Maritime Anomaly Detection for Vessel Traffic Services: A Survey

Abstract

A Vessel Traffic Service (VTS) plays a central role in maritime traffic safety. Regulations are given by the International Maritime Organization (IMO) and Guidelines by the International Association of Marine Aids to Navigation and Lighthouse Authorities (IALA). Accordingly, VTS facilities utilize communication and sensor technologies such as an Automatic Identification System (AIS), radar, radio communication and others. Furthermore, VTS operators are motivated to apply Decision Support Tools (DST), since these can reduce workloads and increase safety. A promising type of DST is anomaly detection. This survey presents an overview of state-of-the-art approaches of anomaly detection for the surveillance of maritime traffic. The approaches are characterized in the context of VTS and, thus, most notably, sorted according to utilized communication and sensor technologies, addressed anomaly types and underlying detection techniques. On this basis, current trends as well as open research questions are deduced.

1. Introduction

Maritime transportation is the backbone of global trade, in value as well as in volume [1]. While navigable waters on the oceans are wide, the bottlenecks of maritime transportation are normally narrow straits, channels and port approaches themselves. Most ports do only provide one approach from port to sea, making the approach itself a critical infrastructure without redundancy [2]. In channels and straits, vessels must follow the water way in a structured manner so as not to expose themselves into risk of hazards, e.g., collisions. This is aggravated by the various meteorological and hydrological conditions under which maritime traffic operates. Thus, accurate traffic information and traffic coordination is needed in those areas, to ensure safe and smooth traffic flows. This task is, nowadays, supported by Vessel Traffic Services (VTS) [3,4]. VTS make use of various communication and sensor technologies to establish an extensive situation awareness. Familiar examples are Automatic Identification System (AIS), radar or radio communication in the very high frequency (VHF) range. Decision Support Tools (DST) help the VTS operators to outsource significant workloads so that tasks such as the anchor watch can be performed by machines instead of humans. Assuming that normal traffic flow is safe and smooth, an anomaly-detecting DST could indicate traffic events that impair traffic flow, in this regard [5].

Anomaly detection is a well-known research field in the scientific community [6] and also in the maritime context specifically [5,7]. Specifically, from the perspective of VTS, this research field seems promising due to the manifold of technologies applicable as data sources. However, as VTS operates within a safety-critical environment, the recommendations and solutions proposed by any DST must be explainable and reliable [5,8]. Further, the addressed anomaly types must suit the VTS traffic scenarios, too. Lastly, requirements related to VTS operation, such as real-time capability, must be taken into account as well.

In this survey, we review the recent literature on maritime anomaly-detection approaches from the point of view of VTS operations. We do this by collecting literature, selecting relevant publications and classifying them corresponding to data source, detection technique and addressed-anomaly types. These and other classifying dimensions are chosen based on the capabilities and requirements of VTS. To the best of our knowledge, this is the first survey on maritime anomaly detection in which the literature is reviewed according to VTS-relevant properties. This survey may be of relevance for any researcher in the field of surveillance or monitoring of maritime traffic or closely related topics. Closely related topics may be any intermediate step of maritime anomaly detection such as traffic extraction or representation.

This survey is organized as follows: In Section 2, this survey is compared with related work. It is shown how comparable surveys can be distinguished and on what other authors focus. Subsequently, in Section 3, the reader is introduced to the context and scope of this survey. As a result, the tasks and services, as well as the technological capabilities and application of DST, are explained. The Section closes with an outline of anomaly types and detection techniques. The literature-review process comprising the collection, selection and classification of the literature in this survey is explained in Section 4. Section 5 presents the results of the literature review. Finally, the survey is concluded in Section 6.

2. Related Work

Within recent years, some surveys reviewing anomaly-detection articles in the maritime context have been published. Here, we focus only on recent surveys starting from 2017 (cf. Section 4).

Sidibé and Shu [9] provide a summary of approaches for anomaly detection for the period 2011–2016. This summary comprises approaches which utilize AIS data only. Further, the authors characterize the approaches by their techniques and applied AIS data attributes.

In [10], an overview of AIS-based anomaly-detection techniques is presented as a part of a broader survey. This survey also deals with related topics such as AIS data providers and methods on route estimation or collision risk assessment. The overview on the detection techniques strongly focuses on technical backgrounds.

Riveiro et al. [7] give a holistic overview of anomaly-detection techniques. The authors cover over two decades of literature, i.e., 1996 to 2017. The reviewed approaches are characterized with various properties such as the utilized data, normalcy extraction and representation, the detection technique itself and anomaly types. Particularly worth mentioning is that this survey does not focus on a specific data source such as AIS.

In a study by Yan and Wang, an overview of AIS-based data-driven detection techniques is given [11]. Further the authors distinguish among purely statistical or Machine-Learning-based as well as hybrid techniques.

In [12], the authors introduce a distinction between the detection of events and anomalies. For both, the reviewed approaches are characterized according to their underlying detection techniques. All reviewed approaches rely either on AIS data solely or in combination with other data, e.g., environmental data.

