Anomaly Detection in Vessel Tracks using Bayesian networks
Steven Mascaro Ann E. Nicholson Kevin B. Korb
Bayesian Intelligence Pty Ltd, Clayton School of IT, Clayton School of IT,
www.bayesian-intelligence.com Monash University, Australia Monash University, Australia
are within or near one of these clusters may be con-
Abstract sidered normal, while the remainder are flagged as po-
tential anomalies. Researchers use many different ma-
In recent years, electronic tracking has pro- chine learning techniques to generate normality mod-
vided voluminous data on vessel movements, els from vessel movement data (typically AIS data),
leading researchers to try various data mining and the models are commonly specified in the language
techniques to find patterns and, especially, of Gaussian mixture models (Laxhammar, 2008), sup-
deviations from patterns, i.e., for anomaly port vector machines (Li et al., 2006), neural networks
detection. Here we tackle anomaly detection and others. A disadvantage of these approaches is that
with Bayesian Networks, learning them from they do not provide a causal model that a human user,
real world Automated Identification System such as a surveillance officer, can understand, interact
(AIS) data, and from supplementary data, with and explore.
producing both dynamic and static Bayesian
Here, we explore the use of Bayesian Networks (BNs)
network models. We find that the learned
(Pearl, 1988; Korb and Nicholson, 2010) for analysing
networks are quite easy to examine and ver-
vessel behaviour and detecting anomalies. While BNs
ify despite incorporating a large number of
have been widely applied for surveillance and anomaly
variables. Combining the mined models im-
detection (e.g., Wong et al., 2003; Cansado and Soto,
proves performance in a variety of cases,
2008; Wang et al., 2008; Loy et al., 2010), to date
demonstrating that learning Bayesian Net-
there have been only a few preliminary applications
works from track data is a promising ap-
of BNs to maritime anomaly detection. As noted by
proach to anomaly detection.
Johansson and Falkman (2007), however, BNs poten-
tially have two substantial advantages in this domain
over other types of models: 1) BN models are eas-
1 INTRODUCTION ily understood by non-specialists and 2) they allow for
the straightforward incorporation of expert knowledge.
A wealth of information on vessel movements has be- They can also represent causal relations directly and,
come available to authorities through the use of the in that case, have the advantage of being more easily
Automated Identification System (AIS). Much of this verified and validated, as we show in Section 3.
data has even filtered through to the general public via
Johansson and Falkman (2007) used the constraint-
the Internet. Surveillance authorities are interested in
based PC algorithm (Spirtes et al., 1993) to learn
using this data to uncover threats to security, illegal
BNs from simulated data representing normal vessel
trafficking or other risks. While in the past, surveil-
behaviour. While they claimed their approach iden-
lance has suffered from a lack of solid data, electronic
tifies a “reasonable proportion” of anomalous tracks,
tracking has transformed the problem into one of over-
while missing others, no specifics such as false (or true)
abundance, leading to a need for automated analysis.
positive rates were given, nor did they examine how
The main goal of vessel behaviour analysis is to iden- their parameters affect anomaly detection. Helldin
tify anomalies. This requires the development of a and Riveiro (2009) also looked at the use of BNs in
model representing normal behaviour, with anoma- anomaly detection with AIS data, but focused specifi-
lous behaviour being then identified by the extent of cally on how the reasoning capabilities of a BN can as-
a vessel’s deviation from normality. A common ap- sist surveillance system operators, such as by flagging
proach is to cluster the data around a set of points in potential anomalies, but they did not look at learning
a multi-dimensional feature space, where the features BNs from the data.
of the track are items such as longitude and latitude,
Outside of the maritime domain, Wong et al. (2003)
speed and course (Laxhammar, 2008). Tracks that
use BNs to detect disease outbreaks by detecting
anomalous patterns in health care data, such as an
upswing in the number of people with flu or an un-
usual decrease in the number of people buying decon-
gestants. Wong et al. use a method called WSARE
(What’s Strange About Recent Events) to detect when
a temporal stream of such data begins deviating from
its own baseline profile. This differs from our approach
here in that we are concerned with tracks as a whole,
rather than trying to identify if and when a track has
begun deviating from a normal baseline.
In our study here we data mined AIS data supplied by
the Australian Defence Science and Technology Organ-
isation (DSTO). Since many factors can contribute to
the (ab)normality of a vessel’s behaviour, in this study
we also enhanced that data set by adding information
such as weather and time, as well as vessel interactions.
We used a metric BN learner, CaMML (Wallace and
Korb, 1999), that flexibly allows various kinds of struc-
tural priors (e.g., directed arcs and tiers), aiding the
learning of sensible models.
We investigated two approaches to model learning.
First, we trained a model on the track data in its orig-
inal time series form. For variables related to motion,
we added new variables to represent the motion at
both step k and k + 1, effectively making the data
represent a dynamic Bayesian network (DBN), which
have been used successfully for other kinds of anomaly Figure 1: Workflow for the experiments.
detection (e.g., Loy et al., 2010). Second, we also cre-
ated single summary records of each track and learned
static models from them. Summary data included av- 2.1 THE DATA
erage speed and course, number of stops, major stop-
ping points and percentage of time travelling straight. We used AIS data from May 1st to July 31st, 2009 for
a section of the NSW coast framing Sydney harbour
To assess the value of the networks in anomaly detec-
(see Figure 2). The raw data initially contained just
tion we took the common approach of using a mea-
under 9.2 million rows and each row consisted of seven
sure for how probable a given track is according to the
fields: the vessel’s MMSI (a nine digit numerical vessel
learned models of normality. This measure was applied
identifier), a timestamp, the latitude and longitude of
to data sets representing both normal and anomalous
the vessel, and its reported speed, course and heading
tracks. In addition, we also mutated the presumed
(see Table 1). We did not use the MMSI directly in
normal tracks to help us see how the network’s proba-
learning, but did use it in pre-processing and to locate
bility estimates change. This led to a very interesting
additional information about the vessel.
understanding of both the network’s behaviour and the
nature of the normal data set. The AIS data was cleaned and separated into ‘tracks’,
first by assigning each record to a separate track based
Next we describe our approach to the main compo-
on the MMSI. We then cleaned the data in each track
nents of this study, including details of the time se-
by rounding (and interpolating) each row to the near-
ries and track summary methods, the variables used
est 10 second interval and eliminating duplicate data.
by the BNs and the learning algorithms. We analyse
However, since the raw data contained many cases in
interesting aspects of the learned BNs, then present
which a single vessel transmits for much of the three
experimental results in Section 3, which demonstrate
month period of the data, further track splitting was
the value of Bayesian networks for anomaly detection.
