manner.

5. Conclusions

Maritime traffic monitoring based on maritime data and computer technology can overcome the limitations of traditional methods in terms of the inexperience and physical fatigue of supervisors. It can also improve the level of intelligence of maritime supervision, provide valuable information about the maritime traffic situation, assist in dangerous supervision, reduce the occurrence of maritime accidents and illegal acts, and optimize the efficiency of traffic flow. In this paper, we take the ship trajectory data broadcasted by the AIS as the research object and propose a ship trajectory anomaly detection method with AIS trajectory data as the driver, ship trajectory clusters as the normal model, and deep neural network as the anomaly detection tool.

The contribution of this study is threefold. Firstly, the data quality issues in real AIS data are analyzed, and three aspects of AIS data quality are summarized, including spatial and temporal integrity, physical accuracy, and data conciseness. To overcome these problems, a complete set of general trajectory pre-processing methods is proposed, mainly including ship trajectory segmentation expression, base abnormality repair, position abnormality repair, and speed abnormality repair. The spatio-temporal feature points in the ship trajectory are extracted to ensure the compression rate, while the features of the original trajectory are highly restored, which effectively saves the computational cost of data mining.

Secondly, it uses the advanced unsupervised machine learning model DBSCAN algorithm for extracting higher quality maritime normative traffic models. In particular, in order to measure the similarity between trajectories more accurately, this study improves the traditional DTW algorithm to be able to identify the direction, local shape features and start and stop location of trajectories. In the comparison experiments, the accuracy of the improved DTW algorithm reached 99.42%, which is much higher than that of the ordinary DTW and Hausdorff, verifying the performance of the proposed method.

Thirdly, we build a ship trajectory prediction model based on BiGRU to solve the problem of gradient disappearance and gradient explosion of RNN and make the prediction model consider the contextual information of trajectory information to effectively improve the accuracy of prediction. Moreover, it is used as a detector to comprehensively judge the position, heading and course of the ship during navigation, and realize the real-time abnormal detection of a ship heading in the water. We also compared BiGRU with two other deep learning algorithms, LSTM and GRU, both of which showed some missed and false alarms and untimely alarms, while BiGRU achieved 96.35% accuracy in anomaly detection and only 1.67% false alarm rate, and timely warning of anomalous ship behavior. This verifies the superior performance of our proposed method in detecting abnormal ship behavior.

However, this method requires a high-quality sample trajectory model, such as data pre-processing, normal trajectory clustering and neural network training to have an impact on the detection effect. In the data pre-processing, some data that cannot match dynamic and static information, as well as those with fewer valid trajectory points are eliminated, and the repair of such data can be considered in future research to achieve the optimal utilization of AIS information mining. The normal model in this study only selects cargo ships and tankers, and shorter ships, such as fishing vessels, should be considered in the future, which is more effective for anomaly detection in specific waters. To meet the practical application requirements, the adaptive capability of updating the normal model to integrate new data should also be strengthened. In addition, in practice, ship behavior is related to the spatial and temporal context in which the ship is located at the moment, including the interaction of other ships around, weather conditions, sea state and other factors. Correlating spatio-temporal semantic analysis of ship navigation environment with ship behavior anomaly detection is also one of the future research priorities.