Detection of AIS Closing Behavior and MMSI Spoofing Behavior of Ships Based on Spatiotemporal Data

Abstract

In marine transportation, many ships are equipped with AIS devices. The AIS data sent by AIS devices can help the maritime authorities and other ships obtain the navigation condition of the ship, thereby ensuring the safety of ships during navigation. However, when a ship is involved in illegal activities, the crew may close the AIS device or tamper with Maritime Mobile Service Identity (MMSI) in the AIS data. To detect these two kinds of behaviors, this paper designs the AIS closing detection algorithm and MMSI spoofing detection algorithm based on the spatiotemporal data provided by AIS and radar. As the radar data does not include the ship’s identification, the associated relationship between radar data and AIS data is difficult to determine in the multi-ship scenario. To solve this problem, the D-TRAP is defined in this paper, it is applied in the process of searching for the associated AIS points of radar trajectory points, when the number of effective AIS points is reduced caused by the above two behaviors, the association method used in the paper has better performance. In addition, real data and simulation data are used to verify the two algorithms. The verification results show that when the ship is simultaneously monitored by radar and AIS, and the monitoring process continues for a period of time, the AIS closing detection algorithm has good performance. When the ship is monitored by AIS and radar before and after MMSI spoofing, and both monitoring processes continue for a period of time, the MMSI spoofing algorithm has good performance.

1. Introduction

Nowadays, marine transportation plays an important role in international trade. In marine transportation, many ships are equipped with Automatic Identification System (AIS), which can continuously send the dynamic and static information of the ships. This information mainly includes Maritime Mobile Service Identity (MMSI) number, type, position, speed over ground, and course over ground of the ship [1]. Through the AIS data, the maritime authorities can obtain the navigation status of ships in certain sea areas, thus facilitating the management of maritime traffic.

During navigation, in addition to normal activities, some ships may participate in illegal activities, such as smuggling, pollution, piracy, and unauthorized fishing in protected areas [2]. These ships may pose a threat to maritime traffic safety and national sovereignty. Therefore, timely detection of dangerous ships with illegal behaviors is an important task in maritime management. In the current researches, the dangerous ships are identified mainly by detecting the abnormal trajectories of ships. The main basis of these researches is that the trajectories of dangerous ships are often out of the ordinary. The authors of [3] studied the abnormal fishing vessel behavior based on vessel trajectories. The authors of [4] trained a behavior/interaction model based on trajectory data of ships, and identified abnormal and possibly dangerous situations through the model. The authors of [5] considered that the vessel trajectory points that did not follow the traffic pattern are anomalous vessel behaviors, and detected anomalous vessel behavior by creating a vessel trajectory predictor. The authors of [6] proposed a framework named MT-MAD for maritime trajectory modeling and anomaly detection. The authors of [7] judged whether the ship’s trajectory was abnormal based on type of ship, traffic direction, speed, course, number of stop points, and number of phase changes. The authors of [8] used trajectory kernels with one-class SVMs to find outlying trajectories. The authors of [9] proposed a multi-class hierarchy framework to detect anomalous trajectories. However, in these researches, the abnormal trajectories are often defined subjectively, or the detected distinctive trajectories are regarded as abnormal trajectories. There is no uniform standard for the definition of the abnormal trajectory, which also limits the scope of application of related researches.

AIS is a self-reporting system; any self-reporting system is prone to “spoofing” or the intentional reporting of incorrect information [10]. Therefore, in illegal activities, on the one hand, AIS data transmitted by the ship can be spoofed, on the other hand, the AIS transponder in the ship can be turned off [11]. Therefore, from another perspective, the correct detection of AIS closing and spoofing can help maritime authorities to detect illegal activities of ships in time, so that the safety of the relevant sea areas can be guaranteed. The authors of [12] demonstrated the feasibility of radiolocation of AIS emissions, which is the basis for future anti-spoofing and AIS verification applications. The AIS data spoofing mainly includes ship identity (MMSI) spoofing and position spoofing. At this stage, there are some researches on the detection of position spoofing, the authors of [10] studied this problem with the help of radar measurements and information from the tracking system, but the research was mainly aimed at the single-target case. The authors of [13] mainly solved the problem of position spoofing by comparing the estimated AIS emitter position and position reported in AIS data, but it required related domain knowledge. The authors of [14] calculated the speed based on the distance and duration between two AIS points, and determined whether a spoofing event occurred based on the speed, this method was suitable for resolving spoofing events with large changes in position. However, there is less research on MMSI spoofing and AIS closing detection, and it is easier for ships to perform these two behaviors in illegal activities. The authors of [15] provided an idea for MMSI spoofing and AIS switch-off detection, but no further research has been done. The authors of [11] determined whether a shortage of AIS messages represented an alerting situation by exploiting the received signal strength information; however, this method relied on ship-related features, like the height of the transmitting antenna, and when the number of ships in a certain sea area is large, it is difficult to obtain the height of the transmitting antenna of each ship. This paper mainly studies the AIS closing and MMSI spoofing problems in multi-ship scenario. In this research, the spatiotemporal data provided by AIS and radar are used without the need for ship-related features, radar is an alternative sensor for maritime surveillance near the ports [16]. The work of this paper is mainly carried out by finding the association between AIS data and radar data, and analyzing the characteristics of AIS closing behavior and MMSI spoofing behavior. The authors of [17,18,19] studied the association between spatiotemporal data of ships provided by different sensors, which provided the basis for our work. The main contributions of this paper are as follows.

(1) We define the D-TRAP, with the help of D-TRAP, the accuracy of the association between trajectory points can be improved, so as to solve the problem that the associated relationship between AIS data and radar data in the multi-ship scenario is difficult to determine.

(2) We design the AIS closing detection algorithm and MMSI spoofing detection algorithm by establishing the associated AIS trajectory map of radar trajectory. The construction of the associated AIS trajectory map can break the limitation of one-to-one association of trajectories, which can expand the scope of application based on trajectory association, and also increase the robustness of the trajectory association algorithm.

(3) We simulate the AIS closing behavior and MMSI spoofing behavior using real data and simulation data, and verify the effectiveness of the proposed algorithms accordingly.

2. Problem Description

2.1. Data Provided by AIS and Radar

In maritime transportation, both radar and AIS can provide spatiotemporal information of ships. Each record provided by AIS is called an AIS point, this paper uses $P{A}_i=\{MMSI,lon,lat,time\}$ to represent the ith AIS point. Among them, $P{A}_i.MMSI$ is the MMSI number of the ship; $P{A}_i.lon$ and $P{A}_i.lat$ are the longitude and latitude of the ship, respectively; and $P{A}_i.time$ is the corresponding time.

Similarly, each record provided by radar is called radar point. In the original radar point, the position of the ship is represented by the angle and distance between the ship and the radar. To be consistent with AIS data, the position of the ship needs to be represented by longitude and latitude, so the angle and distance should be converted into the latitude and longitude of the ship, and these conversion formulas can be found in [20]. At this time, we use $P{R}_j=\{lon,lat,time\}$ to represent the jth radar point, which indicates that the longitude and latitude of the radar point at $P{R}_j.time$ are $P{R}_j.lon$ and $P{R}_j.lat$.