Similarly to the majority of the previously mentioned related work, Dogancay et al. provide an overview of the techniques of anomaly-detection approaches [13]. However, this survey focuses on AIS-based approaches only.

The most recent survey was published by Wolsing et al. in 2022 [14]. Even though this survey focuses on AIS data only, the noteworthy key result of this work is a tabular overview which sorts anomaly-detection approaches from the years 2007 to 2021 by detection techniques, anomaly types, utilized AIS data attributes and more.

Therefore, to the best of our knowledge, this work represents the first survey which reviews maritime anomaly-detection approaches w.r.t. VTS context—more specifically, the Information Service of VTS—and sorts the reviewed literature, accordingly, by relevant properties.

3. Situation Awareness in Vessel Traffic Services

In this section, the reader is introduced to VTS and how its operators build up and maintain their situation awareness about maritime traffic flow. It starts with a brief summary of the historic origin and development of VTS and moves to the service goals and levels. Then, the technological capabilities are briefly introduced and how DST build on them. Finally, the topic of maritime anomaly detection within the scope of this survey is introduced.

3.1. Tasks and Services

After the radio had been employed for a some time already, it was complemented by a novel technology when, in 1948, one of the first harbour surveillance radars was introduced in Liverpool [3,15]. Both technologies, radio and radar, not only offered extended communication and surveillance capabilities but also ensured these during adverse weather conditions. Although initially adapted for efficiency reasons, e.g., to reduce congestion, it was acknowledged that the utilization of these technologies also increased traffic safety. Since the advent of these informal VTS, not only has ship traffic been increasing but also the technological capabilities of VTS. In 2021, the latest guidelines for VTS were outlined in resolution A.1158(32) [4]. According to this resolution, vessel traffic service shall serve three purposes, which are:

1.

“providing timely and relevant information on factors that may influence ship movements and assist onboard decision-making”;

2.

“monitoring and managing ship traffic to ensure the safety and efficiency of ship movements”;

3.

“responding to developing unsafe situations”.

Thereby, VTS operation itself is no longer a pure observer and information provider over a traffic coordinator; rather, it is now a direct shore-based supporter as indicated by their service levels [3,16]:

1.

Information Service (INS);

2.

Traffic Organisation Service;

3.

Navigation Assistance Service.

This study specifically focuses on the INS of VTS.

3.2. Technologies and Their Operations

In order to fulfil the above-listed services and purposes, VTS can make use of various complementary communication and sensing technologies. They are specified by the International Association of Marine Aids to Navigation and Lighthouse Authorities (IALA) in Guideline G1111 [17].

Table 1. Overview of communication and sensor technologies of VTS as defined by IALA in Guideline G1111 [17].

Technology	Description
Radar	A radar system emits electro-magnetive waves and detects the echo signal of reflected waves by targets such as vessels [18]. Direction and distance to the target as well as its motion direction and velocity can be deduced.
AIS	AIS is a standardized, automatic communication system which is used over transceivers [17,19]. It is used by vessels, VTS and for (virtual) aids to navigation. Depending on the message type, the message contains static, dynamic and voyage-related information about the sender.
Environmental monitoring	Various relevant environmental conditions can be monitored [17]. Common is the measurement and monitoring of hydrological (e.g., height of tide, current speed or ice coverage) and meteorological (e.g., wind speed, wind direction or visibility) conditions.
Electro-optical systems	Electro-optical systems refer to imaging devices that can be, for example, daylight or night-vision camera surveillance [17]. Usually, the field of view of the utilized cameras is adjustable.
Radio communications	Spoken communication takes place over VHF radio communication systems [17]. VHF is used to enable real-time situation assessment.
Radio direction finders	A radio direction-finder device is able to deduce the bearing to a VHF emitting station. The bearing can be associated with an AIS target in the vicinity.
Long-range sensors	For situation awareness beyond the operation range of short-range sensors (e.g., radar or AIS), long-range sensors can be applied [17]. Common examples are the so-called long-range identification and tracking system or satellite-based AIS.

gives an overview of these technologies.

The data and information of the utilized communication and sensing technologies are fused together with the aim of providing holistic situation awareness. Software is used which visualizes the situation awareness in an electronic navigational chart.

3.3. Decision Support

In order to facilitate and enhance the situation awareness further, VTS operators are encouraged to utilize decision support tools, which deliver more elaborate functionalities. Examples of applications of DST are listed in IALA Guideline G1110 [5]. The complexity of DST ranges from simple functionalities such as geographically confined vessel-speed alerts to anomalous-behaviour alerts. Accordingly, the complexity of the technical implementation varies from threshold-based alerts to traffic models build on historical data.

To our knowledge, VTS operators most commonly use rather simple DST such as vessel-speed or -number alerts, anchor watch or geofence-based monitoring of undesired entering or leaving of specified zones. However, these alert systems are highly customizable, so that, e.g., thresholds and geographically confined areas can be defined freely based on situation and experience. More complex DST that are, for example, based on statistical models or Machine-Learning-based systems have not found their way into VTS systems yet.

