Detection of maritime anomalous behavior in a successful MARISA North Sea trial Ali Mohamoud, Johan van de Pol, Eric den Breejen, Kim Veltman, Jos van der Velde, Tommaso Mannucci, Hanno Hildmann TNO Defence, Security and Safety Oude Waalsdorperweg 63, PO BOX 96864, 2509 JG, The Hague, Netherlands Emails: {ali.mohamoud, johan.vandepol, eric.denbreejen, jos.vandervelde, kim.veltman, tommaso.mannucci, hanno.hildmann} @tno.nl ABSTRACT Maritime situational awareness (MSA) is of paramount importance for defense as well as civil authorities. We report on MARISA (MARitime Integrated Situational Awareness), a H2020 security project which was conducted to create improved situational awareness with a focus on delivering a complete and useful comprehension of the situation at sea. Specifically, behavioral analysis was used to narrow down the number of vessels in an environment and thereby help optimize decision making processes of the operational end-user. Vessel behavior was analyzed in real time with the actual sensor data of the Netherlands Coast Guard in relation with contextual information. In this paper we introduce the operational maritime scenario and the MARISA Toolkit application. Furthermore, the rule-based behavioral analysis (RBBA) service used for anomaly detection is presented and the implemented automated reasoning approach (based on Complex Event Processing (CEP) over input streams such as e.g., vessel motion, vessel metadata and contextual information) is discussed. The MARISA Toolkit configuration containing the RBBA service has been validated through a successful live trial in the North Sea, conducted under real operational conditions. Keywords: maritime, surveillance, safety, anomaly detection, situation assessment, behavioral analysis, threat analysis 1. INTRODUCTION Coast Guard organizations have nowadays detection systems at their disposal collecting large amounts of data that can be used for the broader maritime security and safety and in particular fisheries, illegal smuggling of goods, illegal trafficking, piracy and terrorism. It is of vital importance to correlate and fuse the large amount of heterogeneous data to extract relevant information for maritime surveillance practitioners creating enhanced maritime situational awareness for efficient decision making and response capabilities [2]. This work deals with a rule-based behavioral analysis (RBBA) service that analyses vessel behavior in relation with contextual information and detects anomalies. The technology makes use of automated reasoning based on Complex Event Processing (CEP) by processing input streams (e.g. vessel trajectories, vessel metadata and contextual information) using rules predefined by subject matter experts. The paramount goal of the behavioral analysis is to narrow down the number of vessels that are of interest in the huge amount of data and thereby help optimize the use of analytical capacity and the decision making processes of the operational end-user. The behavior analysis service – as part of the MARISA toolkit configuration for the North Sea – has been validated in a successful operationally relevant, live trial in the North Sea executed within the MARISA EU project. During the exercise, operationally known as MARISA Alert, the Netherlands Coastguard (NLCG) instructed three ships to sail anomalous patterns in maritime security and safety domain such as illegal diving activity near a ship wreck and transfer of contraband at sea. The behavior analysis service, connected to a live feed of the Coastal Surveillance System successfully captured, processed, analyzed & produced alerts in real time for both illegal diving and transfer of contraband use case without any false alarms. The NLCG operators underscored the added value and operational relevance of RBBA service’s anomaly detection for early warning capabilities and support in rapid decision making. 2. BACKGROUND AND CONTEXT OF THE MARISA PROJECT Maritime Situational Awareness (MSA) is of paramount importance for defense as well as civil authorities. MSA is supported by the recognized maritime picture: acquired through correlation and fusion of data and information from land, sea, airborne, and satellite sensor systems, augmented with heterogeneous information from Geographical Information Systems (GIS) and vessel information databases. Detection and identification of all vessels, both cooperative and non-cooperative, is a key prerequisite for a successful and enhanced situational awareness of the maritime domain. The paramount purpose of MARISA project is to create improved situation awareness with a focus on delivering a complete and useful comprehension of the situation at sea. In doing so support for the practitioners can be ensured along the complete lifecycle of incidents at sea, from the observation of objects in the environment up to detection of anomalies and efficient planning of assets. The RBBA service and its subsequent validation in the MARISA North Sea trial presented in this paper analyses in real time the motion patterns of vessels in relation to contextual data such as: vessel type and information, environment, and interaction with other objects and vessels. Subject matter expert can easily be integrated into the RBBA service approach as well as other relevant sources such as vessel databases, Electronic Navigational Charts (ENC), ship wreck data, historical data, risk maps and white-/blacklists. 2.1 Available data sources The primary source of data for the MARISA North Sea Trial is the fused real-time Automatic Identification System (AIS) and Vessel Traffic System (VTS) radar tracks – also known as Inter VTS Exchange Format (IVEF) data. In addition, historic AIS data for the MARISA Alert exercise area is also used to create density maps. As additional contextual information the ENC chart for the Dutch Exclusive Economic Zone (EEZ) and information about ship wrecks in the North sea were used. In order to run the RBBA service in the MARISA toolkit on live IVEF data stream with vessel tracks, TNO developed and implemented an IVEF adaptor. 2.2 Approach and Methodology The afore-mentioned RBBA service is part and parcel of the broader MARISA toolkit – the outcome of the H2020 MARISA project. The paramount purpose of MARISA is to create improved maritime situational awareness with a focus on delivering a complete and useful comprehension of the situation at sea. In doing so, support along the complete lifecycle of incidents at sea, from the observation of objects in the environment up to detection of anomalies and efficient planning of assets can be ensured for the practitioners. The MARISA project envisages to achieve the enhanced maritime situational awareness through a toolkit that provides a suite of services to correlate and fuse various heterogeneous data and information from different sources, including open sources. The MARISA toolkit builds upon the huge potential that arises from using the open access to “big data” for maritime surveillance: the availability of large to very large amounts of data, acquired from various sources ranging from sensors, satellites, open source, internal sources and extraction of valuable information from these amounts through advanced correlation, fusion and predictive analysis. 2.3 Validation The MARISA project is a trial-based project where the developed toolkit can be verified and validated in a variety of operational trials. Effective verification and validation of the MARISA toolkit is ensured through active involvement of the user community; identification and definition of relevant scenarios, execution of real live exercises, setting up performance metrics and indicators, and validation of performance in the evaluation of operational trials. The work presented in this paper has firstly been verified in a simulation environment where realistic maritime traffic and anomalies have been generated and injected into the service. Validation of the work in a relevant environment has been done in MARISA North Sea trial hosted by the NLCG. Realistic relevant scenarios have been used with coastguard assets mimicking anomalous behavior for validation purposes. The validation of the RBBA service in detecting the anomalous behavior of vessels without any false alarms has been successfully carried out during the MARISA North Sea trial. 3. RULE-BASED BEHAVIORAL ANALYSIS SERVICE 3.1 RBBA service concept The RBBA service enables the analysis of vessel behavior to narrow down the potential number of ships of interest. Rule-based reasoning approaches appear especially well-suited for developing expert systems that reason about situations of interest based on subject matter expert knowledge to assist decision makers [1]. The RBBA service analyses (in real time) the trajectories of vessels in relation to contextual data such as: vessel type and information, the environment, and interaction with other vessels. The service processes the input streams (e.g. vessel trajectories, vessel information and environment information) using predefined rules. The service’s concept as depicted in Figure 1, uses Siddhi Complex Event Processing (CEP) for processing streams of vessel data in order to detect suspicious vessel patterns in space and time. The service contains two types of applications which form its building blocks: 1) predefined applications and 2) dynamic or configurable applications (also known as rules). The service deploys these applications for detecting abnormal vessel behavior and manages them through its application management component.