Whitepaper

From Reactive to Proactive: Going Deeper into Location (GNSS) Manipulation Detection

Request a demo

TLDR

Location (GNSS) manipulation has quickly become popular among illicit actors and much more complex than it was only a few years ago. The maritime industry finds it challenging to stay ahead of bad actors developing new, previously undetected methods.

Windward’s NEW white paper offers two real-world, mini-case studies that show the power of moving beyond known detection typologies with a deep learning model for automatic detection. You will also learn advanced detection techniques, plus the importance of clean data and the humans-in-the-loop.

“Hiding in Plain Sight” Gets Sophisticated

Location (global navigation satellite system – GNSS) manipulation started as a widely used, military-grade technology adopted by navies, but it has since evolved to pose a significant threat to commercial global shipping and trade.

Unfortunately, location (GNSS) manipulation, which falls under the industry’s umbrella term “AIS spoofing,” has become common practice in the commercial market. The number of unique cases has grown exponentially since 2020, with over 3,000 cases involving nearly 1,000 unique vessels.

Location manipulation stands out among deceptive shipping practices due to its advanced technological nature. It features the use of a machine-generated location/path to disguise the true location of the vessel. Multiple methods have been identified to carry out this deception, including false transmission onboard the vessel and third-party onshore accomplices.

Traditional deceptive shipping practices are based on manipulating the information vessels transmit, making those practices relatively transparent. These include altering the vessel’s identities (MMSI and IMO), engaging in dark activity (lack of transmission), or frequently changing transmitted flags.

Location (GNSS) manipulation is different. Bad actors continue to transmit data as usual, but they manipulate the information behind the scenes. This makes the vessel appear to be in a legitimate location, when it is actually somewhere else. Windward calls this phenomenon “hiding in plain sight.”

This sophisticated tactic allows bad actors to obscure their true movements and intentions without exposing themselves to reputational damage. Location manipulation complicates pre- and post-fixture processes, and efforts to enforce sanctions and regulations, because illegitimate vessels seem legit.

From Simple to Complex: Detection Challenges

Windward has detected location (GNSS) manipulation incidents since its commercial emergence in 2021 by using a fixed set of recognized behaviors, or typologies.

Initially, the patterns generated by location (GNSS) manipulation were often obviously fake and easy to detect with the naked eye – the supposed vessel movements were physically impossible and made no logical sense.

These early attempts at deception included perfect geometrical shapes, sharp turns, and vessels sailing for long periods against ocean currents (see the image below).

Much like deceptive practices identified and included in official advisories and regulations become outdated, bad actors quickly adapted to the known manipulation typologies and developed new tactics to evade detection and sanctions.

Patterns became increasingly sophisticated. So while the behavioral typologies model is still critical, without advanced technology and proper domain expertise, stakeholders can miss many new cases that do not align with any of the known typologies.

Addressing this challenge requires groundbreaking, agile technology that can quickly evolve in real-time. By leveraging deep learning models and years of domain expertise, we can move beyond reactive detection frameworks to create proactive models that continuously learn and adapt to emerging threats. These models must be capable of cross-referencing multiple data sources – such as multiple AIS vendors and satellite imagery – and identifying nuanced patterns that indicate manipulation.

Moving Beyond Typologies

Deep learning is a type of artificial intelligence (AI) that mimics how the human brain works to process information and make decisions. Imagine teaching a child to recognize different animals. Instead of giving the child a list of rules to identify each animal, you show them thousands of pictures of animals and tell them the names. Over time, the child learns to recognize each animal based on the patterns they observe.

Similarly, deep learning models are trained on vast amounts of data, allowing them to learn and identify complex patterns and anomalies without being explicitly programmed with specific rules.

All current location (GNSS) manipulation detection models rely on predefined behavioral typologies, like the child above who is given a list of rules. These models flag vessels based on specific, known behaviors, which still works well and catches many cases. But these existing typology models are inherently limited by their reactive nature, because they can only recognize what it has been explicitly programmed to detect.

The Power of Deep Learning: Recognizing Real vs. Synthetic Signals

The Windward Location (GNSS) Manipulation Risk model was enhanced with deep learning technology. Deep learning is trained from the vast amounts of historical data, which Windward has been meticulously tagging since 2021. This wealth of data gives Windward a unique edge, because without it, you can’t build a deep learning model.

Windward’s deep learning model operates like the child learning to recognize animals through exposure to thousands of examples. Rather than being confined to a fixed set of rules (typologies), the model learns from a vast dataset of historical signals.

This includes fake signals that have been verified as manipulations and real ones that were suspected of being fake, but were then verified as being legitimate. This training allows the deep learning model to identify complex patterns and subtle anomalies that indicate a manipulation, even if they don’t fit into any predefined category. By analyzing real vs. synthetic signals, the model can adapt to new and evolving threats, ensuring robust detection capabilities that are not easily circumvented.

Deep learning technology allows Windward’s model to operate without rigid thresholds. By continuously learning from the data it processes, the model can identify complex patterns and subtle anomalies that are indicative of location (GNSS) manipulation. But how can we ensure the data it uses to train and learn is accurate?

The Importance of Accurate Data

The effectiveness of any deep learning model is directly tied to the quality of the data it is trained on. For location (GNSS) manipulation detection, ensuring that the data is accurate, clean, and comprehensive is paramount.

High-quality, accurate data allows the model to not only learn from true representations of legitimate maritime behavior, but also to differentiate between authentic and synthetic signals. If a model is trained on dirty data, as raw AIS data tends to be, and an authentic signal is mistakenly labeled as synthetic, the number of false positives would greatly increase.

So how is data integrity promoted?