3.4. Anomaly Types and Detection Techniques

An anomalous pattern, i.e., an anomaly, inherently requires an understanding of the normalcy from which it deviates. In the context of maritime traffic, VTS operators expect certain traffic patterns which they perceive as normal. Therefore, deviating traffic patterns may appear anomalous. Humans perform this reasoning through different approaches such as using formalized rules or simply by experience. Similarly, anomalies can be detected by a machine. The mechanism performing this is called anomaly detection. In the following, we will first describe a variety of anomaly types and subsequently outline briefly anomaly-detection techniques.

In this review, we focus on five generic anomaly types, which are listed in

Table 2. Considered generic anomaly types in the review classification scheme.

Anomaly Type	Description
Kinematic deviation	Deviation in a single kinematic parameter, e.g., speed over ground or course over ground.
Route deviation	Deviation in a route due to deviation in the sequence of positions.
Collision risk	Close approach between vessels or vessels and (abstract) objects. Objects can be visible on water (e.g., bouys) as well as regulatoric (e.g., traffic separation schemes as abstract objects) or physical (e.g., shallow water or coastlines) confinements of the waterway.
Zone entry	Penetration of regulatorily or physically defined zones.
Inconsistency	Information inconsistency in the situation awareness either due to sensors providing contrasting information or one sensor providing false data.

. This selection is based on our talks with experts in the field of VTS development and operation, other studies [12,20,21] and a preliminary, exploratory investigation of the reviewed literature. These anomaly types, on the one hand, are sufficiently generalized to form the basis for more specific or complex anomaly scenarios and, on the other hand, cover frequent anomaly scenarios which can be addressed by DST [17].

Note that an anomaly detection must not be restricted to the detection of anomalies in the present situation but may also predict upcoming anomalies and their probabilities of occurrence.

The complexity of the an anomaly-detection technique can range from a rule-based system to a system based on a neural network. Generally, multiple techniques can serve an anomaly type. The choice of the technique can be driven by various factors such as the available type and amount of data or computational power. In safety-critical environments such as VTS, in particular, reliability and explainability of the technique play important roles.

In our review, we identified five groups of techniques which are applied for the problem of anomaly detection (cf.

Table 3. Considered anomaly-detection techniques in the review classification scheme.

Detection Technique	Description
Descriptive Statistics	Detection techniques based on descriptive statistics are data-driven. They rely on data sets which are used to derive a statistical distribution to model behaviour patterns [6,22]. Here, normalcy is defined as any pattern that is close to the mean behaviour pattern. An anomalous behaviour pattern would be anything that deviates too far from the mean, thus the term outlier. The degree or threshold of an anomaly is given by the distance from the mean.
Stochastic Processes	Behaviour patterns can be described as stochastic processes. In this case, a model is created which is able to describe the change in a pattern (or a state) over time randomly or due to influential conditions. Generally known approaches that fall into this technique are Markov models or models based on Bayesian statistics [22].
Clustering	The technique of clustering comprises approaches for the creation of clusters and which are based on Machine Learning (ML). There exists a variety of clustering algorithms which all serve specific purposes [23].
Classification	Classification can be performed through various approaches. In this review, only ML-based classification approaches are counted as classification approaches. Similarly to clustering, there is a broad variety of classification algorithms [23].
Neural network-based	Neural networks (NN) are universal function approximators and, thus, theoretically can address every problem type. Any NN-based detection approach is considered under this technique [24].
Rule-based	Rule-based systems build upon human-made rules. The other aforementioned techniques rely on sets and interactions of rules, too; however, this technique crucially differs in its simpler technical structure and the intuitive explainability of decision processes [12].

). We define a techniques as groups of methods. It is important to note that a detection approach does not stick to one specific method but can use multiple methods from one or several of the following techniques.

In case an anomaly-detection approach does not fall under the introduced techniques, it is classified as other.

4. Literature Review

In this section, the literature-review process is briefly explained. This includes the collection, selection and classification of the literature. The whole process is depicted in Figure 1.

4.1. Collection

The focus of this literature review lies in the approaches of anomaly detection in the context of maritime traffic surveillance conducted by VTS, specifically, INS. Beyond that, the review is not constrained to specific anomalies, a data source or other dimensions as is done in some related works (cf. Section 2). Accordingly, the scope is set by the definition of the search terms:

• maritime;
• (surveillance OR VTS OR monitoring);
• anomaly detection.

Here, each term is connected by a Boolean AND operator and the words of the VTS-specific term are connected by Boolean OR operators. By doing this, we aim to retrieve a broad variety of literature within our scope. To focus on more recent approaches, the search is confined to literature from the years 2017 to 2022. Initially, the first 100 search results on Google Scholar were collected.

