Ship Anomalous Behavior Detection Based on BPEF Mining and Text Similarity

Abstract

Maritime behavior detection is vital for maritime surveillance and management, ensuring safe ship navigation, normal port operations, marine environmental protection, and the prevention of illegal activities on water. Current methods for detecting anomalous vessel behaviors primarily rely on single time series data or feature point analysis, which struggle to capture the relationships between vessel behaviors, limiting anomaly identification accuracy. To address this challenge, we proposed a novel vessel anomaly detection framework, which is called the BPEF-TSD framework. It integrates a ship behavior pattern recognition algorithm, Smith–Waterman, and text similarity measurement methods. Specifically, we first introduced the BPEF mining framework to extract vessel behavior events from AIS data, then generated complete vessel behavior sequence chains through temporal combinations. Simultaneously, we employed the Smith–Waterman algorithm to achieve local alignment between the test vessel and known anomalous vessel behavior sequences. Finally, we evaluated the overall similarity between behavior chains based on the text similarity measure strategy, with vessels exceeding a predefined threshold being flagged as anomalous. The results demonstrate that the BPEF-TSD framework achieves over 90% accuracy in detecting abnormal trajectories in the waters of Xiamen Port, outperforming alternative methods such as LSTM, iForest, and HDBSCAN. This study contributes valuable insights for enhancing maritime safety and advancing intelligent supervision while introducing a novel research perspective on detecting anomalous vessel behavior through maritime big data mining.

1. Introduction

With the increasing density of maritime traffic, the maritime navigation environment has become more complex, leading to higher demands for maritime safety supervision [1]. Against this backdrop, anomaly detection for vessel behavior has emerged as a critical tool for ensuring maritime safety and combating illegal activities [2]. By leveraging anomaly detection algorithms to effectively identify deviations in vessel navigation and behavioral patterns, overall waterway traffic safety is enhanced, and monitoring and early warning capabilities for potential illegal activities are strengthened. It provides the scientific foundation and technical support essential for achieving intelligent maritime regulation.

Anomaly refers to phenomena that are unusual or deviate from the norm. The concept of anomalous behavior originates from statistics and, in the context of vessel trajectory data mining, involves modeling normal behaviors by capturing predictable and repetitive patterns. Anomalous behaviors are those that do not conform to this model [3]. Normal vessel behaviors typically involve movements or patterns consistent with standard maritime operations, such as steady navigation, docking, and routine port activities. In contrast, anomalous behaviors are characterized by significant deviations from these expected actions, such as erratic course changes, disappearance of the vessel’s trajectory, or unusual navigation paths. These behaviors often indicate potential illegal activities or violations of maritime safety regulations. Traditional vessel anomaly detection has primarily relied on manual operations performed by land-based monitoring personnel. However, with the continuous growth of vessel traffic and the increasing complexity of environmental factors, manual monitoring is facing numerous limitations and struggling to meet the demands of modern intelligent maritime management [4]. In recent years, research on vessel anomaly detection methods has mainly focused on three categories: rule- and statistics-based methods, machine learning-based methods, and trajectory prediction-based methods [5,6,7].

Rule- and statistics-based methods are among the earliest solutions applied in maritime anomaly detection. These methods build probabilistic models of normal vessel behavior using mathematical modeling and statistical analysis, allowing for the identification of deviations and anomalous behaviors. Researchers analyze historical AIS data to examine features such as the spatial distribution and speed variations of vessel trajectories, identifying activities that deviate from normal navigation patterns [8]. Typical rule- and statistics-based methods include cluster analysis and dynamic differential thresholds. Cluster analysis models historical trajectories based on vessel characteristics like type, size, and destination, extracting regular routes and key waypoints [9,10,11]. The dynamic differential threshold method improves traditional distance algorithms by incorporating vessel motion characteristics, which enhances the accuracy of anomaly detection within specific time periods. Trajectory clustering groups vessel features such as speed, heading, and coordinates, enabling effective detection of potential anomalous behaviors [12,13].

Machine learning-based methods have demonstrated increasingly outstanding performance in complex scenarios in recent years. These methods allow the learning of patterns and relationships automatically from data, handle complex datasets, and detect anomalies that traditional methods may fail to identify. Researchers establish models of normal vessel behavior and compare new behavioral data against these models to flag anomalies [14]. For example, the combination of CNN (convolutional neural networks) and RAE (recursive autoencoders) optimizes feature extraction, significantly improving detection accuracy [15,16]. The joint use of density clustering algorithms (such as DBSCAN) and iForest (isolation forest) enhances the ability to identify complex anomalous behaviors [17]. Additionally, recent studies combine KNN (K-nearest neighbors) clustering with cross-trajectory attribute analysis, achieving significant progress in data preprocessing and model parameter optimization [18,19,20].

Prediction-based methods have become a research focus in maritime anomaly detection. These methods typically rely on time series models, such as LSTM (long short-term memory), transformer, and GRU (gate recurrent unit), to predict future vessel positions and speeds and detect anomalies by comparing predicted positions with actual ones [21]. Researchers have explored various directions in applying this approach. For instance, some studies use DBSCAN clustering results as traffic patterns to input into time series models, supporting real-time trajectory prediction and anomaly detection [22]. Other studies introduce regression models to quantify the uncertainty of future trajectories, further enhancing system robustness and detection accuracy [23]. In summary, maritime anomaly detection methods continue to evolve, with increasing integration and development among rule-based, statistical, machine learning, and trajectory prediction models. Rule-based methods, due to their simplicity and intuitiveness, suit static scenarios; machine learning-based methods excel in complex dynamic environments; and prediction-based methods offer clear advantages in real-time analysis and anomaly warning [24].

However, existing vessel anomaly detection methods often rely on single time series data or feature point analysis when building models, failing to fully consider the interrelationships and sequential features of vessel behavior [25,26]. Current methods struggle to capture subtle changes in complex behavioral patterns, which limits their effectiveness in identifying potential anomalous behaviors [27,28]. Specifically, traditional trajectory similarity calculation methods typically base their analysis on global similarity, often overlooking differences in local behavioral features, leading to false positives or false negatives [29]. Moreover, existing methods demonstrate poor robustness when handling dynamic environmental changes and lack the ability to perform comprehensive analysis of multidimensional behavioral features [30]. Therefore, there is a need for a method that integrates time series features, local behavioral feature differences, and multidimensional correlation analysis to more effectively identify potential vessel anomalies while maintaining high robustness and accuracy in dynamic environments.

