Redefining Maritime Anomaly Detection via Equation-Grounded Synthetic Anomalies

Abstract: Maritime anomaly detection is essential for ensuring maritime safety, security, and efficient traffic management at sea, with Automatic Identification System (AIS) data serving as a primary data source. Despite its importance, most publicly available AIS datasets lack predefined anomaly labels, forcing prior studies to rely on either distribution-based rarity or domain rule/expert-assisted labeling. These approaches, however, face fundamental limitations: statistical rarity often fails to reflect practically critical events, while expert-based labeling is costly, subjective, and difficult to scale. Moreover, both paradigms tend to overlook interaction-driven hazards such as near-miss approaches between vessels. To address these challenges, we propose an equation-grounded anomaly taxonomy that is implementable under a limited AIS observation schema and extensible to other AIS datasets. Specifically, the taxonomy defines three anomaly types: unexpected AIS activity (A1), route deviation (A2), and close approach (A3), covering both single-vessel and inter-vessel anomalies. Building on this taxonomy, we introduce a unified score-synthesize-label pipeline that produces LLM-guided plausibility scores, uses them to synthesize anomalies, and assigns timestamp-level labels. To rigorously assess detection performance, we further design benchmark evaluation settings that account for variations in temporal-window length and anomaly-type composition, and evaluate a broad range of time-series models and anomaly detection models. Together, these contributions provide a systematic basis for evaluating maritime anomaly detection methods across different anomaly types. Our code is available at https://github.com/snudial/open-maritime-anomaly-detection.

• The paper introduces a novel equation-grounded taxonomy that redefines maritime anomaly detection using rule-driven, LLM-guided synthetic anomalies.
• The methodology employs a score–synthesize–label pipeline that segments AIS data and generates physically consistent anomalies across three defined types.
• Empirical benchmarks reveal that traditional detectors struggle with sensor-induced (A1) and interaction-based (A3) anomalies, motivating new detection architectures.

Redefining Maritime Anomaly Detection with Equation-Grounded Synthetic Anomalies

Introduction

Maritime anomaly detection serves as a cornerstone for safety, security, and efficient traffic management, relying primarily on Automatic Identification System (AIS) data streams. However, the vast majority of open AIS datasets lack explicit anomaly labels, forcing prior studies into two insufficient labeling paradigms: distribution-based rarity (where outlier behavior is marked anomalous) and domain/expert-driven heuristics. Both suffer from fundamental limitations—statistical rarity does not always equate to operational risk, and expert annotation is costly, subjective, and infeasible for large-scale, high-resolution datasets. Furthermore, interaction-based hazards such as near-miss events between vessels remain critically underrepresented.

This paper introduces an equation-grounded anomaly taxonomy, shifting the anomaly definition from generic outlierhood to semantically and operationally grounded behaviors tractable within the constraints of real-world AIS data. A unified score–synthesize–label pipeline is constructed, employing LLMs as plausibility scorers to guide controlled and context-sensitive anomaly synthesis. Benchmark evaluation is conducted on a large, open maritime trajectory dataset, with maritime anomalies injected via explicit, rule-driven, and physically consistent perturbations. These advances lay the foundation for systematically evaluating model performance across single- and inter-vessel anomaly types.

Figure 1: Motivation and overview contrasting prior statistical anomaly definitions with the proposed equation-grounded taxonomy.

Equation-Grounded Anomaly Taxonomy

Building on the taxonomy proposed by Lane et al., three core anomaly types are operationalized for rigorous study:

• A1: Unexpected AIS Activity — Position spikes or discontinuities without commensurate kinematic shifts, generally interpreted as sensor artifacts or spoofing.
• A2: Route Deviation — Kinematic anomalies involving abrupt, multi-timestamp deviations in course over ground (COG) or speed over ground (SOG), yielding physically plausible but abnormal maneuvers.
• A3: Close Approach — Interaction-driven near-miss events between two vessels, parametrized by minimum lateral separation and relative motion, reflecting collision risk.

A1 and A2 are single-vessel anomalies, directly manipulating the observed trajectory, while A3 is explicitly formulated as a pairwise event requiring construction of a virtual vessel trajectory to simulate realistic risk-laden interactions.

Figure 2: Overview of the score–synthesize–label pipeline leveraging LLM-based scoring, equation-grounded synthesis, and structured labeling for all anomaly types.

The operationalizable nature of these definitions enables automated, reproducible labeling and evaluation, bypassing the limitations of sparsity-based or ad hoc labeling schemes.

LLM-Guided Anomaly Synthesis Pipeline

The framework begins by partitioning AIS tracks into fixed-length segments and querying an LLM (Qwen3-8B) with structured prompts that encode the target anomaly type and trajectory context (e.g., vessel type, SOG/COG statistics). The LLM outputs a vector of per-timestamp anomaly scores, reflecting the relative semantic plausibility for anomaly injection at each time step. These outputs consistently adhere to anomaly-type-specific structural constraints:

• For A1, LLM scores are allowed to be spiky and irregular, favoring timestamps where physical motion is inconsistent with positional jumps.
• For A2, contiguous high-scores are induced where abrupt kinematic changes are most contextually plausible.
• For A3, the score profile is unimodal and centered on the temporal apex of the simulated interaction, guiding synthetic close-approach event creation.