4.2. Selection

Irrelevant publications, i.e., topic out of scope, were dropped. Kept literature was checked for potentially relevant references. These steps were repeated iteratively, as can be seen in Figure 1. This way, we made sure to collect publications which had not been listed in the initial set of 100 search results but had been cited by other publications.

Thesis works were not kept; however, the references on which they were based were kept. Other surveys were not kept either; however, their references were checked for relevance, too. This selection process of the literature was cross-checked internally.

4.3. Classification

The finally obtained publications were compared. To compare the introduced context of the INS of VTS, corresponding classification dimensions were defined. Initially, the following set of classification dimensions was formulated:

• Data source (i.e., communication and sensor technologies, cf. Table 1);
• Anomaly types (cf. Table 2);
• Area types (i.e., physically, regulatory or not constrained)
• Ship types;
• Detection techniques (cf. Table 3).

The literature review was then performed using these classification dimensions. During the review process and at its end, the filled classification table was cross-checked internally to make sure that the classification was being performed under common understanding and to check for any flaws.

5. Results

The number of publications which were retrievable with the defined search phrase (cf. Section 4) has increased significantly within recent years, as can be seen in Figure 2. To put this into context: more publications are retrievable from the year 2022 than from the years 2010–2015 combined.

Following the review methodology depicted in Figure 1, in total, 136 publications were collected and screened. From those, 55 passed the selection criteria and cross-checks. These publications were sorted according to the classification explained in Section 4. By doing this, this survey addresses topics in or close to the field of maritime traffic surveillance, monitoring or VTS operations, specifically.

The resulting classification of the publication can be examined in

Table 4. Screened publications grouped by data sources and denoted according to detection techniques and anomaly types. Data sources are abbreviated as follows: AIS (A), camera (C), radar (R) and other (O). Abbreviations are concatenated when data sources are combined. Filled circle (●) when a technique or feature is used in publication, otherwise empty circle (○).

	Publication			Technique								Anomaly
Data Source	Author	Year		Descriptive Statistics	Stochastic Processes	Clustering	Classification	NN-Based	Rule-Based	Other		Route Deviation	Kinematic Deviation	Collision Risk	Zone Entry	Inconsistency
A	Abreu et al.	2021 [25,26]		●	○	○	○	○	○	○		○	●	○	○	○
	Cai et al.	2018 [27]		●	○	○	○	○	○	○		●	○	○	○	○
	Chatzikokolakis et al.	2019 [28]		○	○	○	○	○	●	●		●	○	●	○	●
	Chen et al.	2022 [29]		○	○	○	○	○	●	○		○	○	○	●	○
	Daranda and Dzemyda	2020 [30]		○	○	●	○	○	○	○		●	○	○	○	○
	Eljabu et al.	2021 [31]		○	○	○	○	●	○	○		●	○	○	○	○
	Filipiak et al.	2018 [32] 2019 [33]		●	○	○	○	○	●	○		○	●	○	○	●
	Ford et al.	2018 [34]		●	○	○	○	○	○	○		○	○	○	○	●
	Forti et al.	2018–2022 [35,36,37,38,39]		○	●	○	○	○	○	○		●	○	○	○	○
	Fu et al.	2017 [40]		○	○	●	○	○	○	○		●	●	○	○	○
	Goodarzi and Shaabani	2019 [41]		○	○	●	○	○	○	○		●	○	○	○	○
	Guo et al.	2021 [42]		○	○	●	○	○	○	●		○	●	○	○	●
	Han et al.	2020 [43]		○	○	●	○	○	○	○		●	●	○	○	○
	Hu et al.	2022 [44]		○	○	○	○	●	○	○		○	●	○	○	○
	Karatas et al.	2021 [45]		○	○	●	○	●	○	○		●	○	○	○	○
	Keane	2017 [46]		●	○	○	○	○	○	○		●	●	○	○	○
	Kontopoulos et al.	2020 [47]		○	○	○	○	○	●	○		○	○	○	○	●
	Kontopoulos et al.	2020 [48]		●	○	●	○	○	○	○		●	●	○	○	○
	Krüger	2019 [49]		○	○	○	●	○	●	○		○	○	○	○	●
	Nguyen et al.	2018–2021 [50,51,52,53]		●	○	○	○	●	○	○		●	●	○	○	○
	Patroumpas et al.	2017 [54]		●	○	○	○	○	●	○		○	●	●	●	○
	Roberts	2019 [55]		○	○	●	○	○	○	○		●	○	○	○	○
	Rong et al.	2020 [56]		●	○	●	○	○	○	○		●	○	○	○	○
	Singh and Heymann	2020 [57]		○	●	○	●	●	○	○		○	○	○	○	●
	Singh and Heymann	2020 [58]		○	○	○	○	●	○	○		○	○	○	○	●
	Tyasayumranani et al.	2022 [59]		●	○	○	○	○	●	○		●	●	●	○	○
	Wang et al.	2020 [60]		○	○	○	●	○	○	○		●	●	○	○	○
	Wang	2020 [61]		○	○	○	○	●	○	○		○	●	○	○	●
	Xia and Gao	2020 [62]		○	○	○	○	●	○	○		●	●	○	○	○
	Yan et al.	2022 [63]		●	○	○	●	○	○	○		○	○	○	○	●
	Zhao and Shi	2019 [64]		○	○	●	○	●	○	○		●	●	○	○	○
	Zhen et al.	2017 [65]		○	●	●	○	○	○	○		●	○	○	○	○
	Zhou et al.	2019 [66]		●	○	○	○	○	○	○		●	○	○	○	●
	Zissis et al.	2020 [67]		○	○	●	○	○	●	●		●	●	○	○	○
	Zor and Kittler	2017 [68]		○	●	○	○	○	○	○		●	●	○	○	○