required. We split a track record into multiple records
when the vessel was stopped or not transmitting for 6
hours or more.1 This yielded 2,473 tracks across 544
2 APPROACH unique MMSIs averaging 1,995 rows each.
While our basic approach is well known — applying a Vessel track anomaly detection models have been lim-
BN learner to produce normality models to be used in 1
We note, however, that since such stops may them-
assessing degrees of anomaly — in practice the exper- selves indicate an anomaly, deciding what constitutes a
imental workflow was complex, as shown in Figure 1. track warrants future investigation.
based on summaries of each track — e.g., identifying
for a given track the number of times the vessel stops,
the main stopping locations, etc. While track sum-
maries cannot be used as easily in real-time surveil-
lance, they can capture patterns that occur at the time
scale of the track as a whole. For example, if a ves-
sel heads straight out to sea, turns around at a con-
stant rate, then returns directly home, each timestep
in the track may appear perfectly normal to any time
series-based normality model. However, the behaviour
embodied by the track as a whole may be anomalous
and worthy of attention. The variables for each type
Figure 2: Example AIS tracks. of model are in Figure 3 (see Mascaro et al., 2010).
Table 1: An example of five consecutive rows from 2.3 CLASSIFICATION AND
the original AIS data, with information removed to DISCRETIZATION
preserve anonymity. Each row has been produced by
We were interested in whether the pre-processing sum-
a different ship.
marization might help us directly to identify types
MMSI Timestamp Lat Lon Speed Course Hdng of tracks and anomalies. To test this, we classified
X 200905X -33.X 151.X 18.7 49.9 46 the summary tracks using Snob (Wallace and Free-
X 200905X -34.X 151.X 2.1 218 80
X 200905X -33.X 151.X 0 0 511 man, 1992), an unsupervised clustering tool compara-
X 200905X -34.X 151.X 17.5 183 179 ble to AutoClass (Cheeseman et al., 1988), producing
X 200905X -33.X 151.X 1.2 28 64
a class variable for each track (see ‘Class’ node in Fig-
ure 3(b)).
ited to kinematic variables, such as location, speed and Discretization of variables in the data set was needed
course, coupled with the type of the vessel (e.g., Jo- for technical reasons: (1) the version of CaMML that
hansson and Falkman, 2007). One aim of our study allows structural priors requires discrete data and (2)
was to investigate the possible advantages of consider- we used Netica, which also requires discrete variables.
ing additional factors. We added variables related to To perform discretization, we again used Snob to clas-
the ship itself (including type, dimensions and weight), sify each continuous variable in one dimension, with
the weather (such as temperature, cloud cover and each discovered class becoming a state. Using Snob
wind speed), natural temporal factors (including hour in this way allowed us to recover any hidden regu-
of day and time since dawn or dusk), kinematic DBN larities and is similar to the attribute clustering ap-
nodes and elementary information on vessel interac- proach taken by Li et al. (2006). This can often lead
tions for both the time series and track summary mod- to nodes with uneven distributions. For example, the
els. Information about each ship was obtained from ‘Speed’ node in Figure 3a contains lower probability
three locations: the public websites marinetraffic.com states wedged amongst higher probability states. One
and digital-seas.com and also from the DSTO. Cov- might expect to see a more even distribution, however
erage was generally excellent; for example, only 13 of Snob has identified 12 underlying classes correspond-
the 544 vessels lacked ship type information. On the ing to these 12 states — some of which are much more
few occasions in which data was missing, we used a frequent than their neighbours.
“missing” value. Weather information for the period
was retrieved from the Australian Bureau of Meteo- 2.4 THE CaMML BN LEARNER
rology website, based on observation stations around
Sydney harbour (Bureau of Meteorology, 2010). In this work, we make use of the CaMML BN learner
(Wallace and Korb, 1999). CaMML (Causal discov-
2.2 THE MODELS ery via MML) learns causal BNs from data using a
stochastic search (MCMC) and score approach. After
We investigated two kinds of model based on two dif- learning the structure, we parameterized the model
ferent forms of the training data. The first, the time with a standard counting-based procedure (Hecker-
series model, uses the data in its original time series man, 1998), as did Johansson and Falkman (2007).
form. Each timestep in a track was associated with a
CaMML allows one to specify different types of ex-
set of variables, such as latitude, longitude, speed and
pert priors (ODonnell et al., 2006). These can be hard
so on, that have corresponding nodes in the BN. This
priors (e.g., an arc must be present or absent) or soft
approach, of course, has the advantage that learned
priors that specify the probability of certain arcs con-
models can be used in online analysis, but it may miss
necting pairs of variables; other soft priors for more
patterns at a broader time scale.
indirect dependencies can also be specified. Here, we
The second model, the track summary model, was used some simple hard priors in the time series model
always transport. This explains why that variable is
Table 2: Causal tiers for the variables in the time series the common cause of so many others in the time series
model, given as hard priors to CaMML. models. In the track summary network this common
1st Tier ShipType, ShipSize, Rainfall, Max- cause role is assumed by the ‘Class’ variable instead.
Temp, EstWindSpeed, EstOktas Causal discovery relying on joint sample data very of-
ten gets arc directions wrong, in the anti-causal direc-
2nd Tier Lat, Lon, Speed, Course, Heading, tion, because it is dependent upon sparse information
Acceleration, DayOfWeek, HourOfDay, about any uncovered collisions (where two parents of
CourseChangeRate, HeadingChangeR- a child node are not themselves directly connected) to
ate, NumCloseInteractions, NumLo- infer all arc directions. For example, Figure 3(a) shows
calInteractions, ClosestType, Clos-
estSpeed, ClosestCourse, ClosestDis- ShipType→Weather, for a variety of weather variables.
tance, SinceDawn, SinceDusk Of course, ship type cannot affect the weather. A plau-
sible interpretation of this result is that weather con-
ditions do affect which types of ship put to sea, so,
3rd Tier Lat-t2, Lon-t2, Course-t2, Heading-t2, if anything, the arc directions here are reversed. The
Speed-t2, Acceleration-t2
simplest and very effective method of dealing with this
problem is to introduce extra prior constraints, such
as putting some weather variables into a zeroeth Tier.
