SeaSpoofFinder -- Potential GNSS Spoofing Event Detection Using AIS

1. Problem Statement

The paper addresses the critical challenge of detecting large-scale Global Navigation Satellite System (GNSS) spoofing events in the maritime domain. GNSS spoofing involves the transmission of counterfeit signals to deceive receivers into reporting false positions. While individual vessel anomalies can be difficult to distinguish from sensor errors or data transmission issues, the paper posits that coordinated, large-scale spoofing creates a unique signature: multiple vessels in the same geographic area simultaneously reporting implausible position jumps. The core problem is developing a scalable method to infer these events from the global stream of Automatic Identification System (AIS) data without relying on direct GNSS signal interception.

2. Methodology: The SeaSpoofFinder Framework

The authors developed a data-processing framework named SeaSpoofFinder (available at seaspooffinder.github.io/ais_data) to ingest and analyze global AIS position reports. The detection logic follows a rigorous two-stage filtering procedure:

• Stage 1: Kinematic and Data-Quality Filtering

  • The system ingests raw AIS streams and applies kinematic filters to identify implausible position jumps.
  • These filters evaluate the physical feasibility of a vessel's movement (e.g., speed and acceleration limits) to flag reports where a vessel appears to teleport to a new location instantaneously.
  • Data-quality filters are applied to remove obvious transmission errors or corrupted data packets.

• Stage 2: Spatial Consistency and Clustering

  • To distinguish between isolated sensor failures (single-vessel artifacts) and genuine spoofing events, the system requires spatial and temporal correlation.
  • An event is only retained as a candidate if multiple vessels exhibit:
    1. Source Clustering: They originate from a consistent, plausible location.
    2. Target Clustering: They simultaneously jump to a consistent, implausible destination.
  • This multi-vessel consensus mechanism significantly reduces false positives caused by individual vessel data anomalies.

3. Key Contributions

• Development of SeaSpoofFinder: A publicly available framework for processing global AIS data specifically designed to detect spoofing patterns.
• Two-Stage Detection Algorithm: A novel approach that moves beyond single-vessel anomaly detection to a cluster-based analysis, effectively separating systemic spoofing from random noise.
• Global Anomaly Catalog: The creation of a dataset of Final Potential Spoofing Events (FPSEs) derived from real-world maritime traffic.
• Differentiation of Artifacts: The framework explicitly identifies and categorizes non-spoofing anomalies (such as "back-to-port" jumps and data gaps) that often mimic spoofing signatures in dense traffic regions.

4. Results

The analysis of the processed AIS data revealed several significant findings:

• Recurrent Spoofing Patterns: The system identified distinct, recurring spoofing footprints in several high-risk maritime regions, including:
  • The Baltic Sea
  • The Black Sea
  • Murmansk and Moscow (likely referring to the approach to these ports)
  • The Haifa area (Israel)
• Scale of Impact: The affected footprints were observed to span large maritime areas, suggesting that the spoofing events are not isolated incidents but rather broad-area interference affecting multiple vessels simultaneously.
• False Positive Analysis: The study highlighted that even with strict filters, dense traffic regions generate "non-spoofing artifacts" (e.g., vessels reporting jumps back to their home port or data gaps due to signal loss) that can pass initial heuristic filters. This underscores the necessity of the Stage 2 clustering logic.

5. Significance and Limitations

• Strategic Value: The paper demonstrates that AIS-based monitoring is a viable, cost-effective method for identifying and characterizing potential GNSS spoofing activity at a global scale. It provides actionable intelligence for maritime security agencies and naval forces.
• Attribution Caveat: The authors explicitly emphasize a critical limitation: while AIS data can provide strong evidence of spoofing activity, it does not provide definitive attribution. The framework identifies that spoofing is likely occurring and where, but it cannot determine the specific actor or source of the spoofing signal without additional intelligence.
• Future Implications: This work establishes a baseline for automated maritime domain awareness, suggesting that continuous monitoring of AIS streams can serve as an early warning system for GNSS integrity threats.