for the AIS data source alone and

Table 5. Screened publications grouped by data sources and denoted according to detection techniques and anomaly types. Data sources are abbreviated as follows: AIS (A), camera (C), radar (R) and other (O). Abbreviations are concatenated when data sources are combined. Filled circle (●) when a technique or feature is used in publication, otherwise empty circle (○).

	Publication			Technique								Anomaly
Data Source	Author	Year		Descriptive Statistics	Stochastic Processes	Clustering	Classification	NN-Based	Rule-Based	Other		Route Deviation	Kinematic Deviation	Collision Risk	Zone Entry	Inconsistency
AO	Coleman et al.	2020 [69]		○	○	●	●	○	○	○		○	○	○	○	●
	Mazzarella et al.	2017 [70]		●	○	○	●	○	○	○		○	○	○	○	●
	Ray	2018 [71]		○	○	○	○	○	●	○		○	○	○	○	●
ARO	Thomopoulos et al.	2019 [72]		●	○	○	○	○	●	○		○	●	●	○	●
AR	d’Afflisio et al.	2018 [73,74] 2021 [75,76]		○	●	○	○	○	○	○		○	○	○	○	●
R	Bauw et al.	2020 [77]		○	○	○	●	●	○	○		○	○	○	●	○
	Van Loi et al.	2020 [78]		●	○	●	○	○	○	○		○	●	○	○	○
C	Fahn et al.	2019 [79]		○	○	○	●	○	●	○		○	○	●	○	○

for all other data sources and their combinations (with AIS). Multiple publications of the same author and approach are merged into one entry and classified according to the latest publication. As can be seen in the tables, and as stated in Section 4, the classification dimensions area types and ship types were dropped. This is due to the fact that only a small minority of the publications stated that their approaches were clearly addressing specific (or all) area or ship types. The scalability of presented approaches was rarely indicated either. Given that geographical features and maritime traffic can strongly differ among VTS regions, the choice of suitable anomaly-detection approaches is hampered.

In the following subsections, the approaches are presented sequentially from the perspective of the utilized data source, the underlying detection technique and the applicable anomaly type.

5.1. Data Sources

The frequency distribution of the utilized communication and sensor technologies as data sources is depicted in Figure 3. As can be seen, the majority of the proposed approaches utilize AIS solely as data source; however, some make use of AIS and other complementary data sources (cf. Table 4 and Table 5). This may be due to the fact that AIS data is easily accessible, available in large quantities and consistently structured, which makes the research and development of novel anomaly detection techniques feasible [12,14]. Another reason may be that, with AIS, data anomalies can be detected to a large extent.

Out of the 55 screened publications, 42 presented approaches relying on AIS solely. This is hardly surprising, as explained initially. A recent literature review specifically on the application of AIS-based maritime anomaly detection is presented by Wolsing et al. [14]. Some approaches combine AIS and other sources. D’Afflisio et al. propose an approach which relies on positional and kinematic data, which can come from AIS solely or complemented by radar [73,74,75,76]. In [72], Thomopoulos et al. present an anomaly-detection toolbox which fusions vessel data based on AIS, radar and Vessel Monitoring System [72]. In the concept by [69], it is proposed to enhance a vessel’s own situation awareness by complementing ordinary AIS data with additional target vessels’ data, such as from temperature sensors. Another data source is exploited by Mazzarella et al. [70] and Ray [71], who utilize the received signal strength indicator (RSSI) of terrestrial AIS base stations. As VTS maintain their own AIS base stations, the RSSI (or a similar dimension) is a potential data source for anomaly detection. The proposed data sources by [69,70,71] are listed under other in Table 4 and Table 5.

Out of the screened publications, only three utilized approaches are described that rely on data sources other than AIS. This is very striking, due to the availability of other communication and sensor technologies. The approaches from Bauw et al. [77] and Van Loi et al. [78] are both tested on real coastal-surveillance radar datasets. Bauw et al. further specifies that one-dimensional high-resolution range profiles are used in their study. High-resolution satellite-based image data, which includes seashores, rivers and islands, is tested in [79]. Remarkably, no shore-based image data has been applied to the screened approaches. Similarly to the situation with radar-based detection techniques, this is striking, as camera systems are widespread at VTS sites, too.