AIS points and radar points can be displayed in figure according to their latitude and longitude. For example, in Figure 1a, the red points represent AIS points and the blue points represent radar points. In Figure 1, the horizontal axis represents longitude, and the vertical axis represents latitude. The units of longitude and latitude are degrees. The X and Y values of each red point represent the longitude and latitude of a certain ship at a certain moment provided by AIS device, respectively, and the X value and Y value of each blue point represent the longitude and latitude of a certain target (in most cases the target is a ship), respectively, at a certain moment provided by radar. Figure 1a shows latitudes and longitudes of targets provided by AIS and radar in a certain spatiotemporal range. Among them, the longitude range is [109.4600, 109.4848], the latitude range is [18.1770, 18.1917], and the time range is from 09:48:22 on 4 January 2017 to 12:02:23 on 4 January 2017.

2.2. Generation of AIS Trajectory and Radar Trajectory

These spatiotemporal data provided by AIS and radar can be combined in time series to generate trajectories. The generation of AIS trajectory is mainly based on MMSI and the time difference between adjacent AIS points. In this paper, the pth AIS trajectory is represented by $TR{A}_p$, $TR{A}_p=\{P{A}_{p(0)},P{A}_{p(1)},\dots ,P{A}_{p(l)},\dots ,P{A}_{p(m-1)}\}$. $P{A}_{p(l)}$ is the $(l+1)$th AIS trajectory point in $TR{A}_p$. $P{A}_{p(0)}.MMSI=P{A}_{p(1)}.MMSI=\dots =P{A}_{p(l)}.MMSI=\dots =P{A}_{p(m-1)}.MMSI$, and for any $0\le k<l<m$, there is $P{A}_{p(k)}.time<P{A}_{p(l)}.time$. That is, the trajectory points in the AIS trajectory all belong to the same ship, and the trajectory points are ordered in time.

The generation of radar trajectory is mainly based on the distance and time difference between adjacent radar points. Similarly, in this paper, the qth radar trajectory is represented by $TR{R}_q$, $TR{R}_q=\{P{R}_{q(0)},P{R}_{q(1)},\dots ,P{R}_{q(t)},\dots ,P{R}_{q(n-1)}\}$. $P{R}_{q(t)}$ is the $(t+1)$th radar trajectory point in $TR{R}_q$. For any $0\le s<t<n$, there is $P{R}_{q(s)}.time<P{R}_{q(t)}.time$. That is, the trajectory points in the radar trajectory are ordered in time. These two trajectory generation algorithms can be found in [20]. After trajectory generation, each trajectory is given a unique identifier, which is called the trajectory ID.

Because the sampling interval of the radar is short and the performance of the radar is easily affected by weather and other factors, there are many inaccurate radar points, which will cause the “sawtooth” phenomenon of radar trajectory and affect the further analysis of radar trajectory. Therefore, the radar trajectory needs to be smoothed. During the smoothing process, every five points in the radar trajectory are merged into a new radar point, each attribute value of this new radar point is the average of the corresponding attribute values of the five points. Specifically, for a radar trajectory $TR{R}_q=\{P{R}_{q(0)},P{R}_{q(1)},\dots ,P{R}_{q(t)},\dots ,P{R}_{q(n-1)}\}$, the smoothed trajectory is represented by $TR{R}_{q\_smooth}$, $TR{R}_{q\_smooth}=\{P{R}_{q\_smooth(0)},P{R}_{q\_smooth(1)},\dots ,P{R}_{q\_smooth(t)},\dots ,P{R}_{q\_smooth(\lceil n/5\rceil -1)}\}$, where $P{R}_{q\_smooth(t)}.lon=\frac{{\sum }_{k=0}^{4}P{R}_{q(5t+k)}.lon}{5}$, $P{R}_{q\_smooth(t)}.lat=\frac{{\sum }_{k=0}^{4}P{R}_{q(5t+k)}.lat}{5}$, $P{R}_{q\_smooth(t)}.time=\frac{{\sum }_{k=0}^{4}P{R}_{q(5t+k)}.time}{5}$. In Figure 1b, the red lines are the AIS trajectories generated by the AIS points in Figure 1a, and the blue lines are the smoothed radar trajectories generated by the radar points in Figure 1a.

2.3. AIS Closing Behavior and MMSI Spoofing Behavior

As stated in the introduction, AIS is a self-reporting system. When a ship is involved in illegal activities, to avoid supervision, the crew may close the AIS transponder or tamper with the ship’s MMSI in the AIS data. Examples of AIS closing behavior and MMSI spoofing behavior are shown in Figure 2.

Figure 2a shows normal navigation of the ship, where radar trajectory 0 is the ship’s trajectory detected by radar, and AIS trajectory 0 is the ship’s trajectory received by AIS receiver. Figure 2b shows the AIS closing behavior during navigation. After the AIS device of the ship is closed, the AIS receiver cannot receive the data transmitted by the ship, the AIS trajectory is interrupted, as shown by AIS trajectory 0 in Figure 2b, the radar can still detect the ship that is sailing, and the radar trajectory continues to be generated, as shown by radar trajectory 0 in Figure 2b. Figure 2c shows the MMSI spoofing behavior during navigation. As the ship’s MMSI has been changed, two AIS trajectories are generated during the ship’s navigation, as shown by AIS trajectory 0 and AIS trajectory 1 in Figure 2c, the MMSI spoofing behavior has no effect on the radar, the trajectory detected by the radar is still the actual trajectory of the ship, as shown by radar trajectory 0 in Figure 2c. Through the analysis of AIS closing behavior and MMSI spoofing behavior, we find that it is difficult to detect the above two behaviors only by using AIS data; however, this problem can be solved by comparing radar trajectory with the associated AIS trajectory.

3. AIS Closing Detection Algorithm

When a ship closes its AIS device, its AIS trajectory will be interrupted, and the range of the AIS trajectory will be smaller than the range of the ship’s real trajectory. Therefore, the AIS closing behavior can be detected by comparing the AIS trajectory range with the ship’s real trajectory range. The formula of trajectory range is as follows.

$$Range(trajectory)=Distance(maxPoint,minPoint)$$

(1)

In the formula, the longitude and latitude of $maxPoint$ are the maximum longitude and maximum latitude in the trajectory, and the longitude and latitude of $minPoint$ are the minimum longitude and minimum latitude in the trajectory. $Distance$ refers to the distance between two points expressed in latitude and longitude.

If the radar can detect the ship before and after the AIS device is closed, the radar trajectory can be considered to some extent as real trajectory. Therefore, it is feasible to detect the AIS closing behavior by comparing the AIS trajectory with the radar trajectory. Because there are many ships in a certain sea area, many radar trajectories and AIS trajectories will be generated. Therefore, the difficulty of the research is determining the radar trajectory and the AIS trajectory generated by the same ship at the same time period, that is, to determine the associated relationship between the radar trajectory and the AIS trajectory. When the ship has AIS closing behavior, the AIS trajectory is changed, and the radar trajectory is not affected. Therefore, the radar trajectory is used as a reference when determining the associated relationship. Algorithm 1 is the pseudocode of the AIS closing detection algorithm.