to guarantee that the right DBN relationships held
across time steps. We also specified priors in the form Exploring Bayesian networks is very easy and natural
of “temporal tiers”, putting a temporal partial order and here turned up many points of interest. In con-
over variables and so indicating which variables could firming the reasonableness of the time series model,
not be ancestors of which others (Table 2). we found that entering ‘Tug’ or ‘Pilot Vessel’ into the
‘ShipType’ variable significantly increases the chance
2.5 EXPERIMENTAL METHODOLOGY of another vessel being nearby. Cargo ships, on the
other hand, travel mostly solo and tankers almost
After pre-processing the data, we ran experiments us- exclusively so. Ship sizes (i.e., the ‘ShipSize’ vari-
ing CaMML. We divided the data randomly (both able) are also highly correlated with position (the ‘Lat’
time series and track summaries) into 80% (or 1,978 and ‘Lon’ variables) via the ‘ShipType’ variable, with
tracks) for training and 20% for testing. As is common larger vessels tending to appear in a restricted set of lo-
with anomaly detection models (e.g. Das and Schnei- cations. The track summary model shows that cargo
der, 2007; Johansson and Falkman, 2007), the training ships and tankers spend most of their time travelling
data consisted of unfiltered real or ‘normal’ data in or- straight, while tug directions are much more variable.
der to produce a model of normality against which we Tugs also tend to stop in different locations from cargo
could assess deviations. We did a set of 10 runs of ships, and they tend to be stopped for longer periods
CaMML, using different seeds, taking CaMML’s re- than cargo ships.
ported “best” (highest posterior) network each time,
from which we derived the reported results. 3.2 ANOMALY SCORES
There is no generally accepted method for detect-
3 EVALUATION ing anomalies from BN models. Jensen and Nielsen
(2007) proposed a “conflict measure” to detect possible
3.1 INTERPRETING THE LEARNED incoherence in evidence E = {E1 = e1 , . . . , Em = em }:
MODELS
P (E1 = e1 ) × . . . × P (Em = em )
Figure 3(a) shows an example BN produced by C(E) = log
P (E)
CaMML from the time series data, while Figure 3(b)
shows an example learned from the track summary Jensen and Nielsen use this to identify when a power
data. It is clear that few arcs in the learned networks plant begins behaving abnormally. Unfortunately, this
represent intuitive direct causal relations, other than will only catch cases where each attribute is indepen-
the DBN arcs (given as hard priors) and the weather dently common but jointly uncommon. Here, we’re
variables. Many of the other variables are simultane- interested in any kind of joint uncommonness, even
ous properties of the vessel, which will be correlated when variables are independently uncommon, which
by hidden common ancestors. For example, while we simply comes down to a difference in requirements.
would expect a ship’s speed, size and course to be In other approaches Loy et al. (2010) used learned
related, it isn’t obvious what the underlying causes DBNs to calculate log-likelihoods and compare them
might be. They may be such things as the business against thresholds selected to maximize the accuracy,
the vessel belongs to, the purpose of its trip or the extended to detecting abnormal correlations between
nature of its crew and contents. Some of these hidden multiple objects. Cansado and Soto (2008) simply as-
causes will be partly captured by the ShipType, e.g., sumed that records with low probabilities given the
the purpose of a trip employing a cargo ship is almost learned BN are anomalies.
Lat_t2
Lat
-33.9733 33.4
-33.9744 35.7
-33.9532 50.4
-33.948 50.0
-33.8555 15.8
-33.8563 14.3
0 0.42
ClosestType Lon
None 72.9
ClosestSpeed 151.189 6.63 Lon_t2
Tug 14.6 151.208 20.6 0 0.48
Pilot Vessel 3.14 151.209 1.11 151.209 49.9
Cargo 2.85 151.21 8.87 151.243 1.01
Tanker 1.68 151.219 0.39 151.27 8.87
Cargo Hazard A Major 1.64 ClosestCourse ClosestDistance 151.219 10.4 151.524 39.7
Tanker Hazard A Major 0.56 151.458 52.1
other- 2.64
ShipType
Speed Speed_t2
Cargo 23.3
7.42e-05 24.2 8.39e-05 24.0
Tug 17.0
NumLocalInteractions NumCloseInteractions Tanker 16.8
0.00963 0.15 0.00696 0.11
0.0827 5.70 0.0811 5.96
Pilot Vessel 13.2
0.155 0.12 0.161 0.10
Dredger 7.39
0.897 16.5 0.876 15.9
Cargo Hazard A Major 5.54
1.6 0.36 1.55 0.85
Passenger Ship 4.41 2.62 12.5 2.59 12.5
MaxTemp other- 12.4 4.13 0.18 4.56 0.23
7.41 15.5 7.43 15.8
14.2 24.4 14.3 24.0
65.9 0.12 24.6 0.16
ShipSize
EstOktas 102 0.34 102 0.34
-10 8.47
-2.08 24.0
-0.973 21.6
-0.324 0.26
Course Course_t2
0.067 24.6
Rainfall EstWindSpeed 0.827 21.1
Heading Heading_t2
CourseChangeRate
DayOfWeek SinceDusk
HeadingChangeRate
HourOfDay SinceDawn
Acceleration Acceleration_t2
(a)
shipType
Cargo 35.5
Tug 17.7
timeDeltaAvg Tanker 10.1 NumLocalInteractions LongestCloseMyAvgLon LongestCloseMyAvgLat
Pilot Vessel 9.07 flag
Cargo Hazard A Major 6.72
Passenger 2.31 NumCloseInteractions
Tanker Hazard A Major 2.29 AvgClosestDistance LongestCloseType
other- 16.4 None 40.6
duration Class Tug 32.0
4 13.2
CloseInteractionsPc Pilot Vessel 13.1
5 8.89 LocalInteractionsPc Cargo 4.63
shipSize
6 18.6 Tanker 2.60
-10 5.25
7 6.76 Cargo Hazard A Major 2.24
-2.3 4.54 LongestCloseMyAvgSpeed
8 21.3 Passenger 0.80
-2.04 17.3
avgRainfall avgEstOktas 11 5.33 other- 3.98
-0.223 40.0
0.293 32.9 13 20.3
14 5.67
straightSections
avgSpeedRecorded speedSd maxSpeed
avgMaxTemp avgEstWindSpeed
straightPc main2Course mainCourse
speed1_5Pc speed5_10Pc speed10_15Pc speed15_20Pc speed20_Pc
avgMinTemp
stops stopPc
mainStopLat
mainStopLon 0.54 42.7 8.22e-06 19.6
-34.3624 5.94 2.3 19.9 0.00454 2.66
0 31.4
-33.9401 57.8 6.06 16.5 0.0575 12.7 courseChangeRate1_5Pc courseChangeRate10_20Pc
151.21 52.0
-33.6107 4.92 14.2 9.43 0.0946 1.63
151.379 16.6
0 31.4 31.6 5.63 0.165 14.9
79.9 3.14 0.511 28.8
courseChangeRate5_10Pc courseChangeRate20_Pc
main2StopLat main2StopLon 97.6 0.35 0.911 12.9
-33.9386 39.8 0 52.9 157 1.04 0.988 0.38
-33.9157 7.19 151.21 35.4 462 1.28 0.997 6.52
0 53.1 151.446 11.7 headingSd courseSd
minLat minLon startPointLat startPointLon
endPointLat endPointLon
maxLat maxLon
(b)
Figure 3: Example BNs produced by CaMML for the (a) time series data and (b) track summary data.