  Figure 3: Representative synthesized trajectory examples for A1 (position anomalies), A2 (route deviations), and A3 (close approaches between vessels).

The LLM does not synthesize trajectory points directly, ensuring generated values remain physically consistent and equation-constrained. All synthetic anomalies are injected deterministically using closed-form equations parameterized by the LLM’s score output.

Dataset Construction and Empirical Separation from Sparsity-Based Anomalies

Applying the outlined pipeline to the OMTAD open maritime dataset, the authors generate large-scale, labeled anomaly datasets across vessel types and time window lengths. Crucially, they demonstrate that statistical rarity-based anomaly selection (e.g., top-k by sparsity) fails to adequately recover the physically meaningful anomalies defined under the equation-grounded taxonomy, particularly for interaction-driven (A3) and sensor-artifact-based (A1) events.

Figure 4: Distributional analysis of LLM scores for 100 random segments per anomaly type, revealing distinct timestamp selection profiles aligned with anomaly semantics.

Figure 5: PCA embedding visualizes the weak overlap between sparsity-based and equation-grounded anomaly samples, especially for A1 and A3.

These results highlight the inherent limitations of purely unsupervised or outlier-based strategies—they systematically underdetect operationally consequential anomalies.

Quantitative Benchmark Evaluation and Detection Challenges

A rigorous benchmark comparison is conducted using traditional detectors (LOF, OCSVM, IForest), sequence models (LSTM, LSTM-VAE), and modern Transformer-based architectures (Informer, Anomaly Transformer, VanillaTransformer, etc.). Evaluation is strictly timestamp-level, using AUROC, AUPRC, and best F1 metrics, and models are scored separately by anomaly type and time window length.

Key findings:

• A1 (Unexpected AIS Activity): All models approach random-chance performance (AUROC ≈ 54), underscoring the extreme difficulty of detecting sensor-induced anomalies without kinematic deviations. Prediction error-based forecasting models marginally outperform reconstruction-based approaches, but absolute scores remain low.
• A2 (Route Deviation): This type is much more tractable. Forecasting architectures (e.g., Informer, VanillaTransformer) achieve AUROC > 94 and F1 > 38 at moderate anomaly ratios, leveraging pronounced, persistent kinematic shifts.
• A3 (Close Approach): Performance is intermediate (AUROC 66–75 for the top models), but only improves substantially when pairwise interaction features are explicitly constructed. Single-trajectory models underperform, while GNN-based and pairwise difference/concat inputs enable higher recall, directly exploiting the interaction-driven structure of A3 anomalies.

Model performance degrades markedly as the anomaly ratio falls, especially for A1 and A3, reflecting practical detection difficulty under data-sparse conditions. Notably, model rankings are highly consistent across anomaly ratios for A1/A2, while A3 exhibits more variability.

LLM Scorer Validation and Robustness

Systematic analysis of the LLM scorer demonstrates its effectiveness and reliability:

• Distributional Validity: Score output profiles are strongly type-consistent (spiky for A1, contiguous for A2, unimodal for A3).
• Repeatability: Timestamp selection is robust to changes in sampling temperature and model backbone, supporting stable guidance for anomaly injection.
• Generalization: Pairwise backbone agreement studies and expert validation confirm that LLM scorer outputs are consistent and operationally plausible across segments and model configurations.

  Figure 6: Repeatability heatmap showing the stability of the LLM scorer’s timestamp selections across repeated runs and temperature settings.

Practical and Theoretical Implications

The equation-grounded synthetic anomaly paradigm addresses long-standing challenges in maritime ML—namely the lack of standardized, operationally meaningful, and reproducible anomaly labels in public datasets. By offering a physically interpretable and extensible taxonomy, it supports more faithful benchmarking and theory development in sequential anomaly detection for real-world risk domains.

Practically, this framework lays the groundwork for robust model development and deployment for maritime situational awareness applications, with near-term utility in traffic safety systems, digital twin simulation, and incident investigation platforms. The approach is also modular and dataset-agnostic, enabling adaptation to non-maritime domains where domain knowledge can be formalized as explicit, label-generating equations.

From a methodological perspective, the demonstrated failure of sparsity- and error-based detection methods for certain anomaly types motivates the need for novel architectures with stronger inductive biases towards relational or cross-sensor anomaly structure (e.g., spatio-temporal GNNs, graph transformers with explicit interaction modeling).

Conclusion

This work formalizes a principled and operationally grounded framework for synthetic anomaly labeling and benchmarking in maritime vessel trajectories, driven by a score–synthesize–label paradigm that leverages LLMs strictly as context-sensitive scoring modules. It demonstrates that robust anomaly detection hinges upon the alignment between model assumptions and anomaly semantics, particularly for interaction- and sensor-driven events that escape traditional outlier methodologies. The equation-grounded approach marks a necessary step toward standardized, scalable, and empirically meaningful evaluation in maritime anomaly detection and related safety-critical domains.