When looking for the associated trajectory of the radar trajectory, first, the radar trajectory is traversed to find the associated AIS point for each radar point. Due to the large number of AIS points, the search scope needs to be reduced, in this process, the start time and end time of the radar trajectory need to be acquired, which is represented by $startTime$ and $endTime$, respectively, AIS points with timestamps between $(startTime-timeInterval)$ and $(endTime+timeInterval)$ are considered candidate AIS points, $timeInterval$ is the set time interval (line 1, and line 2 in Algorithm 1). When judging whether two trajectory points are associated points, in addition to considering the distance between them, the directions of the two corresponding trajectories at the two points should also be considered. For example, as shown in Figure 3, take $R\_Point2$ in the radar trajectory as an example, if only the distance between the trajectory points is considered, $A0\_Point1$ in trajectory AIS0 should be the associated AIS point of $R\_Point2$. However, the direction of trajectory AIS0 at $A0\_Point1$ is significantly different from the direction of the radar trajectory at $R\_Point2$, the two points are not generated by the same ship. Therefore, when looking for associated AIS point, the directions of trajectories at trajectory points should be considered.

To avoid the influence of detection error, the Direction of a TRajectory At a certain Point (D-TRAP) is defined as the direction of the vector from the first point successfully associated in the trajectory to the certain point. When determining whether the trajectory point $P_{compare}$ is the associated point of point P in trajectory $TR$, the D-TRAP of $TR$ at P needs to be computed, and the formula can be expressed as $D-TRAP(TR,P,P_{compare})=Angle(theunitnorthvector{\displaystyle \stackrel{clockwiserotation}{⟶}}{\displaystyle \overrightarrow{P_{first\_compare}P}})$. In the paper, D-TRAP is computed when determining whether two trajectory points are associated, that is, D-TRAP occurs in pairs. To improve the accuracy, when computing the D-TRAP value of trajectory $TR$ at point P, in addition to $TR$ and P, the point $P_{compare}$ to be compared with P also needs to be considered. According to $P_{compare}$, the trajectory $T{R}_{compare}$ to which it belongs can be obtained, $P_{first\_compare}$ is the first point associated with $T{R}_{compare}$ in $TR$, the angle of clockwise rotation from the north direction to the vector ${\displaystyle \overrightarrow{P_{first\_compare}P}}$ is the D-TRAP value of $TR$ at P when compared with $P_{compare}$. For example, in Figure 3, the associated point of $R\_Point0$ is $A1\_Point0$, and the associated point of $R\_Point1$ is $A0\_Point0$. Next, the associated point of $R\_Point2$ needs to be found. When judging whether $A0\_Point1$ is its associated point, first the direction of trajectory AIS0 at $A0\_Point1$ needs to be computed, the first point associated with the radar trajectory in trajectory AIS0 is $A0\_Point0$, the direction of the vector from $A0\_Point0$ to $A0\_Point1$ is the direction of trajectory AIS0 at $A0\_Point1$, this direction is represented by the angle of clockwise rotation from the north direction to the vector, as indicated by angle A in Figure 3. Then, the direction of the radar trajectory at $R\_Point2$ at this time needs to be computed, as $A0\_Point1$ to be judged belongs to trajectory AIS0, and the first point associated with trajectory AIS0 in the radar trajectory is $R\_Point1$, the direction of the vector from $R\_Point1$ to $R\_Point2$ is the direction of the radar trajectory at $R\_Point2$ at this time, as indicated by angle B in Figure 3, angle A and angle B are significantly different, so $A0\_Point1$ is not the associated point of $R\_Point2$.

At this time, the next candidate point $A1\_Point2$ is judged whether it is the associated point of $R\_Point2$. Similarly, the direction of trajectory AIS1 at $A1\_Point2$ needs to be computed, the first point associated with the radar trajectory in trajectory AIS1 is $A1\_Point0$, the direction of the vector from $A1\_Point0$ to $A1\_Point2$ is the desired direction, as indicated by angle D in Figure 3. Then, the direction of the radar trajectory at $R\_Point2$ at this time needs to be computed, as $A1\_Point2$ to be judged belongs to trajectory AIS1, and the first point associated with trajectory AIS1 in the radar trajectory is $R\_Point0$, the direction of the vector from $R\_Point0$ to $R\_Point2$ is the desired direction, as indicated by angle C in Figure 3, angle C and angle D are basically equal, and the distance between $A1\_Point2$ and $R\_Point2$ is the smallest, therefore, $A1\_Point2$ is the associated point of $R\_Point2$.

According to the above process, as the AIS points to be judged belong to different AIS trajectories, and the first radar point associated with the different AIS trajectories may not be the same, the direction of the radar trajectory at the same point may change with the different AIS points to be judged; this also applies to the direction of the AIS trajectory at the same point.

In line 3 with Algorithm 1, the primary key of $associatedMap$ is the AIS trajectory ID, and the value is the number of associated AIS points from the corresponding AIS trajectory. The primary key of $associatedRadarMap$ is the AIS trajectory ID, the value is the sequence of radar points associated with the corresponding AIS trajectory, $associatedRadarMap$ is mainly used to compute the direction of the radar trajectory at a certain radar point. The primary key of $associatedAISMap$ is the AIS trajectory ID, and the value is the sequence of AIS points associated with the radar trajectory in the corresponding AIS trajectory, $associatedAISMap$ is mainly used to compute the direction of the AIS trajectory at a certain AIS point.

After defining the D-TRAP, the associated AIS point of each point in the radar trajectory can be found in the candidate AIS points. For each radar point, when determining whether a candidate AIS point is its associated point, first, the AIS trajectory to which the candidate AIS point belongs is recorded, and this AIS trajectory is called belonging AIS trajectory. Then, the first point associated with the radar trajectory in the belonging AIS trajectory and the first point associated with the belonging AIS trajectory in the radar trajectory are obtained. Next, the direction of the belonging AIS trajectory at the candidate AIS point and the direction of the radar trajectory at the current radar point are computed, if the difference is small enough, that is, the two directions are basically the same, the distance between the candidate AIS point and the current radar point is computed. If the distance is the shortest distance and meets the set threshold, the candidate AIS point is regarded as the associated AIS point of the current radar point, and update associatedMap, associatedRadarMap, associatedAISMap (lines 4–12 in Algorithm 1).

When all associated AIS points of the radar trajectory have been found, $associatedMap$ is sorted by value from big to small, and the AIS trajectory with the largest number of associated AIS points is used as the primary associated trajectory of the radar trajectory (line 13 and line 14 in Algorithm 1). At this time, the timestamp of the earliest AIS point associated with the radar trajectory in the primary associated trajectory is obtained, and the range of the primary associated trajectory after the timestamp is computed, and the result is used as the AIS trajectory range of the ship. Similarly, the timestamp of the earliest radar point associated with the primary associated AIS trajectory in the radar trajectory is obtained, the range of the radar trajectory after the timestamp is computed, and the result is used as the radar trajectory range of the ship (lines 15–18 in Algorithm 1). If the ratio of the AIS trajectory range to the radar trajectory range is less than $threshold$, it means that the AIS trajectory is interrupted and the corresponding ship has AIS closing behavior (lines 19–21 in Algorithm 1).