Czapelewski et al. [80] apply purely synthetic and simplified image data from an aerial view. They intend, however, to extend their approach and experiments on (synthetic) radar data. Due to the very conceptual character of the approach and its current application of synthetic data only, this publication is not listed in the completed classification schemes.

The review from the perspective of data sources indicates, from the variety of communication and sensor technology, that VTS includes (cf. Table 1) a remarkable minority of methods, i.e., only AIS and radar, is considered in maritime anomaly-detection approaches. Notably, no approach was screened within this review which was based on VHF, despite the fact that this communication technology is used widely and provides context information which cannot be obtained by other communication or sensor technology. In addition, that is despite current research and development progress on natural language processing, on the one hand, and the established Standard Marine Communication Phrases (SMCP), on the other hand, which is followed by Gözalan et al. in [81].

5.2. Anomaly Types

The screened publications were classified according to the anomaly types (cf. Table 2) which they aim to detect. The majority of the publications, viz. 33, covers one specific anomaly type. The remaining 22 publications cover two or three anomaly types (cf. Table 4 and Table 5). The most common combinations of addressed anomaly types cover, at least, either route deviation, kinematic deviation or both. The frequency distribution of the addressed anomaly types is depicted in Figure 4.

Tyasayumranani describes, in [59], an approach to detect whether a ship is being steered under the influence of alcohol. This complex detection is based on the detection of kinematic deviations, route deviations and collision risk. In [28,34], the authors present an approach to detect information inconsistency in the form of AIS reporting gaps due to potentially intentional AIS switch-off. Singh and Heymann describe approaches which shall be able to classify whether AIS reporting gaps are intentional or due to power outages [57,58]. Utilizing the RSSI through an AIS base station (cf. Section 5.1), Mazzarella et al. [70] and Ray [71] demonstrate the detection of AIS switch-off. Furthermore, Mazzarella et al. [70] and Thomopoulos et al. [72] outline a logic-based formalism which is able to detect falsified AIS messages. AIS spoofing is another scenario of information inconsistency and is covered extensively by the work of d’Afflisio et al. [73,74,75,76]. In [49], the author compares the outcome of different techniques (cf. Section 5.3) to detect spoofing committed by fishing vessels. In some approaches, inconsistency refers to invalid positional or kinematic data based on simple projections [32,33,42], taking a vessel’s manoeuvrability into account [29] or detecting implausible value changes [61]. Another form of inconsistency detection is described by Yan et al. [63] and Zhou et al. [66]. Based on different approaches, both compare the detected ship type with the actually reported one and, so, potentially detect information inconsistency. Close-approaches scenarios are defined by [28] as imminent collisions between vessels or the grounding of a vessel. Patroumpas et al. formalize scenarios such as fast or close approaches to detect suspicious interactions such as package picking [54]. Based on radar-range profiles, Bauw et al. demonstrate, in [77], the detection of the visit of unusual ship types, e.g., fishing vessels, in areas where, normally, tankers and container and cargo vessels operate. This is the only publication which covers the anomaly type of zone entry in our review.

It seems that there is already a variety of anomaly scenarios covered by the reviewed literature. The complexity level, ranging from the detection of simple kinematic deviation to that of hiding activities via switched-off AIS, varies, too. Taking into account the differences in the areas and traffic patterns that VTS oversee, most probably some addressed anomaly scenarios may be used universally, where others may need more customized detections, e.g., specific environmental or geographical conditions.

5.3. Anomaly-Detection Techniques

In Section 3.4, the techniques are explained according to the screened publications that have been sorted into each technique. Figure 5 illustrates the frequency distribution of the techniques applied to solve the different problem types of anomaly detection. It shall be noted, however, that the counts of the usages of specific technique types may be biased since some technique types may cover more potential approaches than others.

Remarkably, descriptive statistics is used most often followed by approaches which are based on clustering or neural networks. In [45,49,57,70,77], the authors compare the outcome of various techniques within specific anomaly-detection scenarios. Bauw et al. applies unsupervised approaches, notably, Support Vector Machine (SVM), Isolation forest, Local Outlier Factor, Convolutional Autoencoder and a semi-supervised NN-based classification approach proposed by Ruff et al. [77,82]. In the context of route deviation, Karataş compares the precision of numerous approaches, e.g., based on decision tree, random forest, and density-based spatial clustering of applications with noise (DBSCAN) in combination with classification and long short-term memory (LSTM), and states that decision-tree-based approaches perform the best in his context [45]. Krüger investigates the precision of AIS-spoofing detection with classification methods such as random forest, decision tree or k-nearest neighbours (kNN) algorithms and a fuzzy rules-based method [49]. In the context of detection of intentional AIS on–off switching, Mazzarella et al. compare the detection precision using SVM and a historically based spatial distribution to model the AIS-base-station RSSI [70]. In a similar context, Singh and Heymann compare the effectiveness at detecting whether, more specifically, AIS on–off switching occurs intentionally or due to a power outage by applying approaches such as Naive Bayes, SVM, kNN, decision tree, random forest and linear regression and NN [57].