Anomaly scores for all data
likely reason is that the track summary scores are sim-
ply based on more variables, making each instance
Time series
Track summary
more specific and less probable. There is a surpris-
0.025
ingly small correlation between the two sets of scores
(r =0.159; p < 0.001).2 The two models look at differ-
ent aspects of each track, and, as we see below, rein-
0.020
force each other when performing anomaly detection.
0.015
Density
3.3 RESULTS ON ANOMALOUS DATA
0.010
Unfortunately, we did not have any access to known
anomalous tracks nor are there any standardised or
0.005
publicly available vessel track data sets containing
anomalies (or otherwise). Nevertheless, there are
0.000
many ways to create anomalous data. Cansado and
0 50 100 150 Soto (2008) generated anomalies by modifying se-
Anomaly score lected attributes to random values within their ranges.
Johansson and Falkman (2007) generated anomalous
data using anomalous models.3 Here, we tried three
Figure 4: The KDE distributions of anomaly scores
approaches, partly inspired by these previous meth-
for all tracks in the data set according to the (a) time
ods: modifying instances by swapping incorrect ship
series and (b) track summary networks.
type information, splicing tracks together, and draw-
ing anomalous tracks.
We started from the same assumption as Cansado and 3.3.1 The False Ship Effect
Soto, however we think choosing any particular thresh-
old for deciding when tracks are anomalous would be For each track in the training set, the ship type infor-
arbitrary. In real applications a specific threshold may mation was swapped with that of another randomly
present itself as most suitable, but in general we feel it selected ship of a different type, leaving the track data
is better to present the probability itself to surveillance alone. Figure 5(a) shows how this affected the anomaly
operators, albeit in a more convenient form. score. In most cases this false ship effect is positive,
increasing the anomaly score. The false ship effect for
Thus, for track summary data, we first computed each
the time series model is positive in around 87.2% of
track’s prior probability given the normality model.
the cases as opposed to 69.4% of cases for the track
Since these probabilities are usually very low (around
summary model. Sometimes, however, tracks have be-
the order of 1−10 ) we took the negative log (base 2) to
come more probable given incorrect ship information,
produce an “anomaly score” (i.e., the number of bits
which itself seems anomalous! To be sure, many of the
required to describe the data, given the model). Put
ship types are in fact quite similar (e.g., there are sev-
simply, the higher the anomaly score, the less probable
eral sub-categories of cargo ship) so switching between
the track.
these may randomly produce a more likely track. How-
For time series networks we took a similar approach, ever, this does not account for all the cases. A closer
but instead fed each timestep of the track into the net- look at these showed that many are highly improbable
work to yield a probability estimate for that timestep. (i.e., have high anomaly scores), suggesting that ei-
We then took the average probability over all timesteps ther they have been mislabelled or, more intriguingly,
to generate a negative log anomaly score. For time se- that they do indeed behave anomalously according to
ries data it is possible, of course, to base anomaly cri- their type. This suggests a new criterion for anoma-
teria upon changes in the track over time. Johansson lousness based not merely upon the probability of the
and Falkman (2007), for example, used sliding win- given track but on what alterations might explain the
dows across a track, looking for any anomalous win- track better. This has some of the spirit of Jensen and
dows. For this study, however, we focused on criteria Nielsen’s conflict measure, though is clearly quite dif-
for assessing the tracks as wholes, leaving this kind of ferent; we leave this possibility for future exploration.
alternative for future investigation.
Figures 5(b) and 5(c) show scatter plots of the anomaly
Calculating anomaly scores for all the tracks in our score versus the false ship effect. With the time series
data set and plotting the distribution of the results model, we can see that as the anomaly score grows, the
(using a Gaussian Kernel Density Estimator [KDE]), 2
we obtained Figure 4. These show a fair amount of Earlier iterations with cruder discretizations and more
variables in common showed a stronger correlation — how-
diversity among anomaly scores, i.e. they do not sim- ever, as models grew more detailed, the correlation shrank.
ply clump around the lowest possible score. Note that 3
Wang et al. (2008), without known anomalous data,
the scores produced by the time series model are quite simply weakened their threshold to find “anomalies”,
distinct from those of the track summary model. One whether they were there are not!
False ship effect for all data
false ship effect falls (r =-0.70, p 0.01). This also
occurs with the track summary model, to a smaller
Time series
Track summary
extent (r =-0.31, p 0.01).
0.06
3.3.2 Track Splices
0.05
We also created anomalous tracks by splicing random
0.04
tracks together. This allowed us to test our models
Density
for their ability to detect discontinuities as well as ma-
0.03
jor changes in behaviour. Specifically, we selected 140
0.02
tracks at random and replaced their tails with those of
other tracks (retaining the times and types of the orig-
0.01
inal track). We spliced half of the tracks with those
created by ships of a different type and we spliced the
0.00
other half with tracks created by ships of the same
−40 −20 0
False ship effect
20 40 60 type. When assessing these tracks using the track sum-
False ship score − True ship score mary model, tracks forged from different types yield
an average anomaly score of 121.3 while those forged
(a)
from the same type yield an anomaly score of 115.4
Time series anomaly score vs false ship effect (p 0.01). Both scores are significantly different from
●
the average anomaly score for all data of 89.0.