With the rapid development of NLP (natural language processing) technologies, research on text similarity has provided new insights for overcoming the limitations of current vessel anomaly detection methods. Text similarity algorithms offer significant advantages in analyzing structured sequences, capturing both local and global feature differences, and modeling multi-dimensional features, demonstrating strong adaptability. These techniques exhibit high robustness and accuracy when handling dynamic and diverse data structures [31,32,33]. Amur et al. pointed out that traditional methods face significant limitations when processing short texts, as the limited information in short texts makes it difficult to accurately assess text similarity through simple lexical matching [34]. Zhou et al. proposed a model combining text and syntactic information, which enhances text understanding through graph convolutional networks, significantly improving performance on short text similarity tasks [35]. Additionally, Schopf et al. introduced the Lbl2Vec method, which performs unsupervised text classification by learning the similarity between text and labels without requiring large-scale labeled data [36]. Ismail et al. proposed a word alignment method particularly suitable for text similarity in Arabic, addressing the complexities and morphological variations in the language [37]. Deforche et al. further advanced the field by introducing a hierarchical orthographic similarity measure for interconnected texts. This method significantly improves the accuracy and interpretability of text similarity measurement by graphically representing texts and calculating structural similarities [38].

In response to the challenges faced by current vessel anomaly detection methods, we propose a novel vessel anomaly detection framework named BPEF-TSD (behavior pattern extraction framework and text similarity-based detection). This framework integrates the vessel behavior pattern recognition algorithm BPEF mining model, the Smith–Waterman local sequence alignment algorithm, and a text similarity measurement algorithm. First, we use the BPEF mining model to capture vessel behavior events from historical AIS data over different time periods and then perform temporal combination operations to construct a complete behavioral sequence chain for the vessel. Next, we apply the Smith–Waterman algorithm to locally align the target vessel’s behavioral sequence chain with those of known anomalous vessels. Finally, we calculate the overall similarity between behavioral sequence chains using an improved text similarity algorithm, marking vessels with similarity exceeding a certain threshold as anomalous.

2. Methods

The framework of the BPEF-TSD method, as shown in Figure 1, is structured as follows. First, we use the BPEF mining model to mine and identify all behavioral patterns of the target vessel, generating corresponding behavioral sequence chains through associative combinations. Then, the Smith–Waterman algorithm is applied to locally align the target vessel’s behavioral sequence chain with those of known illegal vessels, identifying the most similar local segments. Next, we improve the Jaro–Winkler text similarity algorithm and, in conjunction with the LCS (longest common subsequence) algorithm, calculate the overall similarity between the target vessel’s behavioral sequence chain and those of known illegal vessels. This process evaluates the similarity between local sequence fragments while quantifying the differences between local and complete fragments. Finally, to ensure the detection algorithm effectively distinguishes between normal and anomalous behaviors, we apply an alternating optimization method to determine relevant weights and thresholds, achieving accurate and efficient anomaly detection.

2.1. BPEF Mining Modeling

2.1.1. AIS Data Processing

Select the target detection area and filter the AIS data of vessels within the specified time range for that area while also collecting AIS data of vessels that have been identified as anomalous by maritime authorities. The AIS data contain a wealth of information related to vessel navigation, but errors may occur during transmission, reception, encoding, and decoding processes. Therefore, it is necessary to preprocess the AIS data before analyzing vessel anomalies in order to reduce the impact of erroneous data on subsequent experiments. The main steps of AIS data preprocessing are as follows:

• MMSI Code Validation: Retain MMSI codes with a length of 9 digits to ensure the uniqueness of maritime mobile communication services.
• Geographic Range Filtering: Retain data with longitude less than 180° and latitude less than 90° to ensure geographic validity.
• Speed and Course Validation: Retain records with speed and course within normal ranges. Specifically, we limit heading values strictly to between 0 and 360 degrees to conform with standard navigational practices, where 0 degrees represents true north and 360 degrees completes the circle, thus ensuring all heading values are within this circular range. Additionally, speeds are ensured not to exceed a reasonable range, relevant to the type of vessel and prevailing conditions.
• Redundant Data Removal: Remove duplicate records from the AIS data. Additionally, if a ship has insufficient trajectory points to reflect its movement characteristics, such data are discarded.
• Drift Point Filtering: Eliminate trajectory drift points in the ship navigation data to improve accuracy.

2.1.2. Behavioral Pattern Characteristics

We define vessel behavior patterns by combining the vessel behavior characteristics. Then, we develop a vessel behavior pattern detection algorithm to mine behavior patterns from vessel AIS trajectory data, laying the foundation for constructing vessel behavioral sequence chains and calculating their similarity. Vessel behavior characteristics refer to the regularities and dynamic variations exhibited by a vessel during its voyage, which can be classified into temporal, spatial, and other aspects. Other aspects include speed stability, movement stability, low-speed maintenance, and positional sequence symmetry [39]. The definition and mathematical expression of the vessel behavior model are shown in

Table 1. Definitions and mathematical expressions for ship behavior patterns. The mathematical expression includes the type of behavior pattern and the conditions associated with the pattern (such as temporal sequence, time intervals, location conditions, etc.). Here, o_i represents the vessel object involved in the behavior pattern; (t_a, t_b) denotes the timestamp set of the behavior pattern, indicating the time period from t_a to t_b.