Algorithm 1 AIS closing detection algorithm.
Input: Radar Trajectory, $RT$; Parameter when searching for candidate AIS points, $timeInterval$; threshold to determine whether AIS closing behavior occurs, $threshold$.
Output: AIS trajectory ID with AIS closing behavior.
1:	$startTime,endTime\leftarrow acquireStartAndEndTime(RT)$
2:	$canAISList\leftarrow searchCanAISPts(startTime,endTime,timeInterval)$
3:	Create associatedMap, associatedRadarMap, associatedAISMap.
4:	for each radar point $radarPt$ in $RT$ do
5:	$assAISPt\leftarrow findAssoAISPt(canAISList,radarPt,associatedRadarMap,associatedAISMap)$
6:	if $assAISPt$ is not null then
7:	$trajectoryId\leftarrow assAISPt.trajectoryId$
8:	Update $associatedMap$
9:	Update $associatedRadarMap$
10:	Update $associatedAISMap$
11:	end if
12:	end for
13:	Sort $associatedMap$ by value from big to small.
14:	$priAISTrId\leftarrow getPriKey(associatedMap)$
15:	$aisStartTime\leftarrow getAISStartTime(associatedAISMap,priAISTrId)$
16:	$radarStartTime\leftarrow getRadarStartTime(associatedRadarMap,priAISTrId)$
17:	$AISTraRange\leftarrow computeAISTraRange(priAISTrId,aisStartTime)$
18:	$radarTraRange\leftarrow computeRadarTraRange(RT,radarStartTime)$
19:	if$AISTraRange/radarTraRange<threshold$then
20:	Print out AIS trajectory ID with AIS closing behavior: $priAISTrId$.
21:	end if

4. MMSI Spoofing Detection Algorithm

As the generation of the AIS trajectory is based on the MMSI number, if the ship changes the MMSI number in the AIS data during navigation, two different AIS trajectories will be generated before and after the MMSI spoofing, and the two AIS trajectories do not overlap in time, so the MMSI spoofing detection algorithm can be designed based on these features. The pseudocode of the algorithm is shown in Algorithm 2.

Algorithm 2 MMSI spoofing detection algorithm.
Input: Radar Trajectory, $RT$; Parameter when searching for candidate AIS points, $timeInterval$; threshold to determine whether MMSI spoofing behavior occurs, $threshold$.
Output: AIS trajectory ID before MMSI spoofing, and AIS trajectory ID after MMSI spoofing.
1:	$startTime,endTime\leftarrow acquireStartAndEndTime(RT)$
2:	$canAISList\leftarrow searchCanAISPts(startTime,endTime,timeInterval)$
3:	Create associatedMap, associatedRadarMap, associatedAISMap.
4:	for each radar point $radarPt$ in $RT$ do
5:	$assAISPt\leftarrow findAssoAISPt(canAISList,radarPt,associatedRadarMap,associatedAISMap)$
6:	if $assAISPt$ is not null then
7:	$trajectoryId\leftarrow assAISPt.trajectoryId$
8:	Update $associatedMap$
9:	Update $associatedRadarMap$
10:	Update $associatedAISMap$
11:	end if
12:	end for
13:	Sort $associatedMap$ by value from big to small.
14:	$priAISTrId\leftarrow getPriKey(associatedMap)$
15:	for each AIS trajectory ID $AISTrId$ in the sorted $associatedMap$ do
16:	if $isIndependent(AISTrId,priAISTrId)$ then
17:	if trajectory $AISTrId$ is earlier than trajectory $priAISTrId$ then
18:	$beforeAISId\leftarrow AISTrId$;
19:	$afterAISId\leftarrow priAISTrId$;
20:	else
21:	$beforeAISId\leftarrow priAISTrId$;
22:	$afterAISId\leftarrow AISTrId$;
23:	end if
24:	Break;
25:	end if
26:	end for
27:	if$beforeAISId$ is not null then
28:	$aisStartTime\leftarrow getAISStartTime(associatedAISMap,beforeAISId)$
29:	$radarStartTime\leftarrow getRadarStartTime(associatedRadarMap,beforeAISId)$
30:	$AISTraRange\leftarrow computeAISTraRange(beforeAISId,aisStartTime)$
31:	$radarTraRange\leftarrow computeRadarTraRange(RT,radarStartTime)$
32:	if $AISTraRange/radarTraRange<threshold$ then
33:	AIS trajectory ID before MMSI spoofing: $beforeAISId$, and AIS trajectory ID after MMSI spoofing: $afterAISId$.
34:	end if
35:	end if

In the MMSI spoofing detection algorithm, it is also necessary to find the associated AIS point of each point in the radar trajectory, all associated AIS points are counted according to their belonging AIS trajectories, and these associated AIS trajectories are sorted according to the number of associated AIS points. The AIS trajectory with the largest number of associated AIS points is used as the primary associated trajectory of the radar trajectory, these steps are the same as the corresponding part in the AIS closing detection algorithm (lines 1–14 in Algorithm 2). After obtaining the primary associated AIS trajectory, the AIS trajectory that is independent of the primary associated AIS trajectory in time needs to be found from the associated AIS trajectories, and this AIS trajectory is named the independent AIS trajectory. If the independent AIS trajectory exists, the chronological order of the independent AIS trajectory and the primary associated AIS trajectory need to be determined, the earlier trajectory is recorded as $beforeAISId$, and the later trajectory is recorded as $afterAISId$ (lines 15–26 in Algorithm 2). Then, it is determined whether trajectory $beforeAISId$ has AIS closing behavior, and this process is consistent with the corresponding part in the AIS closing detection algorithm. If the trajectory has AIS closing behavior, it means that trajectory $beforeAISId$ is interrupted, and the corresponding radar trajectory is still continuing. It is known that trajectory $afterAISId$ appears after the end of trajectory $beforeAISId$, and trajectory $afterAISId$ is also the associated trajectory of the radar trajectory. At this time, it can be judged that the corresponding ship has MMSI spoofing behavior, trajectory $beforeAISId$ is the trajectory generated before MMSI spoofing, and trajectory $afterAISId$ is the trajectory generated after MMSI spoofing (lines 27–35 in Algorithm 2).

5. Case Study

5.1. Dataset

The experiment mainly uses two datasets. The first dataset is real AIS data and real radar data. The second data set is real AIS data, and radar data generated based on these AIS data.

5.1.1. Real AIS Data and Real Radar Data

Real AIS data and real radar data were collected in the sea area near Sanya, China from 4 January 2017 to 6 January 2017. These data were collected by inverse synthetic aperture radar and land-based AIS receiver built on land. The inverse synthetic aperture radar can actively obtain the position, radial speed, and other data of moving targets. The land-based AIS receiver can accept AIS data sent by AIS devices on ships. In this dataset, there are 412,786 AIS points and 95,823 radar points. The area where the data is collected is shown by the red rectangle in Figure 4a. Its longitude range is [108.9689, 110.3278] and latitude range is [17.7792, 18.3998].