●●
● ●
●
●●
●●
● ●
● ●
●●● ● ●
●● ●● ●
● ●●● ●●●
●
With the spliced tracks, as we expected the track sum-
●●●● ● ● ●● ● ●●●● ●
●
●●●● ● ●● ● ●●● ●● ● ●●
mary model performed slightly better than the time se-
40
● ● ●●
●
● ● ● ●
●●●● ● ●● ●●● ● ● ●● ●
●●●●● ● ●●●● ●● ●● ● ●●
● ●●
●●●
●●● ●● ●●●● ●● ● ● ● ● ● ●● ●●
●●●
● ● ● ●● ●●● ●●
●● ●●● ●● ● ● ● ●
● ●
● ●●●●
●● ● ●
●● ● ● ● ●● ●●● ● ● ● ●
●●●●
● ● ●
●
●
●
● ●● ●
●
●
●●
●
●
●
● ●●
●
●●
●
●●●
●
●
●●
●
●●●●
● ●●
●
●
●
●
●●● ●
●
●
●
●
●
●
●
●
●● ●
●●●
●●
●
●
●
●●
●
●
●●
●
●
●●
●
●
●
●●
●
●●
●●●
●●
●
●
●
●●
●
●
●●
●
●
●
●
●
●
●
●
●
●●
●
●●
●
●●●
●
●
●
●
●
●
●
●
●
●
●
●
●●
●●
●
●
●
●
●
●
●
●●●
●●
●
●
●●
●●
●●
● ●●●
●●
●
●●
●
●
●●
●
● ●●●
●
●
●●●
●
●
●
●
● ● ●● ●
●
● ●
●●● ●● ●●●
●●● ●
●
●
●
●● ●
ries approach, because the time series model is not able
●●●●
● ● ● ● ●
● ● ●● ●● ● ●
●●
●●●
●● ●●
● ● ●●●
● ● ●●
●
●●●● ●●
● ●
● ●● ●●●
●
● ●●
●●
● ●●
● ●● ●●
●
●●●●
●
●
●
●●
● ●●●
●●●
●●●
●●
●
● ●
●●●
●●●● ●
●●●
●
●●●
● ●
●●●
●● ●
●
● ●
● ● ●● ● ●●●● ● ● ●●
● ●
to detect unusual behaviour across the whole track.
False ship effect
● ● ●●●●●●● ● ●● ● ● ●●●●
● ●● ●● ●●
●
●●
●●
●●
●●
●
●
●●●
●
●●
●
●
●
●
●
●●●
● ●
●
●●
●
●●
● ●
● ● ●
●
●
●●●
●
●
●
●
●●●●
●●
●● ●●
●● ●● ● ● ●
●
● ●● ●
● ●● ● ● ●
●●●●●●●●●
●●
●●
●●● ●●●●●●● ●
●●●
●●
●●●● ●
●●●
●●●●
●●●
● ●●
●●●
● ● ●●●
●
● ●●
●●●
●●
●●●●●
●● ● ●● ● ●● ●
20
●
●
● ● ● ● ●
● ●
●● ●●
● ● ● ●● ●● ●
●●
●
● ●
● ● ●
●● ●
● ● ●● ● ● ●●
●●●● ●●●● ●●
●●●●
●
●●
● ●●
●●● ●
●
● ●●● ●● ●●
●●●●
● ●●
●●● ● ●
●●● ● ●●● ● ● ● ● ●●●
● ● ●●●● ●●● ● ● ● ●● ●●●●●
●●● ● ● ●
●
●●●●
● ●●
●●
●
●● ●
●
●
●
●●
●● ●
●
●
●●●● ●●
● ●●●●
●
●●
●● ●
●
●
●●
●●
●
●●●
●
●●
●
●
●
●
●
●
●
●
●
●
●
●
●●
●●●
●●
●●
●●
●
●●●
●
●
●
●
●
●●
●
●
●●●
●
●●
●
●
●
●●
●
●
●●
●
●
●
●
●
●●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●●●●
●●
●●
●
●
●●
●
●
●
●●●
●●●
●
●
●
●●
●
●
●
●●●
●●
●
●
●
●
●
●
●
●
●
●
●
●
●●
●●
●●
●●●
●
●
●
●
●
●
●●
●●
●
●
●
●
●
●
●●
●
●
●
●
●
●
●
●●
●●
●
●
●
●
●
●
●
●●
●
●●
●
●
●
●
●
●
●
●●
●
●
●
●●●
●
●
●
● ●●
●
●●
●
●
●
●
●
●
●
●
●
●
●●
●●
●
●
●●
●
●●
●●
●
●●
●
●
●
●
●
●
●●
●
●
●●●
●● ●
●
●●
●
●
●
●
●
●
●●●
●●●●
●●
● ●
●●
●●
●●
●
●
●
●●●●
●
● ● ●● ●●
● ● ●
●●● ● ● ●
Tracks put together from ships of different types pro-
● ● ● ●● ●●●●●
●●●●
● ●●● ●
●●●●●●
●
●
● ●●●●●
●
●●●
●● ●
●●
● ●
●
●
●●● ●●
●●
●
●
●
●
●●
●
●●●
●
● ●
●●●
●●
●●●
●●●●
●
● ●●●●●●●●
●● ● ●
●●
●●
●
●
●
●
●
●●●● ●
● ●●●●
●●
●
●●
●●
●
●
●●
●
●●●
●●
●●● ●
●
●●●
●
●
●●
●
●●
●
●
● ●
●●●●
●
●●●●
●●
●
●
●
●
●●
●●
●●
●
●●● ●
●
●
●
●
●
●
●
●
●
●
●●
●●
●●●
●●●
●
●
●
●●●
●
●
●
●
●
●● ●
●●
● ●
●
●
●●●
●●
●●
● ●
●●
●
●
●●●
●●
●
●
●
●
●
●
●
●
●
●
●
●
●●
●●
●●
●●
●
●
●● ●
●●●
●●
●
●
●
●●
●●●
●●
●●●
●
●●
●
●
●
●●
●●
●
●
●
●
●
●
●
●
●
●
●
●
●●
●
●●
●
●●
●●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●●
●●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●●
●
●●
●
●
●
●
●●
●
●
●
●
●
●
●
●
●
●
●
●
● ●●●●
●
●●
●●●●
● ●
●●
●
●●
●●
●●
●
●●
●●
●
●
● ●
●● ● ●
●
● ●
●●
●● ● ●
●
● ● ●●
●
● ●
●
●
●
● duced an average score of 48.9 while those spliced from
●● ● ● ●●● ●●●● ●●●● ●●
● ●● ●●●●
● ●●●
● ●●●
●● ●●●●●
● ●●●●
● ●●
●●
● ●● ●
● ●
●● ●● ●
● ● ●● ●
●● ● ●● ● ●●●● ● ●
● ● ● ●●●
● ●●●
● ●● ●● ● ●●● ●●● ● ●
●
●●● ●●● ● ● ●●●●●●
●●●
●●
●
●●
●
●
●
●●●
●●●● ●
●●
●●
●
●
●
●
●
●
●●●
●●●
●●
●●
●●●
● ●●● ●
●●
●
●● ●●
●●●
●●
●
●●
●
●
●
●●●
●●●●● ●
●●●●●●
●
●
● ●
● ●
●● ●
● ● ● same types had a score of 45.6; while a small differ-
0
●●●
● ●● ●●●●●● ●● ●● ● ● ● ● ● ●●● ●
●●●
●●
● ● ●● ● ● ● ● ● ●●●● ●
●
● ●●● ●●●
●
● ●
●●●●●●● ●
●●●●● ●
● ● ●● ●● ● ● ●● ●● ●
● ● ● ●●● ● ●●●●●●
●●● ● ● ●● ●
●● ● ● ●●
● ● ●●●●● ●● ●●●●●●● ● ●● ●
●● ● ●●●● ●●
●
●
●
● ●
●● ● ●●●
●
● ● ●●●
● ● ●
● ●●●
●
● ●●
●
●●
●
●
●
●●● ●
●●●●
●
●●
●
●
●
●
●
● ● ●
●
●●
●●●●●
●
● ●
●
● ●●
●●
● ●
●● ● ● ●
●● ● ● ●
●
● ●●
●
● ● ● ●●
● ●
●
●● ● ence, this was statistically significant (p < 0.01). In
●● ●●●
● ● ●●
●
●
● ● ●
● ● ●● ● ● ● ●● ● ●
● ●
● ●
addition, while the higher score was significantly dif-
−20
● ●
● ● ●●
●
● ●
● ●
●
●
● ● ferent (p < 0.01) from the average of the full data set
●
(43.8), the lower score was not (p 0.01). Here we
can see the advantage of the higher level view of the
−40
●
20 40 60 80
track summaries.