Behavioral Pattern	Definition and Mathematical Expressions
Stay	The vessel maintains a low speed or even a speed of zero over a period of time, typically occurring during berthing or anchoring processes, with trajectory points densely distributed in space.
	${{\rm B}}_{Stay}=⟨Stay\left(time,position,stability\right),o_i,\left(t_a,t_b\right)⟩$
Jump	Due to AIS signal interruption or equipment malfunction, the vessel experiences missing trajectory data over a period of time, resulting in longer time gaps between trajectory points and causing breaks or jumps in the trajectory.
	${\mathsf{{\rm B}}}_{Jump}=⟨Jump\left(time,displacement\right),o_i,\left(t_a,t_b\right)⟩$
Deviation	The vessel deviates from its regular course over a period of time, with the trajectory straying from the main shipping lane, typically accompanied by abnormal changes in speed or heading.
	${\mathsf{{\rm B}}}_{Dev}=⟨Deviaction\left(time,position\right),o_i,\left(t_a,t_b\right)⟩$
Gather	The vessel remains at low speed or in a stationary state over a period of time and comes into close proximity with other vessels within the same spatial range, forming a cluster of vessels.
	${\mathsf{{\rm B}}}_{Gather}=⟨Gather\left(density,velocity\right),o_i,\left(t_a,t_b\right)⟩$
Accompany	Over a period of time, the vessel maintains a similar movement trajectory with one or more other vessels, remaining spatially close and synchronously moving within a similar timeframe.
	${\mathsf{{\rm B}}}_{Acc}=⟨\begin{array}{c}Accompany\left(\mathrm{SpatialProximity},\mathrm{TemporalSynchronization}\right),\\ (o_i,o_j),\left(t_a,t_b\right)\end{array}⟩$
Turn back	Over a period of time, the vessel repeatedly travels back and forth between symmetric starting and destination points, following the same routes or positional points.
	${\mathsf{{\rm B}}}_{Tback}=⟨Tback\left(place1,place2,...\right),o_i,\left(t_a,t_b\right)⟩$

.

2.1.3. Behavioral Pattern Association Combinations

Behavior pattern association and combination consist of two parts: the minimal operator computation set and the behavior pattern combination operation. Vessel behavior combination operation is a further combination of behavior patterns based on the minimal operator computation.

The minimal operator computation set forms the foundation for combining vessel behavior patterns. It is primarily divided into three categories: logic-based operators, time series-based operators, and other types of operators. This study focuses on time series-based operators. Specifically, the occurrence time of a behavior pattern is represented by an interval timestamp. We classify the relationships between behavior pattern interval timestamps into three types: (1) The interval timestamps of two behavior patterns do not overlap, (2) the interval timestamps of two behavior patterns completely overlap, and (3) the interval timestamps of two behavior patterns partially overlap. When the interval timestamps of two behavior patterns do not overlap, the sequence of the behavior patterns can be clearly identified. When the interval timestamps of two behavior patterns completely overlap, it indicates that the two behavior patterns occur concurrently within the same interval. When the interval timestamps partially overlap, we use the interval timestamp segmentation method to determine whether the behaviors occur sequentially or concurrently.

Based on the minimal operator computation set, we combine vessel behavior patterns to describe the vessel’s navigation process. The temporal combination operation takes into account the temporal relationships between behaviors, with operators such as “precedes”, “succeeds”, and “concurrent” involved. Figure 2 illustrates an example of the association and combination between two behavior patterns.

2.2. Behavioral Sequence Chain Construction

2.2.1. Behavior Symbolization and Vector Construction

The BPEF mining model provides a systematic framework for mining vessel behavior patterns and outlines the associations and combinations between different vessel behavior patterns. Next, we symbolize vessel behavior patterns by assigning a specific symbol to each pattern. For example, “S” represents stationary behavior, and “D” represents deviation from the route. This symbolic representation lays the foundation for constructing vessel behavior sequence chains.

Table 2. Symbolic representation of ship behavior patterns.

Vessel Behavior Patterns	Symbolic Representation
Stay	“S”
Jump	“J”
Deviation	“D”
Gather	“G”
Accompany	“A”
Turn back	“T”

lists the symbolic representations of vessel behavior patterns.

To accurately capture the dynamic and spatial information of each vessel behavior pattern, we assign a corresponding feature vector to each behavior pattern during the symbolic representation process. This vector is denoted as $V=\left[T,G,S,Sin\left(\theta \right),Cos\left(\theta \right)\right]$. Each element in the vector represents a feature in a specific dimension, as detailed below:

• Time Ratio (T): The time ratio represents the relative position of a specific behavioral pattern within the entire behavioral period. It normalizes the occurrence time of a behavior into the range of [0, 1]. Specifically, T_event, T_start, and T_end represent the absolute time of the behavioral event, the time the vessel enters the specified area, and the time it leaves, respectively, all measured in seconds. The time ratio is calculated as shown in Equation (1).

$$T={\displaystyle \frac{T_{event}-T_{start}}{T_{end}-T_{start}}}$$

(1)

2.

Grid encoding (G): Grid encoding represents the vessel’s geographical location by mapping its latitude and longitude coordinates to predefined grids. The area of interest is divided into fixed-size grids (e.g., 0.01° × 0.01°), and the vessel’s coordinates are assigned to the corresponding grid, producing the grid index G, This index is calculated based on the row (Row) and column (Col) indices of the grid. The specific calculation method is Equations (2)–(4).

$$\mathrm{Grid} \mathrm{row} \mathrm{index} (\mathrm{Row})={\displaystyle \frac{ \mathrm{Latitude}-{\mathrm{Latitude}}_{\min }}{\mathrm{Grid} \mathrm{size} }}$$

(2)

$$\mathrm{Grid} \mathrm{column} \mathrm{index} (\mathrm{Col})={\displaystyle \frac{\mathrm{Longitude}-{\mathrm{Latitude}}_{\min }}{\mathrm{Grid} \mathrm{size} }}$$

(3)

$$\mathrm{Grid} \mathrm{index} \left(G\right)=\mathrm{Row} \times \mathrm{Total} \mathrm{number} \mathrm{of} \mathrm{columns}+\mathrm{Col}$$

(4)

3.

Speed Over Ground (S): S represents the rate at which a vessel moves per unit of time and is typically measured in knots (1 knot = 1 nautical mile/h). This value is directly obtained from AIS data.

4.