As can be seen in Figure 6, the applied technique type is associated with the addressed anomaly type. The anomaly-types route deviation and kinematic deviation are covered by the commonly applied techniques descriptive statistics, clustering or NN-based classification.

Most detection techniques which are based on descriptive statistics consider, somehow, outliers in the (spatio-temporal) distribution of the vessels’ attributes [27,32,33,46,59,72]. Outliers can be defined with, e.g., distance to the mean or standard deviations. Commonly used attributes are, particularly, the vessels’ position, speed and course. Abreu et al. propose an approach based on visual analytics [25,26]: For visually selected spatial subtrajectories, a score indicating the degree of anomaly is calculated. Analogously to the approaches mentioned before, the calculation is based on the statistical deviation from the mean of given attributes. Implementation of anomaly-detection techniques based on descriptive statistics are very obvious in the age of big data. VTS are able to record data which is produced by their communication and sensor technologies. This data can serve as a solid basis for the aforementioned and other data-driven techniques.

Numerous approaches apply clustering, another data-driven technique, before proceeding with other techniques such as descriptive statistics or NN-based classification. This way, most authors try to reduce the amount of data while still keeping information about relevant traffic patterns, e.g., stopping or turning points. In [30,40,41,42,43,48,56,64], the authors apply DBSCAN as a clustering algorithm to vessels’ positional or kinematic AIS data. Zhao et al. use these clusters as training data for a Recurrent Neural Network (RNN), i.e., an LSTM [64]. The authors highlight that this method requires high data quality, which is a challenging task in a real-time environment such as VTS. It shall be mentioned that adjustment of the parameters of the DBSCAN clustering algorithm is known to be arbitrary [53]. Against the background of scalability and explainability of anomaly-detection techniques in safety-critical environments, the application of the DBSCAN clustering algorithm, however, is disputable.

Since NN are universal function approximators, they can process various data types and address a broad range of problem types in general. Due to the advent of big data, especially the availability of AIS data, NN can be trained intensely. A commonly addressed anomaly type is route deviation; however, the precise NN classes applied vary. Eljabu et al. trained a Graph Convolution Network which models the spatio-temporal vessel traffic network and demonstrates that it is able to identify anomalous route behavior [31]. In order to detect kinematic anomalies, Hu et al. apply a Variational Autoencoder and show that it outperforms other approaches, e.g., decision tree, SVM and LSTM [44]. In the work of Nguyen et al., an RNN is trained to detect kinematic and route deviations. It does so by learning the stochastic representation of given routes and detecting improbable events which can be anomalies [50,51,52,53]. A similar approach applying a Bayesian RNN is followed by Xia et al. [62]. Both working groups state that RNN are able to learn vessel behaviour patterns based on AIS data without preliminary traffic extraction and claim promising results. The literature shows that the results of NN-based anomaly detection are promising. Be that as it may, the decision finding process of NN-based systems intrinsically lack explainability [12,83,84]. Due to this, the application of NN in safety-critical environments such as VTS is problematic.

Forti et al. and d’Afflisio et al. base their work on the Ornstein–Uhlenbeck mean-reverting stochastic process [22]. However, both working groups have extended their approaches differently. Forti et al. cover route-deviation detection and demonstrate the capabilities of their approach [35,36,39] by applying it on the real-world scenario of the blocking of the Suez canal. They state that their approach would have been capable of predicting this anomaly early [38]. D’Afflisio, on the other hand, integrate a hypothesis testing framework and they aim at detecting AIS spoofing and stealth deviations [73,74,75,76]. Beyond that, inconsistency anomalies can be detected by other techniques. Some examples are rule-based approaches with predetermined thresholds [28,29,33,47,71,72], statistical approaches with data-driven thresholds [33,70,72] or those based on cross-checking data values using pre-trained classification models, e.g., SVM or random forest [63,70], or even NN, as performed by Wang [61]. The latter author further proposes a rare behaviour factor which can be used by (VTS) operators to tune the sensitivity of the anomaly detection [60]. The rule-based or statistically driven techniques offer a comprehensible decision process of anomaly detection. However, these techniques can only uncover anomalies which are predefined by experts and covered by statistical data. Furthermore, it shall be mentioned that anomaly-detection techniques based on statistical data assume that statistically frequent values (or events) correspond to normalcy. However, statistically rare values (or events) can be normal, too, and vice versa.

Two anomaly-detection techniques are sorted under other in the tabular overview (cf. Table 4 and Table 5). A unique approach within the scope of this review is followed by Guo et al. who deduce a vessel’s manoeuvrability from its trajectory through kinematic interpolation of the AIS track [42]. An AIS data point that does not follow the ship’s manoeuvrability is a potential anomaly. Another unconventional approach is the utilization of convex hulls, which is carried out by [28,67].