Anomaly score
3.3.3 Manually drawn anomalies
(b)
Track summary anomaly score vs false ship effect Finally, we tested models using anomalous tracks
drawn with a mouse over a map, where the mouse loca-
●
tion and speed generated the vessel location and speed
respectively. Other factors were created randomly, in-
20
●
● ●
● ● ● ●
●●
●
●
●
●● ●
●● ●
● ●
cluding the time and duration, noise in the data, vessel
● ● ● ●
● ●
●● ● ●
● ● ●● ●
●● ●●●
●●● ●
● ● ●
●
●
●
●
●● ●
●●●
● ●
● ●●
●●
●●● ● ●● ●● ●
●● ● ● ● ●● ●
●●●●●
● ●
●●● ●
●
●
● ●●
● ●●
● ●● ●
●●
●●
●
●
● ● ● ● ●●
● ●
●●
● ●●
●
●●
●
● ●● ●●
●
details and maximum speed. This allowed us to com-
● ●● ● ●●● ●● ●●● ●
●● ●
●●●● ●●●●● ●● ● ● ●●
False ship effect
● ●●● ●●● ● ●● ●● ● ● ●
●
● ●●
●● ●
●●
●
●
●
● ●●●
●●
●
●
●●
●●
●●
●
●
●
●
●
●
●●●
●●●
●
● ●●● ● ●
●● ●●●●●●●
●
●●
●
●
● ●●●●●●●● ●
●●●●
●
●
●●
●
●●
●●
●●
● ●●●
●
●
●●
● ● ● ●●● ● ● ● ● ●
● ● ●
pare the performance of both models across several
10
● ● ●●● ● ●●
●● ● ● ●● ●●●●●● ●
●
●●● ●
●
●●●
●●●●
●
●
●●●●●●●●
● ●●●●
●
●
●
●●● ●
●
●● ● ●
●●● ● ●● ● ●
●● ● ●
●●
● ● ● ● ●●●
●●●●●
●●
● ●
●● ● ●
●
●●● ●● ●
●●●● ●●● ● ●●●●
●●●●● ●●●
●
●●● ●
●
●●
●● ●●
●● ●● ●●
● ●
●● ●●
● ●
●●●●
●●
●●● ●●●●●●●
●●●●●●●
●
●●●●
●●●● ●
●●●●●●●● ●●● ●●
●
●● ●●● ● ●● ● ●● ● ●
●● ● ●
●●● ●●
●
●
●
● ● ●●
● ●●●●
● ● ●●● ●
●
●● ●
● ●
●●
●
●●
●
●
●
●
●
●
●●
●
●●
●●●
●●
●
●
●
●
●
●
●●
●●
●
●●
● ● ●● ●●●
●●
●
●
●
● ●
●●●●●
●●●●●
●
● ●●●
●
●
●
●
●●●
●●
●
●
● ●●●●
●●● ●
●●
●
●●
●●
●
●●
●●
●
●●
●●●●●
●
●●
●●●
●
●●
●
●
●
●
●
●
●●
●
●●
●●
●
●
●
●
●
●
●
●
●●
●
●
●●
●
●
●
●
●●
●
●●
●●●
●●●
●
●●
●
●
●
●
●
●●
●
●
●
●
●●●●
●● ●
● ●●
●
●●
● ●●
●
●
●
●
●●
●
●●●
●●
● ●
●
●●●
●●●●
●
● ●
●
●●●
● ● ●
● ●
●
●
●
●●
● ●
●
● ● ●● ●
● ●
●
●
● different categories of anomalous behaviour, thereby
●●●● ● ● ● ●●
●● ●●●●●● ● ●●●
●● ●
●● ●● ●●●●● ●●● ●●● ●●●● ● ●
●● ●●● ● ●● ●● ● ●● ● ● ● ●● ●
●●● ● ●● ● ●●●●
●
●● ●●
●●● ●● ●●● ● ●●
● ● ● ●●
●
● ●
●
● ●
● ●●
● ●
● ●●●
●
●● ● ●
●● ●
●●
●
●
●
● ●●●
●●
●
●
●
●
●
●
●
●●
●
●
●●
●
●●
●
●
●●
●
●
●
●
●●●
●
●●●
●
●
●
●
●
●
●
● ●
● ●●
●
●
●
●●
●
●● ●●
●●
●●
●●
●●
●●
●●
●
●
●●●
●
●
●
●
●●
●
●
●
●
●
●
●
●
●
●
●●●
●
●
●●
●
●
●●●
●●
●
●
●● ●●
●
●
●●●
●●
●●
●●
●●
●
●●
●●
●
●
●
●● ●
●●
●
●
●
●●
●
●●
●
●
●●
●
●
●
●
●●
●
●●
●
●
●
●
●
●
●
●
●
●
●●●
●
●
●●
●
●
●●
●●
●
●
●
●
●
●
●●
●
●
●
●●
●
●
●
●
●
●●
●●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●●
●
●●
●
●
●
●●
●
●●
●
●●
●
●
●
●
●●
●
●●
●
●●
●
●
●
●
●
●
●
●
●
●
●●
●
●
●
●
●
●
●
●
●
●
●
●
●●
●●
●●
●
●
●●
●
●●●●
●●
●●●
●
●
●
●
●●
●●
●
●●
● ●●●
●●
●●
●
●●●●
●
●
●
●
●
●● ● ●
●
●
● ●
shedding light on the strengths and weaknesses of each
● ● ● ● ●●●●● ● ●
● ●●● ●● ●● ●●● ●●● ●●●
●
●●
●● ● ●●
● ●● ●
●
●
●●● ●●●
●
●●
● ● ●●
● ●●●
●●●
● ●●●●● ● ●●
● ●
●
●● ●
●● ●● ●
●●
●● ●
●●● ● ●●● ●
●
●●
●
●
●●
●● ●●●
●● ●●●●●
● ●
●
●
●
●
●
●
●
●●
●
●●●
●
●●
●
● ●● ●
●
●
●
●●●
●●●●
●●●●
●
●
●●
●
●
●●
●●●
●●
●●
●
●●
●●
●
●
●●
●●● ●
●
●●
●
●●
●
●
●
●
●●
●
●●
●
●
●
●
●●
●●
●
●
●
●
●
●
●
●●
●
●
●●●
●●
●
●●
●●●
●●
●●
●●●
●
●●
●
●● ●
●
●
●●●
●●●●
●●●●
●●●
●●
●
●●●
● ● ●●●
●
● ●● ●● ●
●●●● ●●
●
● ● ●
●● ●
●● ● ● model. Anomalous behaviour in these tracks included
0
●● ●●
● ●● ●● ●
●● ● ●● ●● ●● ●● ● ●● ●● ●●●
● ● ● ● ●●●● ●●●
● ● ●
●●
●●●● ● ●
●
● ● ● ●●
●● ●
●● ●● ●●●●
●
●
●
●●
●●●●
●● ●●
● ●
●●●
●●
●
●● ●●
●
●
●●● ● ●
●● ●
● ●●● ●● ● ●
●● ● ● ● ●● ●● ●● ●● ● ● ●●