Sine and cosine values of heading angle(Sin(θ), Cos(θ)): The heading angle θ, measured in degrees and directly obtained from AIS data, is cyclic since 0° and 360° represent the same direction and is transformed into its Sin(θ) and Cos(θ) values to better capture this periodicity. The specific calculation method is outlined in Equations (5) and (6).

$$Sin\left(\theta \right)=Sin\left({\displaystyle \frac{2\pi \times \theta }{360}}\right)$$

(5)

$$Cos\left(\theta \right)=Cos\left({\displaystyle \frac{2\pi \times \theta }{360}}\right)$$

(6)

2.2.2. Behavioral Sequence Chain

Through the BPEF mining model in Section 2.1 of this paper, we mine all behavior patterns of the target vessel and known anomalous vessels, converting them into corresponding behavior symbols as described in Section 2.2.1. Then, based on the temporal sequence combination of vessel behavior patterns, all behavior pattern symbols are sorted by occurrence time, and the feature vectors of each behavior pattern are similarly ordered, ultimately forming a vessel behavior sequence chain with associated feature vectors. The specific construction process of the ship behavior sequence chain is shown in Figure 3.

2.3. Anomaly Detection

After constructing the vessel behavior sequence chain, the similarity between the target vessel’s behavior sequence and that of anomalous vessels is compared. We propose an improved Jaro–Winkler similarity algorithm to calculate the similarity between locally optimal matching sequences aligned by the Smith–Waterman algorithm. Additionally, to reduce the impact of sequence completeness on anomaly detection results, we apply the LCS method to evaluate the integrity of the behavior sequence chains. Next, we apply an alternating optimization method to determine three weight parameters and an anomaly threshold. Using these parameters, we calculate the overall similarity between vessel behavior sequence chains. Finally, anomalous vessels are identified by comparing the combined similarity with the anomaly threshold.

2.3.1. Smith–Waterman Local Alignment

The Smith–Waterman algorithm is a dynamic programming method widely used for local sequence alignment in bioinformatics. It constructs a dynamic programming matrix to evaluate all possible alignments and determine the optimal local alignment. In this study, the algorithm is applied to locally align the behavior sequence chains of the target vessel and anomalous vessels. By optimizing the scoring matrix and considering matches, mismatches, insertions, and deletions, the best local alignment between the two sequence chains is determined through backtracking of the score matrix.

We select the behavioral sequence chains S₁ from the target vessel and S₂ from the anomalous vessel, with lengths $m=\left|S_1\right|$ and $n=\left|S_2\right|$, respectively. We construct a score matrix D of size $\left(m+1\right)\times \left(n+1\right)$, where each cell represents the best alignment score up to that position. For each character pair in the two sequences, (1) we assign a match score of $m=3$ if the characters match; (2) we apply a mismatch penalty of $d=-3$ if the characters do not match; and (3) we introduce gaps in the sequences to account for misalignments, with a gap penalty of $g=-2$. A dynamic programming algorithm populates the score matrix D. Each cell’s value is determined by the maximum of four possible calculations: (1) The value from the diagonal cell plus the match score if the characters match or the mismatch penalty if they do not; (2) the value from the cell above, incremented by the gap penalty g; (3) the value from the cell to the left, incremented by the gap penalty g; and (4) a value of 0, indicating the start of a new local alignment.

Equation (7) and Figure 4 provide a detailed illustration of the computational steps involved in the Smith–Waterman algorithm.

$$D(i,j)=\left\{\begin{array}{l}D(i-1,j-1)+s\left(St\right[i],Si[j\left]\right)\\ D(i-1,j)+g\\ D(i,j-1)+g\\ 0\end{array}\right.$$

(7)

The score matrix initializes to zero, representing gaps at the start of the sequences and allowing local alignments to begin at any position within the chains. After filling all the cells, the highest value in the matrix D marks the endpoint of the optimal local alignment. Backtracking starts at this maximum value and continues towards the top-left corner, stopping when a cell with a value of 0 is reached. During backtracking, the optimal alignment is determined by these rules: (1) Move to the diagonal cell if the current cell originates from there and the characters match or mismatch; (2) move to the cell above if the current cell originates from it; and (3) move to the cell to the left if the current cell originates from it. For example, Figure 5 demonstrates the Smith–Waterman algorithm’s local alignment between the test sequence TGTTSCGG and the anomalous chain GGTTGSCTS. First, the score matrix is constructed and filled step-by-step, as shown in Figure 5a. Next, the highest value in the matrix is identified, marking the alignment’s endpoint. Following the backtracking rules, the process proceeds from this point, as shown in Figure 5b. Figure 5c highlights the most similar local regions, with vertical lines “|” representing matches and hyphens “-” indicating gaps.

2.3.2. Similarity Calculation

The similarity calculation between vessel behavior sequence chains consists of two parts: local similarity and comprehensive similarity. First, we propose an improved Jaro–Winkler algorithm to evaluate the local similarity between vessels, used to calculate the similarity between behavior sequence subsequences aligned by the Smith–Waterman algorithm. The Jaro–Winkler algorithm is a method for calculating the similarity between two strings, derived from the Jaro algorithm. The higher the score, the greater the similarity between the two strings, with a score of “1” indicating a perfect match and a score of “0” indicating no similarity. This algorithm is particularly suitable for calculating the similarity between short strings (such as behavior sequence subsequences) due to its high accuracy and efficiency when handling shorter strings.

The two aligned behavioral sequence sub-chains are denoted as S₁′ and S₂′, and the Jaro–Winkler similarity between them is computed using the formula in Equations (8) and (9). Specifically, M represents the sum of all match scores between behavioral sub-sequence chains, while |S₁′| and |S₂′| represent the lengths of strings S₁′ and S₂′. The term t refers to half the number of transpositions (e.g., if S₁′ and S₂′ have 6 matching characters, with 2 out of order, then t = 1). The factor P is the weighting factor (typically 0.1), and L represents the length of the common prefix, with a maximum value of 4.

$$Jaro={\displaystyle \frac{1}{3}}({\displaystyle \frac{M}{\left|{S_1}^{\prime }\right|}}+{\displaystyle \frac{M}{\left|{S_2}^{\prime }\right|}}+{\displaystyle \frac{M-t}{M}})$$

(8)

$$Jaro-Winkler=Jaro+P\times L\times \left(1-Jaro\right)$$

(9)