Based on these points, a total of 1113 AIS trajectories and 794 radar trajectories are generated. According to the definition of trajectory range in Chapter 3, the average range of AIS trajectories is 8594 meters and the average range of radar trajectories is 1754 meters. Histograms of the radar trajectory range and the AIS trajectory range are shown in Figure 4b and Figure 4c, respectively. From the two histograms, it can be seen that the ranges of most radar trajectories are within 5000 meters, and the ranges of most AIS trajectories are within 20,000 meters. The ranges of the radar trajectories are generally smaller than the ranges of the AIS trajectories, which is caused by the insufficient detection capability of the radar used in the experiment.

5.1.2. Real AIS Data and Simulated Radar Data

During the data collection process, due to the limitation of radar detection capability, the amount of effective radar data obtained is small. Therefore, to further verify the effectiveness of the algorithms proposed in this paper, in addition to the real radar data, some radar data are also generated through a radar simulation program based on real AIS data. The radar simulation program simulates the working process of the radar. In the simulation program, the minimum scanning angle of the radar is 61.7, the maximum scanning angle is 307.6, and the radar scans 5 degrees per second. When scanning to the boundary, the scanning direction is changed. The specific steps are as follows.

(1) The current time is represented by $currentTime$, and the current angle of the radar is represented by $currentDegree$.

(2) The AIS data are organized into trajectories, for each AIS trajectory, a new AIS point is generated based on the two points of the trajectory before and after the current time. Each attribute of the new AIS point is a weighted sum of the corresponding attributes of the two points, and the weight of the point closer to the current time is greater.

(3) The angle between the new AIS point and the radar is computed. If the difference between the angle and $currentDegree$ is less than the set threshold, a radar point is generated based on the new AIS point, the position of the radar point is the position of the new AIS point plus random noise. The distance between the radar and the radar point is computed, if the distance is within the radar scanning range, it means that the generated radar point meets the requirements and saves it.

(4) $currentTime$ and $currentDegree$ are updated. Continue (1)–(4) until the $currentTime$ is greater than the set threshold or the timestamps of all AIS trajectory points.

These AIS data used to generate radar data were collected in the sea area near Sanya, China from 1 January 2017 to 3 January 2017. Through the radar simulation program, a total of 25,225 effective radar points were generated.

5.2. Evaluation of Algorithms

In the experiment, F1 score is used to evaluate the AIS closing detection and MMSI spoofing detection algorithms. The formula of F1 score is as follows.

$$F1=\frac{2\ast P\ast R}{P+R}$$

(2)

Among them, P is precision, $P=\frac{TP}{TP+FP}$, R is recall, and $R=\frac{TP}{TP+FN}$. It can be seen from the formula that the F1 score takes precision and recall into consideration, which can evaluate the algorithms more comprehensively.

In the evaluation of the AIS closing detection algorithm, $TP$ indicates that the AIS trajectory generated by the ship that close the AIS transponder is detected to have AIS closing behavior, $FP$ indicates that the AIS trajectory generated by the ship that do not close the AIS transponder is detected to have AIS closing behavior, and $FN$ indicates that the AIS trajectory generated by the ship that close the AIS transponder is not detected to have AIS closing behavior. In the specific use process, it is known that the number of trajectories with AIS closing behavior is $N\_close$. Assuming that the number of trajectories with AIS closing behavior detected by the AIS closing detection algorithm is $D\_close$, and the number of correctly detected trajectories is $C\_close$, $TP=C\_close$, $FP=D\_close-C\_close$, FN = $N\_close-C\_close$.

In the MMSI spoofing detection algorithm, the correct detection of MMSI spoofing mainly includes two parts, one is that the MMSI spoofing behavior is found, and the other is that the trajectory ID after MMSI spoofing is correctly detected. In the evaluation of the MMSI spoofing detection algorithm, $TP$ indicates that the AIS trajectory with MMSI spoofing is detected correctly, $FP$ indicates that the detected MMSI spoofing behavior does not conform to the real MMSI spoofing behavior, and $FN$ indicates that the AIS trajectory with MMSI spoofing is not detected correctly. In the specific use process, it is known that the number of trajectories with MMSI spoofing behavior is $N\_spoof$. Assuming that the number of trajectories with MMSI spoofing behavior detected by the MMSI spoofing detection algorithm is $D\_spoof$, and the number of correctly detected trajectories is $C\_spoof$. Similarly, $TP=C\_spoof$, $FP=D\_spoof-C\_spoof$, $FN=N\_spoof-C\_spoof$.

5.3. AIS Closing Detection Experiment

5.3.1. Simulation of AIS Closing Behavior

In the experiment, AIS closing behavior should be simulated. Due to the limitation of radar detection capability, on the one hand, the AIS trajectory often lasts for a period of time before it is associated with the radar trajectory, as the lack of associated relationship, the trajectories before association are meaningless to our research, therefore, only the trajectories after association are studied, as shown in Figure 5; on the other hand, when the ship is sailing normally, the range of the primary associated AIS trajectory after association is larger than the range of the radar trajectory after association, that is, there is no AIS closing behavior. Therefore, to simulate the AIS closing behavior, the primary associated AIS trajectory needs to be truncated, that is, the ship closes the AIS device at the truncation time of the AIS trajectory. Truncation ratio is expressed by $tr\_ratio$, $tr\_ratio=\frac{AIS\_range}{radar\_range}$, among them, $radar\_range$ is the range of the radar trajectory after association and $AIS\_range$ is the range of the AIS trajectory between association and the truncation time, as shown in Figure 5. The AIS trajectory points after truncation time are deleted, so that the AIS closing behavior is simulated, and by changing the value of $tr\_ratio$, the behavior of the ship closing the AIS device at different times can be simulated. The simulation steps are as follows.

(1) A new AIS trajectory named $temp\_AISTra$ is created. The points of the AIS trajectory are added to $temp\_AISTra$ in order starting from the earliest AIS point associated with the radar trajectory.

(2) The range of $temp\_AISTra$ is computed, and the result is represented by $ais\_range$. If $ais\_range<tr\_ratio\ast radar\_range$, new AIS point needs to be added to $temp\_AISTra$, and if $ais\_range\ge tr\_ratio\ast radar\_range$, the newly added AIS point need to be deleted from $temp\_AISTra$.

(3) The timestamp of the last point in $temp\_AISTra$ is obtained, and the timestamp is represented by $lastPtTime$.

(4) Points in the AIS trajectory that are later than $lastPtTime$ are deleted, that is, the ship generating the AIS trajectory closed the AIS device at $lastPtTime$.

Through the above steps, the AIS closing behavior can be simulated. At this time, the range of the truncated AIS trajectory is less than $tr\_ratio\ast radar\_range$, and it is the AIS trajectory with the largest range under this condition.