A Foundation of Historical and Accurate Data

Important Methods and Best Practices

A unique dataset and early tagging – since Windward began tagging location (GNSS) manipulations as early as 2021, we have amassed a unique dataset that forms the foundation for training our deep learning model. This extensive historical database provides unparalleled insights into this behavior, enabling our model to learn from a wide array of real-life cases and enhance its detection capabilities.

Fused blips for clean signals – our approach emphasizes a patented fusion process designed to clean, fuse, and simplify raw AIS data, ensuring only relevant data is retained. This process integrates multiple data sources to create a comprehensive and accurate dataset. By meticulously cleaning and fusing the data, we eliminate noise and enhance the quality, providing a robust foundation for our deep learning model to accurately detect location (GNSS) manipulation.

Multi-vendor data integration – Windward’s technology ingests data from multiple vendors, making it significantly more difficult for spoofing attempts to succeed. This comprehensive approach allows us to cross-verify information from various sources, further enhancing the accuracy and reliability of our detection.

Advanced Detection Techniques

Cross-referencing AIS signals – the neural network in our model combines different types of maritime signals from AIS transmissions to identify complex patterns and subtle anomalies that indicate manipulation.
Continuous learning and adaptation – our model incorporates mechanisms for continuous learning and adaptation. It is regularly retrained on new cases, allowing it to focus on different types of manipulation and respond quickly to emerging threats. This adaptive approach ensures that our detection capabilities are not constrained by outdated formulas and can swiftly adjust to new deceptive tactics.

The X-Factor: Humans-in-the-Loop

Ensuring accuracy with expert validation – the deep learning model is supported by human expertise to ensure the highest accuracy in detection. Domain experts play a crucial role in accurately labeling manipulation cases, providing precise data for the model to learn from. This humans-in-the-loop approach is essential for maintaining the model’s effectiveness and reliability.
Real-world validation – by manually inspecting flagged cases from the model – plus cases we gather from customers, partners, and industry sources – our experts ensure that the model’s detection is accurate and actionable. This wide-ranging review and validation process reduces false positives and maintains the model’s overall precision at 100%.

Detecting Location (GNSS) Manipulation: Real-World Examples

Our advanced location (GNSS) manipulation detection technology is not an abstract concept…it has proven effective in real-world scenarios with leading maritime agencies and organizations. Below are two use cases that illustrate how our deep learning model accurately identifies GNSS manipulation that is not aligned with any known behavioral typology.

Case Study 1: Palau-Flagged Tanker

Khor Al-Zubair Port in Iraq has become a notorious hiding spot for vessels engaging in location (GNSS) manipulation. A significant increase in cases where vessels appear to be transmitting legitimate AIS signals, while actually not being present at the port, has been observed. One such example is the following Palau-flagged tanker, owned by a company located in the Marshall Islands.

- Vessel movement: the tanker arrived from Fujairah and sailed back there
- Spoofing duration: Approximately three days

Draft changes: during the manipulation, the vessel’s draft changed from 7.1 to 10.2 and back to 7.1, indicating cargo operations

Detection: the tanker initially appeared to be at the correct location in the port, based solely on its AIS transmission. And a satellite image of the port area from May 31, 2024, shows a vessel in the area. But upon closer analysis, the vessel in the image does not match the Palau-flagged tanker’s size (228m vs. 182m).

Further investigation revealed that the vessel in the photo was actually a low risk Liberian-flagged oil products tanker – confirming that the vessel was not really where its crew wanted people to think it was.

Map 1 — *Showing the Palau-flagged tanker’s transmissions in port and the real low-risk vessel that was actually there, but that is different in size than the vessel claiming to be there.*

Behavioral pattern: this tanker is a repeat offender, consistently engaging in location (GNSS) manipulation in the Persian Gulf region.
Windward risk: this vessel has been flagged as a high-risk vessel in the Windward system since May 2024 for multiple location (GNSS) manipulation incidents

Case Study 2: Panama-Flagged Crude Oil Tanker

Location (GNSS) manipulation is often visually identifiable through fake paths or shapes, as discussed above. But this Panama-flagged crude oil tanker, which is owned by a Chinese company and usually operates between Singapore and China, presented a more challenging case.

Vessel movement: the vessel appeared to anchor near Malacca on May 13, 2024, where it started its manipulation
Manipulation duration: eight days
Draft changes: the vessel’s draft changed multiple times (11 -> 7.5 -> 11 -> 7.6 -> 11 -> 20), indicating significant cargo operations
Detection: despite looking like normal anchoring behavior, the satellite image from May 18, 2024 confirmed the vessel was not present at the supposed location

Map 2 — *Image 2: Planet Labs satellite image shows the Panama-flagged tanker’s legitimate behavioral pattern and the satellite image confirming it’s not really there.*

Behavioral pattern: unlike the vessel in our first use case, this tanker operates in various areas, including Malacca and the Persian Gulf, showcasing its use of location (GNSS) manipulation in multiple regions
Windward risk: this vessel has been flagged as a high-risk vessel in the Windward system since October 2023 for multiple location (GNSS) manipulation incidents and dark activities, all related to the Iran regime

Accurate Identification for Maritime Security

These use cases underscore the importance of our deep learning model in detecting location (GNSS) manipulation events occurring outside the scope of the known behavioral typologies. The model’s ability to analyze vast amounts of data, together with AIS signals cross-referenced with satellite imagery by the humans-in-the-loop, allows for accurate identification of deceptive practices, ensuring maritime security and compliance.

By leveraging cutting-edge technology and extensive domain expertise, we provide robust and reliable detection capabilities that keep our clients informed and protected against sophisticated GNSS manipulation tactics.

I Want to Learn More about Deep Learning!

Request a demo