In the original Jaro–Winkler algorithm, the match score M between two strings increases by 1 only when characters match. In our improved algorithm, we first filter all successfully matched character pairs based on the match threshold R (Equation (10)) and add them to the match set M_set (Equation (11)). Here, S_1i′ and S_2j′ ∈ M_set represent the character pairs in the match set. The match threshold R defines the maximum allowable distance between matching characters in the two behavior subsequence chains. Next, we extract each matching character pair and its corresponding feature vectors V_1i and V_2j from the match set M_set and compute the Mahalanobis distance between them (Equation (12)). This calculation provides a more precise match score for each character pair.

$$R=⌊{\displaystyle \frac{\mathit{max}(\left|{S_1}^{\prime }\right|,\left|{S_2}^{\prime }\right|)}{2}}⌋-1$$

(10)

$$M_{set}=\left\{\left({S_{1i}}^{\prime },{S_{2j}}^{\prime }\right)\left|{S_{1i}}^{\prime }={S_{2j}}^{\prime },\left|i-j\right|\le R\right.\right\}$$

(11)

$${\mathrm{D}}_{\mathrm{M}}(V_{1i},V_{2j})=\sqrt{(V_{1i}-V_{2j}{)}^T{\mathsf{\Sigma }}^{-1}(V_{1i}-V_{2j})}$$

(12)

To prevent the direct summation of Mahalanobis distances from disproportionately affecting the overall similarity, we normalize all Mahalanobis distances (Equation (13)). After normalization, all distances are scaled to the [0, 1] range, eliminating biases caused by feature dimension differences and ensuring that each matching character pair contributes more fairly and consistently. Finally, we sum all the normalized Mahalanobis distances to obtain the final match score M (Equation (14)), providing a more accurate measure of the behavior pattern matching between the behavior subsequence chains.

$$D_M^{norm}({S_{1i}}^{\prime },{S_{2j}}^{\prime })={\displaystyle \frac{D_M({S_{1i}}^{\prime },{S_{2j}}^{\prime })-D_{min}}{{\mathrm{D}}_{\max }-{\mathrm{D}}_{\min }}}$$

(13)

$$M=\sum _{({S_{1i}}^{\prime },{S_{2j}}^{\prime })\in M_{set}}{D}_M^{norm}({S_{1i}}^{\prime },{S_{2j}}^{\prime })$$

(14)

We use the improved match score M to calculate the Jaro–Winkler similarity, thereby obtaining the similarity S_local between the target behavior subsequence and the anomalous behavior subsequence.

In the similarity calculation of behavior sequence chains, not only the similarity between the aligned behavior subsequences needs to be considered, but also the degree of change in the sequence chain, i.e., the completeness of the sequence chain. This completeness measure evaluates whether the characteristics of the original behavior sequence chain are adequately preserved during the registration process to prevent over-trimming, which could cause sequence bias and impact the reliability of the similarity calculation. To fully consider the impact of behavior sequence chains on the anomaly detection results, we introduce the LCS to mitigate the bias caused by information loss and quantify the integrity of the sequence chain. The LCS values of the target sequence chain completeness and the anomalous sequence chain completeness are denoted as S_self-1 and S_self-2, respectively.

Next, we propose a weighted composite similarity method to further improve the accuracy and reliability of the anomaly detection results. This method combines local similarity S_local, target sequence chain completeness S_self-1, and anomalous sequence chain completeness S_self-2, assessing the similarity between the target and the known anomalous sequence chains from multiple dimensions. Specifically, S_local represents the local similarity after alignment, i.e., the similarity between the behavior subsequences, while S_self-1 and S_self-2 reflect the completeness measures of the target and anomalous sequence chains, respectively. Finally, the calculation formula for the composite similarity S_comp is as follows:

$$S_{comp}=A\times S_{local}+B\times S_{self-1}+C\times S_{self-2}$$

(15)

where A, B, and C are weighting coefficients used to adjust the relative importance of each similarity measure in the overall evaluation.

2.3.3. Adaptive Parameter Adjustment

This study employs an alternating optimization method to adjust the weights and thresholds. The weights A, B, and C reflect the contributions of different similarity measures to the comprehensive similarity, while the threshold determines whether the comprehensive similarity meets the anomaly detection standard. The specific optimization process involves initially setting the weights and thresholds. The initial threshold is determined by the quantile (e.g., 75% or 85%) of the local similarity between known anomalous ship behavioral sequence chains, and multiple initial weight parameters are set based on the importance of different features.

In each iteration, the weights are optimized while the threshold is fixed, followed by the optimization of the threshold with the weights fixed. This process is repeated until the detection performance of the model stabilizes, ensuring a detection efficiency of 95% or higher. After determining the threshold and weights, the anomaly standards for ships are established based on the comprehensive similarity. The comprehensive similarity S_comp is compared to the predefined threshold:

If S_comp ≥ threshold, the target ship’s behavior is considered highly similar to anomalous behavior, and the ship is classified as anomalous.

If S_comp < threshold, the target ship’s behavior does not meet the anomaly similarity standard, and the ship is classified as normal.

2.4. Mainstream Algorithms for Ship Anomalous Behavior Detection

To demonstrate the effectiveness of the BPEF-TSD framework, we compared its performance with several representative anomaly detection algorithms, including LSTM (long short-term memory), iForest (isolation forest), and HDBSCAN (hierarchical density-based spatial clustering of applications with noise) algorithms. The details of these algorithms can be found as follows:

2.4.1. LSTM

LSTM is a specialized recurrent neural network (RNN) recognized for its strong performance in sequence-based tasks and is particularly well-suited for anomaly detection in time series data. By incorporating gating mechanisms such as the input gate, forget gate, and output gate, LSTM dynamically regulates the retention and discarding of information, addressing the gradient vanishing problem in traditional RNNs and effectively capturing long-term dependencies in time series data. The specific formula is as follows:

$$C_t=f_t·C_{t-1}+i_t·{\tilde{C}}_t$$

(16)

$$h_t=o_t·\mathrm{t}\mathrm{a}\mathrm{n}\mathrm{h}\left(C_t\right)$$

(17)

where C_t is the current memory state; C_t−1 is the memory state from the previous step; i_t is the input gate output, determining how much new information to add, with i_t ∈ [0, 1]; ${\tilde{C}}_t$ is candidate memory content, representing new input information, with ${\tilde{C}}_t$ ∈ [−1, 1]; o_t is output gate output, deciding how much of the memory state to reveal, with o_t ∈ [0, 1]; h_t is the hidden state, representing the current output of the LSTM cell; and tanh is the activation function used to scale values between [−1, 1].