●● ● ●
●●●●
● ● ●●
● ●●● ● ●●●●●●
●●
●●●●●● ● ●
● ●●
●●●
●
●●
● ●● ●
●●
●●● ●● ●●● ●●●
●● ● ●● ● ● ●
● ●● ●● ● ● ●● ● ●●
●
● ● ●●
●●●●
●●● ●
● ● ●●
● ●●
●● ●●●● ●●●
●● ● ●●
●
● ●●
●●●●●●
● ●
●●
● ● ●●
●●
●●●●
●●●
●
●
●
●
●
●
●●
●
●
●
●●●
● ●
●●●
●● ●●●●●
●●
●
●
●
●
●
●
●
●●
●●
●●
●
●
●●●
●●●●
●
●●●●
●
●●
●
●●
●
● ●●●
●●●
●
●● ●
●●
●●●●●
●●
●
●
●●
●
● ●●
●●
●
● ●●
●●●
●●
●●
●● ●●
●
●
●
●
●
●
●●
●●
● ●
●
●
●
●●
●●
●
●
●●●●
●●●
●●
●●
●
●●●
●●●●
● ●●●●● ● ●●
● ●
●●
●● ● ● ●
●
●
●
●
●
●
very noisy data, close interactions with many other
●● ● ● ● ● ●● ● ●
●● ● ●●
● ●
●●● ●●
●●● ●●● ● ●●
●● ●●●●
● ● ●●●●
● ● ●● ●● ● ●
●
● ●
●● ●
●
●
● ●
● ●●●
● ● ● ● ●● ●
● ●
● ●
● ● ●●●●
●
●
●●● ● ● ●●● ● ● ●● ● ● ●
●●● ●●
●● ●●
●● ●
●●●
● ●●
●
●●●● ●● ●
●
●●●●● ● ●●●
●
● ●
●
●
●
●
●
●
vessels, vessels that circle in unusual patterns, vessels
●● ● ●●
●
●●●●● ●
● ●●●
● ● ●●● ●●●
●
travelling over land, overly short tracks in the middle
−10
●● ● ● ●● ● ● ●●
● ● ● ●●● ● ●● ●●●●
● ● ● ●
● ● ●
●
●
●
●
● ●
●●
●
● ● ●●
of the sea and vessels behaving against their type. In
● ● ● ● ●
●
all, 107 such tracks were created.
40 60 80 100 120 140 160
Anomaly score
When combined with the normal track test data, and
scored using the two models both independently and
(c) combined, the ROC (receiver operating characteristic)
curves of Figure 6 are the result. The ROC curves
demonstrate the tradeoffs that can be made (if we
Figure 5: False ship effect: (a) anomaly score differ-
were to settle on specific thresholds for anomalies) be-
ences for false ship information versus correct ship in-
tween false positives and true positives; the greater
formation, sorted by score; and scatter plots for (b)
time series and (c) track summary networks.
Time series ROC curve Track summary ROC curve Combined ROC curve
1.0
1.0
1.0
0.8
0.8
0.8
True positive rate
True positive rate
True positive rate
0.6
0.6
0.6
0.4
0.4
0.4
0.2
0.2
0.2
0.0
0.0
0.0
0.0 0.2 0.4 0.6 0.8 1.0 0.0 0.2 0.4 0.6 0.8 1.0 0.0 0.2 0.4 0.6 0.8 1.0
False positive rate False positive rate False positive rate
Figure 6: ROC curves for test data, containing both normal tracks and manually created anomalous tracks,
given the (left) time series, (middle) track summary and (right) combined models.
the area under the curve (AUC), the less severe the Combined ROC curve
tradeoff needs to be. We can see that the track sum-
1.0
mary model (with an AUC of 0.780) performs better
than the time series model (AUC 0.712). Adding the
0.8
anomaly scores from the two models together (in effect,
True positive rate
creating a combined model with equal weight given to
0.6
each individual model) performs better again (AUC
0.809). Table 3 shows the average scores each model
yielded for various kinds of anomalous tracks. We can 0.4
see that both models easily detected the tracks con-
0.2
taining too many close interactions (average scores of
139.9 and 75.8, against the test averages of 90.8 and
0.0
45.7, giving Deltas of +49.1 and +30.1 for track sum- 0.0 0.2 0.4 0.6 0.8 1.0
mary and time series models, respectively). The time False positive rate
series model detected overly short tracks best (track
summary: +4.7; time series: +17), while the track Figure 7: ROC curves for the Johansson and Falkman
summary model substantially outperformed the time data using the combined models.