If the threshold for detecting AIS closing behavior is set to a value greater than or equal to $tr\_ratio$ (in this experiment, the threshold is set equal to $tr\_ratio$), the simulated AIS closing behavior can be detected according to Algorithm 1. In this experiment, we set $tr\_ratio$ to 95%, 90%, 85%, 80%, 75%, 70%, 65%, 60%, 55%, 50%, 45%, 40%, 35%, 30%, 25%, 20%, 15%, 10%, and 5%, respectively, to evaluate the performance of AIS closing detection algorithm under different truncation ratios. The effect of simulating AIS closing behavior is shown in Figure 6, the blue lines are radar trajectories, and the red lines are AIS trajectories, for the convenience of explanation, the trajectories in Figure 6 are the trajectories that can be effectively associated. Figure 6a shows the AIS trajectories and radar trajectories of ships during normal navigation. Figure 6b shows the AIS trajectories and radar trajectories when $tr\_ratio$ is 80%. At this time, the range of the AIS trajectory is less than 80% of the range of the corresponding radar trajectory, that is, the ship turns off the AIS device when the range of the AIS trajectory is about to reach 80% of the range of the corresponding radar trajectory. Figure 6c shows the AIS trajectories and radar trajectories when $tr\_ratio$ is 40%. The figures of other truncation ratios are not listed here.

5.3.2. Experimental Results

In the AIS closing detection experiment, the two datasets mentioned above are used, the first dataset contains real AIS data and real radar data, among them, 50 AIS trajectories that can be identified as the primary associated AIS trajectories are used for the experiment, and the second dataset contains real AIS data and simulated radar data, among them, 100 AIS trajectories that can be identified as the primary associated AIS trajectories are used for the experiment. First, the primary associated AIS trajectory is truncated according to different ratios, that is, the behavior of the ship closing AIS device at different times is simulated, and then the performance of the AIS closing detection algorithm at different truncation ratios is tested. The experimental results are shown in

Table 1. The performance of the AIS closing detection algorithm at different truncation ratios.

$\mathit{t}\mathit{r}\_\mathit{r}\mathit{a}\mathit{t}\mathit{i}\mathit{o}$	TP	FP	FN	P	R	F1
95%	47 (97)	9 (0)	3 (3)	0.84 (1.00)	0.94 (0.97)	0.89 (0.98)
90%	45 (97)	8 (0)	5 (3)	0.85 (1.00)	0.90 (0.97)	0.87 (0.98)
85%	45 (96)	7 (0)	5 (4)	0.87 (1.00)	0.90 (0.96)	0.88 (0.98)
80%	44 (91)	7 (0)	6 (9)	0.86 (1.00)	0.88 (0.91)	0.87 (0.95)
75%	44 (87)	6 (0)	6 (13)	0.88 (1.00)	0.88 (0.87)	0.88 (0.93)
70%	42 (84)	5 (0)	8 (16)	0.89 (1.00)	0.84 (0.84)	0.87 (0.91)
65%	39 (81)	3 (0)	11 (19)	0.93 (1.00)	0.78 (0.81)	0.85 (0.90)
60%	40 (79)	3 (0)	10 (21)	0.93 (1.00)	0.80 (0.79)	0.86 (0.88)
55%	37 (75)	2 (0)	13 (25)	0.95 (1.00)	0.74 (0.75)	0.83 (0.86)
50%	31 (69)	0 (0)	19 (31)	1.00 (1.00)	0.62 (0.69)	0.77 (0.82)
45%	30 (65)	0 (0)	20 (35)	1.00 (1.00)	0.60 (0.65)	0.75 (0.79)
40%	28 (55)	0 (0)	22 (45)	1.00 (1.00)	0.56 (0.55)	0.72 (0.71)
35%	26 (37)	0 (0)	24 (63)	1.00 (1.00)	0.52 (0.37)	0.68 (0.54)
30%	24 (25)	0 (0)	26 (75)	1.00 (1.00)	0.48 (0.25)	0.65 (0.40)
25%	22 (19)	0 (0)	28 (81)	1.00 (1.00)	0.44 (0.19)	0.61 (0.32)
20%	20 (12)	0 (0)	30 (88)	1.00 (1.00)	0.40 (0.12)	0.57 (0.21)
15%	17 (7)	0 (0)	33 (93)	1.00 (1.00)	0.34 (0.07)	0.51 (0.13)
10%	12 (1)	0 (0)	38 (99)	1.00 (1.00)	0.24 (0.01)	0.39 (0.02)
5%	5 (0)	0 (0)	45 (100)	1.00 (null)	0.10 (0.00)	0.18 (null)

; the numbers without brackets are the test results of the first dataset, and the numbers with brackets are the test results of the second dataset.

The trend of F1 scores of the AIS closing detection algorithm under different truncation ratios is shown in Figure 7. Among them, the horizontal axis represents the truncation ratio and the vertical axis represents the F1 score. The blue line is the trend of the F1 scores of the algorithm in the first dataset, and the red line is the trend of the F1 scores of the algorithm in the second dataset.

5.3.3. Result Analysis

As can be seen from Table 1 and Figure 7, when $tr\_ratio\ge 55\%$, the F1 scores of the AIS closing detection algorithm are all greater than 0.8, the algorithm has good performance. The F1 score of the algorithm decreases as $tr\_ratio$ decreases. This is because if $tr\_ratio$ is small, that is, the range of the remaining AIS trajectory is small, which means that the AIS device of the ship is closed prematurely, and the number of corresponding AIS points will also be small. This may result in the AIS trajectory not being recognized as the primary associated trajectory, and it is impossible to detect whether the ship generating the AIS trajectory has AIS closing behavior. Therefore, when using this algorithm to detect the AIS closing behavior, the range of the AIS trajectory after association cannot be too small, that is, the process of the ship being monitored by the radar and AIS at the same time should last for a period of time.

5.4. MMSI Spoofing Detection Experiment

5.4.1. Simulation of MMSI Spoofing Behavior

In the experiment, MMSI spoofing behavior should also be simulated. AIS points with different MMSI numbers will generate different AIS trajectories: the AIS trajectories generated before and after MMSI spoofing are different. Therefore, the primary associated AIS trajectory can be truncated into two parts to simulate the MMSI spoofing behavior, the trajectory ID in the first half is unchanged, and the trajectory ID in the second half is changed to a new trajectory ID, that is, the ship has MMSI spoofing behavior at the truncation time of the AIS trajectory, the second half of the trajectory is the trajectory generated by AIS points after MMSI spoofing.

The steps for simulating MMSI spoofing behavior are similar to the steps for simulating AIS closing behavior, except that the last step is different. In the simulation program, instead of deleting the points in the AIS trajectory later than $lastPtTime$, the trajectory ID to which these trajectory points belong is updated to a new trajectory ID, In other words, the ship performed MMSI spoofing at $lastPtTime$, and the AIS points after $lastPtTime$ generated a new AIS trajectory. Similarly, in this experiment, we also set $tr\_ratio$ to 95%, 90%, 85%, 80%, 75%, 70%, 65%, 60%, 55%, 50%, 45%, 40%, 35%, 30%, 25%, 20%, 15%, 10%, and 5%, respectively, to simulate the MMSI spoofing behavior of the ship at different times. The effect of simulating MMSI spoofing behavior is shown in Figure 8, the blue lines are radar trajectories, the red lines are the AIS trajectories before MMSI spoofing, and the black lines are the AIS trajectories after MMSI spoofing, for the convenience of explanation, the trajectories in Figure 8 are the trajectories that can be effectively associated. Figure 8a shows the AIS trajectories and radar trajectories of ships during normal navigation. Figure 8b shows the radar trajectories and the AIS trajectories before and after MMSI spoofing when $tr\_ratio$ is 80%. At this time, the range of the AIS trajectory before MMSI spoofing is less than 80% of the range of the corresponding radar trajectory, that is, the ship performs the MMSI spoofing behavior when the range of the AIS trajectory is about to reach 80% of the range of the corresponding radar trajectory, and a new AIS trajectory is generated based on the AIS points after MMSI spoofing. Figure 8c shows the radar trajectories and the AIS trajectories before and after MMSI spoofing when $tr\_ratio$ is 40%. The figures of other truncation ratios are not listed here.