2.4.2. iForest

The iForest method is based on the concept of “isolation” and constructs isolation trees by randomly selecting attributes and partitioning points to separate anomalous data. Inspired by the random forest approach, iForest is an unsupervised anomaly detection technique that operates on the core principle: “Outliers are more easily isolated”. This method integrates the temporal and spatial characteristics of AIS data, enabling it to effectively detect anomalies in both clustered and dispersed regions. iForest demonstrates exceptional computational efficiency when applied to high-dimensional datasets and reliably isolates anomalies, making it a powerful tool for anomaly detection. The specific formula is as follows:

$$s\left(x,n\right)=2^{-{\displaystyle \frac{E\left(h\left(x\right)\right)}{c\left(n\right)}}}$$

(18)

$$c\left(n\right)=2\mathrm{l}\mathrm{n}\left(n-1\right)+\mathsf{\gamma }-{\displaystyle \frac{2\left(n-1\right)}{n}}$$

(19)

where n is the number of samples in the dataset; $s\left(x,n\right)$ is the anomaly score of sample x, with $s\left(x,n\right)$∈ [0, 1]; $E\left(h\left(x\right)\right)$ is the expected path length of sample x, representing the number of splits needed to isolate x in the isolation tree; $c\left(n\right)$ is a normalization factor for the average path length in a dataset of size n; and $\mathsf{\gamma }$ is Euler’s constant (approximately 0.577).

2.4.3. HDBSCAN

HDBSCAN effectively addresses challenges associated with uneven data distribution. This advanced density-based clustering algorithm excels in detecting trajectory points with abnormal density distributions. Constructing a minimum spanning tree represents the hierarchical relationships between points, while sparse points are identified as noise based on a predefined density threshold. Points with low density are classified as anomalies. The specific formula is as follows:

$$core\text{\_}dist\left(p\right)=\mathrm{d}\mathrm{i}\mathrm{s}\mathrm{t}\mathrm{a}\mathrm{n}\mathrm{c}\mathrm{e}\left(p, k-th nearest neighbor\right)$$

(20)

$$mreach\left(p,q\right)=\mathrm{m}\mathrm{a}\mathrm{x}\left(core\text{\_}dist\left(p\right),core\text{\_}dist\left(q\right),\mathrm{d}\mathrm{i}\mathrm{s}\mathrm{t}\mathrm{a}\mathrm{n}\mathrm{c}\mathrm{e}\left(p,q\right)\right)$$

(21)

where $mreach\left(p,q\right)$ is the mutual reachability distance between points p and q, which reflects their local density relationship; $core\text{\_}dist\left(p\right)$ and $core\text{\_}dist\left(q\right)$ are the core distances of p and q, defining their local density; and $distance\left(p,q\right)$ is the direct distance between points p and q.

2.5. Evaluation Metrics

We evaluate the results based on the true labels of AIS data, the artificially labeled generated trajectories, and the predicted labels. The primary goal of anomaly detection is to improve the detection accuracy for the minority anomalous class. To assess the efficiency and accuracy of the BPEF-TSD anomaly detection framework, we use four evaluation metrics: accuracy (Acc), precision (P), recall (R), and F1-score. The formulas for calculating these metrics are as follows.

$$\mathrm{A}\mathrm{c}\mathrm{c}={\displaystyle \frac{T_N+T_P}{T_N+T_P+F_N+F_P}}$$

(22)

$$P={\displaystyle \frac{T_P}{T_P+F_P}}$$

(23)

$$R={\displaystyle \frac{T_P}{T_P+F_N}}$$

(24)

$$F1={\displaystyle \frac{2\times P\times R}{P+R}}$$

(25)

In the formula, T_P refers to true positives (correctly detected normal samples); T_N refers to true negatives (correctly detected anomalous samples); F_P refers to false positives (anomalous samples incorrectly detected as normal); and F_N refers to false negatives (normal samples misclassified as anomalous). Acc measures the model’s overall detection accuracy. P represents the precision in detecting positive samples, while R evaluates the proportion of correctly identified positive samples. The F1-score balances P and R, addressing the impact of class imbalances that can distort their values.

3. Experiments and Results

3.1. Study Area and Experimental Setup

We selected Xiamen Port and its surrounding waters as the experimental area for this study. Situated on the southeast coast of China, Xiamen Port is located at 118°04′ east longitude and 24°27′ north latitude, as shown in Figure 6. It is one of China’s significant coastal ports and serves as a key hub in the national transportation network. This study collected AIS data from Xiamen Port and its surrounding waters between 12 October and 31 December 2022, covering a geographical range of 24.30° to 24.60° north latitude and 117.80° to 118.45° east longitude, as shown in Figure 7. Within this study area, the average ship speed was 5.8 knots, with speeds ranging from 0 to 18.5 knots, and the average time interval between trajectory points was 2 min. After data cleaning and preprocessing, a total of 13,512 ship trajectories were obtained. To ensure the representativeness and reliability of model training and evaluation, the dataset was divided into a training set, validation set, and test set in a ratio of 3:1:1. The training set was used for model parameter learning, the validation set for optimizing hyperparameters, and the test set for evaluating model performance.

