11 detectors · normalized
Eleven ways to see
what shouldn't be happening.
Every position, every track, every second. The behavioral detectors run continuously and report normalized confidence scores so the triage queue stays ranked by priority, not by detector.
Dark transit
Identifies vessels going dark — turning AIS off mid-transit through monitored waters. Weighted by prior dwell and geofence proximity.
AIS spoofing
Detects MMSI swaps, impossible jumps, and inconsistent static fields. Flags vessels whose reported identity doesn't match kinematic history.
Loitering
Course-change intensity formula catches active loitering distinct from anchorage. Speed threshold separates idle hulls from surveillance patterns.
Rendezvous
Two vessels closing to within transfer range, one of them dark. Often precedes ship-to-ship transfers or sanctions evasion.
Geofence breach
Entry into restricted, exclusion, or sensitive zones. Configurable per sector — Taiwan median line, Hormuz TSS, Azov exclusion.
Speed anomaly
Departures from the vessel's own historical speed baseline, not static thresholds. Captures both unusual sprints and unexplained drifts.
Heading anomaly
Erratic heading changes inconsistent with vessel type and traffic density. Tuned to distinguish fishing from evasion.
Route deviation
Track divergence from declared destination or typical corridor. Weighted by distance-to-detour and time-off-path.
Kinematic implausibility
Positions that imply impossible speeds or heading changes between reports — a common signature of spoofing and replayed tracks.
Statistical outlier
Per-vessel baselines combined with peer-group distributions flag behaviors that look normal in isolation but not against similar hulls.
Collision risk
Closest-point-of-approach forecasts across tracks. Surfaces near-miss geometries before they materialize — also a proxy for coerced encounters.
Signals fuse into a single risk score per vessel.
Each detector emits a confidence between 0 and 1. Scores are weighted by sector context — a geofence breach in Hormuz carries more weight than the same breach in the Channel — then combined into a normalized 0–100 risk score with MARSEC tiering.