5.4.2. Experimental Results

In the experiment, the two datasets mentioned above are also used. First, the primary associated AIS trajectory is truncated according to different ratios, and the trajectory ID in the second half is changed to a new trajectory ID, that is, the MMSI spoofing behavior of the ship at different times is simulated. Then, the performance of the MMSI spoofing detection algorithm at different truncation ratios is tested. The experimental results are shown in

Table 2. The performance of the MMSI spoofing detection algorithm at different truncation ratios.

$\mathit{t}\mathit{r}\_\mathit{r}\mathit{a}\mathit{t}\mathit{i}\mathit{o}$	TP	FP	FN	P	R	F1
95%	11 (1)	0 (0)	39 (99)	1.00 (1.00)	0.22 (0.01)	0.36 (0.02)
90%	15 (1)	0 (0)	35 (99)	1.00 (1.00)	0.30 (0.01)	0.46 (0.02)
85%	20 (4)	1 (0)	30 (96)	0.95 (1.00)	0.40 (0.04)	0.56 (0.08)
80%	26 (8)	2 (0)	24 (92)	0.93 (1.00)	0.52 (0.08)	0.67 (0.15)
75%	28 (15)	1 (0)	22 (85)	0.97 (1.00)	0.56 (0.15)	0.71 (0.26)
70%	32 (29)	0 (0)	18 (71)	1.00 (1.00)	0.64 (0.29)	0.78 (0.45)
65%	34 (43)	0 (0)	16 (57)	1.00 (1.00)	0.68 (0.43)	0.81 (0.60)
60%	33 (48)	0 (0)	17 (52)	1.00 (1.00)	0.66 (0.48)	0.80 (0.65)
55%	35 (54)	0 (0)	15 (46)	1.00 (1.00)	0.70 (0.54)	0.82 (0.70)
50%	34 (58)	0 (0)	16 (42)	1.00 (1.00)	0.68 (0.58)	0.81 (0.73)
45%	36 (55)	0 (0)	14 (45)	1.00 (1.00)	0.72 (0.55)	0.84 (0.71)
40%	34 (46)	0 (0)	16 (54)	1.00 (1.00)	0.68 (0.46)	0.81 (0.63)
35%	34 (36)	0 (0)	16 (64)	1.00 (1.00)	0.68 (0.36)	0.81 (0.53)
30%	37 (23)	0 (0)	13 (77)	1.00 (1.00)	0.74 (0.23)	0.85 (0.37)
25%	35 (12)	0 (0)	15 (88)	1.00 (1.00)	0.70 (0.12)	0.82 (0.21)
20%	29 (4)	0 (0)	21 (96)	1.00 (1.00)	0.58 (0.04)	0.73 (0.08)
15%	24 (2)	0 (0)	26 (98)	1.00 (1.00)	0.48 (0.02)	0.65 (0.04)
10%	21 (0)	0 (0)	29 (100)	1.00 (null)	0.42 (0.00)	0.59 (null)
5%	8 (0)	0 (0)	42 (100)	1.00 (null)	0.16 (0.00)	0.28 (null)

; the numbers without brackets are the test results of the first dataset, and the numbers with brackets are the test results of the second dataset.

The trend of F1 scores of the MMSI spoofing detection algorithm under different truncation ratios is shown in Figure 9. Among them, the horizontal axis represents the truncation ratio, the vertical axis represents the F1 score. The blue line is the trend of the F1 scores of the algorithm in the first dataset, the red line is the trend of the F1 scores of the algorithm in the second dataset.

5.4.3. Result Analysis

As can be seen from Table 2 and Figure 9, in the first dataset containing real AIS data and real radar data, when $tr\_ratio$ is between 65% and 25%, the F1 scores are all greater than 0.8, and the algorithm has good performance. When $tr\_ratio$ is greater than 65%, the F1 score of the algorithm decreases as $tr\_ratio$ increases, and when $tr\_ratio$ is less than 25%, the F1 score decreases as $tr\_ratio$ decreases. In the second dataset containing real AIS data and simulated radar data, the F1 score of the algorithm has a similar trend.

This is because when $tr\_ratio$ is small, the range of the AIS trajectory before MMSI spoofing that can be associated with the radar trajectory is small, and the number of corresponding AIS points is also small. When looking for associated AIS points of the radar trajectory, due to the influence of noise and AIS points of other ships, these AIS points may not be considered as the associated points, and the AIS trajectory generated before MMSI spoofing is not considered as the associated trajectory. This will result in the inability to find two AIS trajectories that are independent in time, and thus the MMSI spoofing behavior cannot be detected. Similarly, when $tr\_ratio$ is large, the range of the AIS trajectory after MMSI spoofing that can be associated with the radar trajectory is small, and the corresponding number of AIS points is also small, and therefore the AIS trajectory generated after MMSI spoofing may not be considered as the associated trajectory, and the MMSI spoofing behavior cannot be detected. Therefore, when detecting MMSI spoofing behavior, the ship needs to be monitored by AIS and radar at the same time before and after MMSI spoofing, and both monitoring processes need to continue for a period of time.

5.5. Discussion on the Impact of AIS Packet Loss on the Algorithm

During the transmission of AIS data packets from the AIS device on the ship to the land-based AIS receiver, packet loss may occur. To test the impact of AIS packet loss on the algorithms, we delete each trajectory point in the AIS trajectory with a probability of $p\_loss$, so as to simulate the situation where the packet loss rate increases $p\_loss$, $p\_loss$ is set to 5%, 10%, 15%, 20%, and 25%, respectively. As the internal mechanism of the AIS closing detection algorithm and the MMSI spoofing detection algorithm are the same, the AIS closing detection algorithm is used as an example to test the performance of the algorithm under different packet loss probabilities. In the experiment, the first dataset containing real radar data and AIS data is used. When simulating AIS closing behavior, $tr\_ratio$ is set to 80%, 60%, 40%, and 20%, respectively. Similarly, the F1 score is used to evaluate the performance of the algorithm. The experimental results are shown in

Table 3. The performance of the algorithm under different packet loss probabilities.

	$\mathit{p}\_\mathit{l}\mathit{o}\mathit{s}\mathit{s}$	0% (No Loss)	5%	10%	15%	20%	25%
$\mathit{t}\mathit{r}\_\mathit{r}\mathit{a}\mathit{t}\mathit{i}\mathit{o}$
80%		0.87	0.85	0.81	0.81	0.82	0.79
60%		0.86	0.84	0.84	0.82	0.72	0.77
40%		0.72	0.70	0.68	0.68	0.70	0.65
20%		0.57	0.57	0.57	0.51	0.55	0.44

.