In maritime traffic, the number of ship behavior samples with anomaly labels is limited, and there is insufficient knowledge of potential anomalous behaviors. In order to obtain more trajectories of anomalous ship behavior, we need to mix anomalous behavior with known normal behavior. Consequently, this study introduces a method for generating anomalous trajectories based on existing AIS data. The steps involved are as follows:

First, we randomly select a trajectory from normal behavior samples and choose a random point within it as the starting point for behavior. From this point, a random navigation mode is selected based on the behavior pattern definitions. In each mode, randomly generated course and speed values fall within the ranges of 0–360° and 0–20 knots, respectively, and the navigation trajectory is simulated according to the behavior pattern’s characteristics. The duration of each behavior pattern is randomly determined within a specified range, and each anomalous trajectory may consist of multiple behavior patterns. To ensure diversity and plausibility, the occurrence of any behavior pattern in a single trajectory is limited to three times. Using this method, we generate a single anomalous trajectory. Two hundred anomalous trajectories were generated for each subset of the training dataset and the evaluation dataset.

3.2. Experimental Results and Analysis

3.2.1. Optimal Model Input Parameters Selection

Using the known anomalous ship behavior data in the training dataset, we first calculated the similarity distribution of ship behaviors among anomalous ships. Figure 8 illustrates that the similarity scores of anomalous ships are primarily distributed between 0.4 and 0.9, indicating a notable degree of behavioral similarity among anomalous ships. According to the similarity scores, a range of potential thresholds was established to balance detection accuracy and false positive rates. Here, we set the initial threshold as the 75th and 85th percentiles based on the statistical results, as these quantiles effectively represent the majority of anomalous behavior characteristics, ensuring both the sensitivity and precision of the model.

We conducted six experimental combinations with varying weight parameters (A, B, and C) and two initial similarity thresholds (75th and 85th percentiles) to explore the impact of these factors on anomaly detection performance. The different combinations were designed to assess how the relative importance of each similarity measure and the choice of threshold affect the overall detection accuracy, as follows: (1) A = 0.5, B = 0.25, C = 0.25, threshold = 0.73; (2) A = 0.5, B = 0.25, C = 0.25, threshold = 0.77; (3) A = 0.25, B = 0.5, C = 0.25, threshold = 0.73; (4) A = 0.25, B = 0.5, C = 0.25, threshold = 0.77; (5) A = 0.25, B = 0.25, C = 0.5, threshold = 0.73; and (6) A = 0.25, B = 0.25, C = 0.5, threshold = 0.77. We tested multiple weight configurations and threshold values to identify the optimal balance for distinguishing normal and anomalous vessel behaviors. The final model parameters were selected based on the average results from these experiments.

Figure 9a–f illustrates the dynamic trends of parameter A and parameters B and C under various parameter combinations and similarity threshold conditions. Across all combinations, parameter A exhibits an overall upward trend and consistently dominates, highlighting the critical role of local similarity in anomaly detection. Conversely, parameters B and C demonstrate a consistent downward trend, with their rates of decline and fluctuation characteristics influenced by the initial weight configuration and threshold selection. For the combination with initial weights A = 0.5, B = 0.25, and C = 0.25, as shown in Figure 9a,b. Parameter A undergoes a rapid initial adjustment followed by a significant increase, while parameters B and C decrease more gradually. This behavior indicates that the model progressively strengthens the weight of local similarity, emphasizing its priority. In contrast, when the initial weight of B or C is higher, as depicted in Figure 9c–f, parameters B or C decline more rapidly, whereas parameter A increases at a slower rate. In Figure 9d,f, where the initial weight of parameter B or C is the highest, the model initially relies on the integrity feature. However, as iterations progress, the weight of the local similarity feature A rises rapidly and eventually dominates, demonstrating the model’s ability to dynamically adjust feature weights for optimizing anomaly detection. Notably, in Figure 9f, parameter A experiences a significant drop around the 80th iteration, likely due to the objective function nearing convergence. During this stage, the model may make substantial weight adjustments to explore potentially better solutions, resulting in short-term fluctuations in local similarity weights. Nevertheless, parameter A recovers quickly and continues its upward trajectory, reaffirming the central importance of local similarity in the final optimization process.

We further analyzed the validity of the threshold in our method framework. As shown in Figure 10, the experimental results indicate that the threshold distribution exhibits significant regularity and adaptability under different combination modes. In Figure 10a,b,d,e, the threshold distribution exhibits a multi-modal characteristic, suggesting the model’s ability to flexibly explore multiple potential optimal ranges under complex conditions, thereby demonstrating strong adaptability. In Figure 10c,f, the threshold distribution is closer to unimodal, indicating that the model achieves greater focus and convergence under these conditions. Additionally, the threshold density is generally concentrated around 0.75, suggesting that this range may represent the optimal solution across multiple combinations. The secondary peaks in different combinations reflect the model’s ability to dynamically adjust based on varying scenarios.

3.2.2. Dynamic Trends and Validation of Model Performance Indicators

Figure 11a–f illustrates the dynamic changes in the model’s four performance indicators under various initial weight parameters and threshold settings. Across all combinations, the indicators generally follow a pattern of “slow growth in the early stage, rapid improvement in the middle stage, and stabilization in the late stage”. Specifically, Figure 11a,b show that accuracy and precision remain particularly stable during the middle stage and reach near-convergence in the late stage. In contrast, Figure 11c,d indicate more pronounced fluctuations in recall, especially during the early stage when the model’s ability to detect anomalous behavior is still developing. Figure 11e highlights significant improvements across all four indicators, with the F1-score exhibiting particularly notable growth. This pattern suggests that the model progressively enhances its ability to capture the local similarity of anomalous behavior as the influence of self-integrity features diminishes. Notably, in all combinations, although the overall performance of the indicators is strong, slight fluctuations occur during the later stage, around the 80th iteration, likely due to the fine-tuning of local feature weights. Additionally, the consistently high F1-scores across multiple combinations confirm the model’s ability to accurately identify abnormal behaviors and minimize missed detections, ensuring its reliability and adaptability for practical applications in diverse scenarios.

Figure 12a presents a radar chart comparing the optimal parameter combinations from six experiments conducted on the training dataset. The results indicate that the model maintains high recall and precision across different parameter configurations, with stable detection outcomes. Based on the optimization results from the training dataset, we set the weight parameters to 0.6, 0.2, and 0.2, and the threshold to 0.75. We then validated the model using the Xiamen Port test dataset. As shown in Figure 12b, the BPEF-TSD demonstrates outstanding performance across four metrics: precision, recall, F1-score, and accuracy. Specifically, the model achieves a precision of 0.964, a recall of 0.928, an F1-score of 0.945, and an accuracy of 0.910.