series model for tracks containing unusual stops, as
would be expected (track summary: +28.3; time se-
ries: +2.9). In most cases, the track summary model We also examined what happens when the ship type
outperformed the time series model. of the tracks is altered. Interestingly, the only cases in
which this change created a notable negative false ship
effect (i.e., increased the probability of the track) again
3.3.4 Testing on Johansson & Falkman’s
involved high anomaly scores. These scores were 25
simulated data
and above for the track summaries and 36 and above
for the time series — both much higher than the re-
We also applied our methods to the simulated data
spective average scores for the anomalous tracks.4
used by Johansson and Falkman (2007), both normal
and anomalous. Our models, while not well suited
to the simulated data, performed reasonably well. In 4 CONCLUSION
particular, with the track summary model, anomalous
tracks received an average anomaly score of 22, while We have demonstrated Bayesian Networks are a
normal tracks averaged 17; while in the time series promising tool for detecting anomalies in vessel tracks.
model, anomalous tracks received an average score of By using a BN learner on AIS data supplemented
29, with normal tracks averaging 25. When we cal- by additional real world data, we produced both
culated the ROC curves, we found that the time se- dynamic and static networks, which demonstrated
ries model performed better with this data set with an distinct and complementary strengths in identifying
AUC of 0.691, over the track summary AUC of 0.652. anomalies. Thus, we were able to improve anomaly
This was likely due to a lack of extended ship type detection by combining their assessments. This sug-
information. The combined model (whose ROC curve
is shown in Figure 7) again performs better than both 4
For further details of our comparison with Johansson
individually, with an AUC of 0.727. & Falkman’s work, see Mascaro et al. (2010).
Table 3: Average anomaly scores for various forms of anomaly. Columns headed ‘Delta’ indicate the difference
from the average score for normal test tracks.
Track Time
Summary Series
Type Score Delta Score Delta
Normal test tracks 90.8 (0) 45.7 (0)
Random movement in the middle of water 102.4 +11.7 50.8 +5.1
Closed tracks in the middle of water 101.7 +10.9 53.7 +8.0
Very short tracks 95.5 +4.7 62.7 +17.0
Unusual stops 119.1 +28.3 48.6 +2.9
Tracks with many interactions 139.9 +49.1 75.8 +30.1
Tracks with many loops 126.2 +35.4 52.7 +7.0
Travel over land 122.2 +31.4 60.2 +14.5
Appearing at edges of observable area only 103.5 +12.7 54.2 +8.6
Very noisy observations 135.2 +44.4 54.6 +8.9
Tracks behaving against type 113.7 +22.9 57.8 +12.0
Multiple anomalies 126.9 +36.1 53.9 +8.2
gests that learning networks at still additional time Conf. on Intelligent Sensors, Sensor Networks and In-
scales, intermediate between the full track and each formation Processing, pp. 395–400.
AIS snapshot, may improve anomaly detection even Korb, K. B. and A. E. Nicholson (2010). Bayesian Artificial
further. Such approaches may well generalize to other Intelligence (2nd ed.). Chapman & Hall/CRC Press.
kinds of anomaly detection and can be extended to Laxhammar, R. (2008). Anomaly detection for sea surveil-
work with other kinds of track, such as those created lance. In The 11th Int. Conf. on Information Fusion,
by cars, planes and humans. pp. 55–62.
Li, X., J. Han, and S. Kim (2006). Motion-Alert: Au-
Acknowledgements tomatic anomaly detection in massive moving objects.
In Proc. of the 2006 IEEE Intelligence and Security In-
formatics Conference (ISI 2006), Berlin, pp. 166–177.
The authors would like to thank the DSTO for sup- Springer.
porting this work, Göran Falkman and especially
Fredrik Johansson for providing access to their data Loy, C., T. Xiang, and S. Gong (2010). Detecting and
discriminating behavioural anomalies. Pattern Recogni-
and generously answering many questions about their tion.
approach, and SAAB Microwave Systems for permit-
Mascaro, S., K. B. Korb, and A. E. Nicholson (2010).
ting us the use of their simulated data. Learning normal vessel behaviour from AIS data with
Bayesian networks at two time scales. Technical Report
TR 2010/, Bayesian Intelligence.
References
ODonnell, R., A. Nicholson, B. Han, K. Korb, M. Alam,
Bureau of Meteorology (2010). Daily weather observations, and L. Hope (2006). Causal discovery with prior infor-
May – July 2009. http://www.bom.gov.au/climate/ mation. In A. Sattar and B.-H. Kang (Eds.), AI 2006,
dwo/IDCJDW2124.latest.shtml. Volume 4304 of LNCS, pp. 1162–1167. Berlin: Springer.
Cansado, A. and A. Soto (2008). Unsupervised anomaly Pearl, J. (1988). Probabilistic Reasoning in Intelligent Sys-
detection in large databases using Bayesian networks. tems. San Mateo, CA: Morgan Kaufmann.
Applied Artificial Intelligence 22 (4), 309 – 330.
Spirtes, P., C. Glymour, and R. Scheines (1993). Causa-
Cheeseman, P., J. Stutz, M. Self, J. Kelly, W. Taylor, and tion, Prediction and Search. Springer Verlag.
D. Freeman (1988, August). Bayesian classification. In
AAAI 88, pp. 607–611. Wallace, C. S. and P. R. Freeman (1992). Single factor
estimation by MML. Journal of the Royal Statistical
Das, K. and J. Schneider (2007). Detecting anomalous Society B 54 (1), 195–209.
records in categorical datasets. In Proceedings of the 13th
ACM SIGKDD international conference on Knowledge Wallace, C. S. and K. B. Korb (1999). Learning linear
discovery and data mining, pp. 220–229. ACM. causal models by MML sampling. In A. Gammerman
(Ed.), Causal Models and Intelligent Data Management,
Heckerman, D. (1998). A tutorial on learning with pp. 89–111. Heidelberg: Springer-Verlag.
Bayesian networks. In M. Jordan (Ed.), Learning in
Graphical Models, pp. 301–354. MIT. Wang, X., J. Lizier, O. Obst, M. Prokopenko, and P. Wang
(2008). Spatiotemporal anomaly detection in gas moni-
Helldin, T. and M. Riveiro (2009). Explanation methods toring sensor networks. Wireless Sensor Networks, 90–
for Bayesian networks: Review and application to a mar- 105.
itime scenario. In Proc. of the 3rd Annual Skövde Work-
shop on Information Fusion Topics (SWIFT 2009), pp. Wong, W., A. Moore, G. Cooper, and M. Wagner (2003).
11–16. Bayesian network anomaly pattern detection for disease
outbreaks. In Int. Conf. on Machine Learning, Vol-
Jensen, F. V. and T. D. Nielsen (2007). Bayesian networks ume 20, pp. 808.
and decision graphs (2nd ed.). New York: Springer Ver-
lag.
Johansson, F. and G. Falkman (2007). Detection of ves-
sel anomalies — a Bayesian network approach. In Int.