It can be known from Table 3 that when $p\_loss\le 15\%$, the F1 scores of the algorithm under each $tr\_ratio$ drop by 0.06 at most, that is, when the packet loss rate of the AIS data increases within 15%, the performance of the algorithm is relatively stable and has a certain anti-interference ability.

6. Discussion

This research focuses on the detection of AIS closing and MMSI spoofing during ship navigation. Before designing the corresponding algorithms, the associated relationship between AIS data and radar data needs to be determined. In the multi-ship scenario, this problem is difficult to solve, and when the ship has AIS closing behavior and MMSI spoofing behavior, the corresponding AIS data volume will be reduced, which makes the problem more difficult. Therefore, we introduce the concept of the D-TRAP. According to the aforementioned, this will improve the association accuracy between points, and accordingly, the association accuracy between radar trajectories and their primary associated AIS trajectories will also increase.

Here, we prove it experimentally. The experiment use 175 radar trajectories generated from simulated radar points, and three methods are used to find their associated AIS trajectories. The first two methods are to achieve trajectory association by finding associated AIS points of radar trajectory points, among them, the first is the method proposed in the paper (distance +D-TRAP), and the second is the method based only on distance (only distance). The third is the traditional trajectory association method by computing the distance between trajectories (trajectory-to-trajectory). The simulated radar points are generated based on the AIS points, the associated relationship between them is determined, and therefore the associated results can be measured.

In the experiment, we first obtain AIS trajectories corresponding to these 175 radar trajectories, and then truncate these AIS trajectories according to different ratios, so as to test the associated results of the three methods under different AIS data volumes. When truncating AIS trajectories, we define the truncation ratio as $tr\_ratio=AISLeft\_Range/AIS\_Range$, where $AIS\_Range$ is the range of the original AIS trajectory, and $AISLeft\_Range$ is the AIS trajectory range after truncation. In the experiment, we set $tr\_ratio$ to 100%, 80%, 60%, 40%, and 20%, respectively. In the experiment, F1 score is used to evaluate the three trajectory association algorithms, among them, $TP$ is the number of radar trajectories correctly associated, $FP$ is the number of radar trajectories with incorrect association, and $FN$ is the total number of radar trajectories minus $TP$. The experimental results are shown in

Table 4. Association performance of the three methods.

$\mathit{t}\mathit{r}\_\mathit{r}\mathit{a}\mathit{t}\mathit{i}\mathit{o}$	Distance + D-TRAP			Only Distance			Trajectory-to-Trajectory
	Precision	Recall	F1	Precision	Recall	F1	Precision	Recall	F1
100%	0.9510	0.7771	0.8553	0.9510	0.7771	0.8553	0.9349	0.9029	0.9186
80%	0.9077	0.6743	0.7738	0.9008	0.6743	0.7712	0.7396	0.7143	0.7267
60%	0.8421	0.5486	0.6644	0.8276	0.5486	0.6598	0.6213	0.6000	0.6105
40%	0.6782	0.3371	0.4504	0.6304	0.3314	0.4345	0.3787	0.3657	0.3721
20%	0.2273	0.0857	0.1245	0.1757	0.0743	0.1044	0.1006	0.0971	0.0988

.

According to Table 4, the F1 scores of the method proposed in this paper are all greater than or equal to the F1 scores of the method based only on distance, which shows that with the help of D-TRAP, the accuracy of the association between trajectory points can be improved. When the amount of AIS data is reduced ($20\%\le tr\_ratio\le 80\%$), the proposed method has better performance than traditional trajectory association method, which shows that the proposed method has stronger robustness for reduction of effective AIS data. When a ship has AIS closing behavior and MMSI spoofing behavior, the number of corresponding AIS points will decrease. Therefore, it is necessary to use the method proposed in the paper when determining the associated relationship between trajectories.

Based on real data and simulation data, this research simulates the AIS closing behavior and MMSI spoofing behavior of ships at different times, and tests these two algorithms. The test results show that the AIS closing detection algorithm has good performance when the ship does not close the AIS device prematurely; when the ship does not perform the MMSI spoofing behavior too early or too late, the MMSI spoofing detection algorithm has good performance. The test results are consistent with the actual situation. When the ship closes the AIS device prematurely, the amount of AIS data of the ship is small, which will result in the failure to form an AIS trajectory, or it is difficult to obtain the associated relationship between the AIS trajectory and the radar trajectory. At this time, only the radar trajectory can be observed, the ship to which the radar trajectory belongs cannot be determined, and the AIS closing behavior of the ship cannot be detected. When the ship performs MMSI spoofing behavior prematurely, the number of AIS points of the ship before the MMSI spoofing is small, which may also lead to the failure to form an AIS trajectory, or the associated relationship between the AIS trajectory before MMSI spoofing and the radar trajectory is difficult to obtain. At this time, only the AIS trajectory after the MMSI spoofing and the corresponding radar trajectory can be associated, and the MMSI spoofing behavior of the ship cannot be detected. Similarly, when the ship performs MMSI spoofing behavior too late, only the AIS trajectory before the MMSI spoofing and the corresponding radar trajectory can be associated, which will also cause the MMSI spoofing behavior of the ship to be undetectable. Therefore, in the following research, when looking for the associated AIS points of radar points, the accuracy of the association can be improved by comparing other attributes of trajectory points, such as speed in trajectory point, so that the application range of the AIS closing detection algorithm and the MMSI spoofing detection algorithm can be expanded.

The research in this paper can be applied to the ship data service system of the maritime authority. The maritime authority can establish radar, AIS receiver, and other data acquisition devices to obtain multisensor data of ships within its jurisdiction. At this stage, the multisensor data in most ship data service systems is often isolated, and the systems do not take full advantage of the multisensor data to achieve functions that cannot be achieved by using single-sensor data. This paper mainly uses the radar data and AIS data of ships to detect AIS closing behavior and MMSI spoofing behavior through D-TRAP and related algorithms, and these two types of illegal behaviors are difficult to detect through single-sensor data.

7. Conclusions

This research focuses on the detection of AIS closing and MMSI spoofing in multi-ship scenario. In this research, the associated relationship between the radar trajectory and the AIS trajectory is determined based on the distance between trajectory points and the directions of trajectories at trajectory points, and the AIS closing detection algorithm and the MMSI spoofing detection algorithm are designed by establishing the associated AIS trajectory map of radar trajectory. This study simulates AIS closing behavior and MMSI spoofing behavior based on real and simulated data, and tests the two algorithms. The test results show that the algorithms proposed in this paper can detect AIS closing behavior and MMSI spoofing behavior under certain conditions.

In AIS spoofing, in addition to MMSI spoofing, there is also position spoofing, but in the multi-ship scenario, the AIS points after position spoofing will affect the determination of the associated relationship between the radar trajectory and the AIS trajectory. Therefore, in future research, to detect the position spoofing behavior in the multi-ship scenario, first, the trajectory can be partitioned into trajectory segments, and then the trajectory segment with a small range can be used as a reference to further determine the associated relationship between trajectories.