6. Conclusions

To ensure safe and smooth maritime traffic, its surveillance is performed by VTS for specific regions such as port or channel areas. VTS operators make use of various DST in order to reduce their workload and increase maritime-traffic safety. The DST themselves can utilize a variety of communication and sensor technologies and resulting data at VTS sites. One application of DST is the detection of anomalies in maritime traffic.

In this survey, the state-of-the-art of anomaly-detection approaches are presented. For this purpose, 136 publications from the years 2017 to 2022 were collected and screened for relevance. Therefrom, 55 publications were classified as relevant (cf. Section 4) and, subsequently, further investigated. Noteworthily, the number of relevant publications increases significantly for later years, as can be seen in Figure 2.

The proposed approaches are presented from the perspectives of the data sources (cf. Section 5.1), detectable anomaly types (cf. Section 5.2) and anomaly-detection techniques (cf. Section 5.3). The results can be summarized as follows:

• The primary data source used as a base for anomaly detection is AIS. The widespread application of this data source can be explained by its ubiquity, standardized structure and sufficient coverage of relevant maritime traffic information. Only few approaches utilize other data sources. However, despite the contextual information, VHF has not been used in any approach.
• The served anomaly scenarios can be grouped into five generic anomaly types. Most approaches aim at detecting either route or kinematic deviations, or information consistency. However, the precisely served anomaly scenario can be very specific and, for example, cover detection of intentional AIS switch-off, unusual ship visits or a ship being steered under the influence of alcohol.
• The underlying detection techniques are manifold and can range from rather simple and transparent approaches such as measures from descriptive statistics or rule-based systems to more complex and intransparent approaches, e.g., based on NN. The applied detection techniques are connected to the aimed anomaly detection type. For example, approaches for the detection of implausible kinematic or route deviation are often based on measures from descriptive statistics.

Finally, it is worth mentioning that almost all publications focus on specific anomaly scenarios. The approaches presented by Nguyen et al. [53] and Thomopoulos et al. [72] are part of holistic systems. However, none of the investigated approaches are applied operatively at VTS sites, yet.

7. Discussion

Despite all the approaches outlined in science, monitoring a VTS area is still a manual task for the VTS operators and, subsequently, connected with challenges to human observation capabilities and the ever-increasing volume of communication and sensor data. DST are under development, as outlined before; however, they are not used widely spread in current VTS operations. The authors assume that this is due to a variety of reasons, namely:

1.

Transparency of and trust in DST decision-making;

2.

Real-time capabilities;

3.

Scattered national solutions;

4.

Geographical scalability of approaches and training data sets.

As a first step, the potential lack of trust of the VTS operators in DST decision-making capabilities must be addressed. Specifically, with approaches not based on descriptive statistics or rule-based systems, the decision-finding is not clear to the operator due to a lack of explainability. Humans, then, tend not to trust the respective DST. Most of the solutions discussed above are concepts, prototypes or case studies which have never been integrated or tested within the operators’ daily working systems. This advanced prototyping and testing, which could help to close that trust gap, is also challenging, as not all VTS are computationally equipped to allow for higher levels of anomaly detection in real-time, given the existing computational power installed. Further, some interfaces to third-party computational systems cannot be realized due to security considerations, since VTS are considered critical infrastructure. As VTS systems are often national solutions for one coastal state resulting nationally in a bilateral monopoly structure as well as different interpretations of normality based on the geographical region, the scalability of research and development efforts is not a given. This makes development more challenging and rather expensive. Furthermore, the step from descriptive or rule-based DST towards other techniques outlined in this survey would require data-quality measures such as properly annotated training data sets, which go beyond pure AIS traffic tracking. According to the best knowledge, those set are not publicly available and significant efforts are needed to generate such sets, even though initial approaches to automatically annotate AIS data sets exists, such as, e.g., by Constapel et al. in [85] for COLREGs information.

Despite those implementation hurdles, DST capabilities for VTS operations are continuously progressing and have reached a state that allows a constantly more in-depth monitoring of maritime traffic than can be realistically achieved by human observation only. Safe but realistic test environments are needed to ensure early human-oriented testing by VTS operators, such as, e.g., achieved by the European Maritime Simulator Network within the STM Validation project [86]. Such environments can help to safely test DST to achieve trust and acceptance by the VTS operators in advance, to overcome one of the implementation hurdles for innovative DST in VTS. Additionally, integration of VHF information into DST must be further investigated, as there is still relevant contextual information missing for the DST given the currently considered data sources, which is AIS mainly.

In summary, the following future work is required, according to the authors’ opinion, to facilitate DST in daily VTS operations:

1.

Integration of VHF data into DST to bridge the missing data gap;

2.

Generation and availability of annotated and approved training data to bridge the training and testing gap;

3.

System integration of realistic test beds for operators under operational conditions to bridge the human–machine trust gap.

This would help DST to reach their full potential in assisting the VTS operators in their tasks by relieving them from routine, but still complex, monitoring tasks. They could then focus on ensuring safe and smooth maritime traffic in critical situations.