3.2.3. Comparative Experiment with Mainstream Algorithms

We conducted comparative experiments, and the results are presented in

Table 3. Comparison of anomaly detection results of different methods.

Model	Precision	Recall	F1-Score	Accuracy
BPEF-TSD	0.964	0.928	0.945	0.910
LSTM	0.932	0.807	0.872	0.884
iForest	0.843	0.715	0.774	0.917
HDBSCAN	0.347	0.520	0.416	0.995

. Four methods, BPEF-TSD, LSTM, iForest, and HDBSCAN, were evaluated using four performance indicators: precision, recall, F1-score, and accuracy. The results indicate that BPEF-TSD significantly outperforms the other methods in overall performance. Specifically, BPEF-TSD achieved precision, recall, and F1-score values of 0.964, 0.928, and 0.945, respectively, which are higher than those of the other methods, demonstrating an effective balance between precision and recall. Although HDBSCAN exhibits the highest accuracy, its anomaly detection capability is limited, with precision and recall values of only 0.347 and 0.520, respectively. In contrast, BPEF-TSD demonstrates superior detection efficiency and accuracy, particularly in recognizing complex behavior patterns and detecting anomalies. These results validate the effectiveness and robustness of the BPEF-TSD framework in detecting abnormal ship behavior, providing critical support for maritime safety supervision.

4. Discussion

The test results indicate that, with appropriate weight and threshold configurations, the model can effectively detect anomalous behaviors and is suitable for the vessel anomaly detection task in the Xiamen Port area. However, during the course of this experiment, we identified certain limitations in the anomaly detection methods based on vessel behavior patterns.

• Over-reliance on AIS data quality: During the experiment, we observed that the BPEF-TSD method is heavily dependent on the quality of AIS data, and its performance is limited by the available anomalous vessel data. AIS data integrity is essential for accurately capturing vessel behavior patterns, but the small number of anomalous data samples restricts model training and validation. To address the lack of real-world anomalous data, we introduced a synthetic data generation method that combines normal and anomalous behaviors, enhancing the dataset and model robustness. However, synthetic data may not fully capture the complexities of real-world anomalies, which could impact detection accuracy in actual maritime environments [40]. In the future, we can employ data augmentation techniques, such as SMOTE, to increase the number of anomalous samples [41,42]. Additionally, data fusion techniques can be used to integrate other data sources, such as radar, satellite imagery, and optical sensors, reducing reliance on a single data source and improving the accuracy and reliability of the detection process [43,44].
• Generalizability of the Xiamen Port data: This study focuses on Xiamen Port, a key coastal and container port in China. However, the methods we developed are designed to be adaptable to other maritime environments. We selected Xiamen Port because it represents typical maritime behaviors, such as navigation, docking, and cargo handling. The BPEF-TSD framework, built on general principles of ship behavior, can be applied to other ports or waterways with similar conditions. By leveraging behavioral patterns, similarity measures, and anomaly detection algorithms, the framework demonstrates broad applicability. In future work, we plan to further test and validate the framework using data from other waterways. This will enable us to evaluate its effectiveness across a wider range of maritime environments, ensuring that the proposed anomaly detection system is not only suitable for Xiamen Port but also adaptable to various maritime contexts.
• Limited applicability to multi-vessel scenarios: The BPEF-TSD method primarily targets the behavior patterns of individual vessels and does not fully account for multi-vessel coexistence scenarios, such as escorting or overtaking. This limitation reduces the method’s effectiveness in areas with frequent vessel interactions [45]. Future research could expand the behavior pattern recognition algorithm to analyze collective vessel behavior, enhancing its ability to recognize complex patterns such as group navigation and strategic avoidance [46,47].
• Challenges in threshold setting: In this study, we used a single threshold for anomaly behavior detection. In practical applications, the complexity of data characteristics and scenarios may render a fixed threshold unsuitable for all cases. Specifically, both excessively high and low thresholds can lead to incorrect anomaly detection. Previous studies have explored this issue, highlighting that the selection of an appropriate threshold should consider both data characteristics and the application scenario [48]. In the future, adaptive threshold techniques could be considered to dynamically adjust thresholds based on real-time data, or machine learning methods could be employed to automatically learn the optimal threshold, potentially improving detection sensitivity and accuracy [49].

5. Conclusions and Future Work

This study introduces a vessel anomaly detection framework based on BPEF mining and text similarity, designed to identify and detect target vessels that exhibit behavior patterns similar to known anomalous vessels during navigation. Our method utilizes BPEF mining to extract vessel behavior events and construct behavior sequence chains. We apply the Smith–Waterman algorithm to locally align the behavior sequence chains of target vessels with those of known illegal vessels, identifying the most similar local segments. Subsequently, we enhance the Jaro–Winkler text similarity algorithm and combine it with the LCS algorithm to calculate the overall similarity between the behavior sequence chains of target vessels and known illegal vessels, effectively identifying potential risk vessels.

Experimental results demonstrate that this detection method maintains high precision and recall while delivering stable detection outcomes under appropriate weight parameters and threshold configurations. Compared to manually annotated anomalous trajectory points, our proposed method achieves an accuracy exceeding 95% in identifying anomalous behaviors. This further validates that appropriate parameter adjustments enable the model to sustain high detection performance in real-world scenarios, providing efficient and reliable technical support for maritime safety supervision and showcasing its engineering application potential in maritime anomaly detection.

In future research, we could incorporate longer time span ship trajectory data to improve the accuracy of navigation pattern recognition. Additionally, integrating multi-source data, such as radar, satellite imagery, and environmental conditions, into the BPEF mining framework would enable a more comprehensive capture of ship behavior, thereby enhancing the robustness and accuracy of anomaly detection. Moreover, exploring adaptive thresholding mechanisms and improved data fusion techniques could better handle noisy or missing data, ensuring more reliable results. Finally, upon detecting anomalous behaviors, developing supplementary regulatory tools capable of swiftly identifying the causes of anomalies and mitigating false positives from normal navigation adjustments would further optimize maritime safety management.