What are the two or three ships whose activity could represent a threat? These Conditions concern kinematic/dynamic elements (variation in speed, proximity to another ship) but also contextual (meteorological conditions, night/day) or descriptive elements (type, ship owner, history). This is a perfect example to implement clearpriority alerts (www.clearpriority.com)

1. SIS 0400-F8version 1.0 (N° RDE-000120829)
©DCNS 2007 - all rights reserved / tous droits réservés
Abnormal Vessel Behaviour Detection
Capacity
Olivier Coussaert - CLEAR PRIORITY
26 th September - Mourillon

2. SIS 0400-F8version 1.0 (N° RDE-000120829)
AGENDA
Objectives
Abnormal Behavior Detection Capability
How can users define Abnormal Behaviors?
Runtime Platform
Results & Conclusions

3. SIS 0400-F8version 1.0 (N° RDE-000120829)
The Problem
Text
What are the two or three ships
whose activity could represent a threat?

4. SIS 0400-F8version 1.0 (N° RDE-000120829)
Abnormal Behavior Detection Capability
Data for 100.000-
1000.000 ships every
1/2 - 10 minutes.
Alerts for 10-100
ships every days.

5. SIS 0400-F8version 1.0 (N° RDE-000120829)
User-Defined Abnormal Behavior
Condition Concept
A ship has an abnormal behavior when one or several characteristics of its
behavior fulfill certain Conditions.
These Conditions concern kinematic/dynamic elements (variation in speed,
proximity to another ship) but also contextual (meteorological conditions,
night/day) or descriptive elements (type, ship owner, history).
Condition Editor
The User can pick and combine Conditions from the Condition Dictionnary to
precisely define what kinds of behavior the platform. has to report.

6. SIS 0400-F8version 1.0 (N° RDE-000120829)
Runtime Platform
Preprocessing
Analysis Rule
Engine
Multi-Agent
System
Data
Alert to Be Studied
DCNS
ClearPriority
IRIT
Transform Data in
Events
Automate Event
Correlation Analysis to
Generate Alerts
Learn from User to Enforce
the Quality of Generated
Alerts

7. SIS 0400-F8version 1.0 (N° RDE-000120829)
Results & Conclusions
User-Oriented Approach: Conditions allow to model abnormal
behavior intuively and hide all the mathematical & technical
complexities;
Event Centric: Reducing the gigantic mass of data related to several
dozen of thousands of ships to a restricted but notable set of events
allow to achieve high performance.
Combine the advantages of different technologies:
combining complex event processing (ClearPriority) with learning
machine technologies (IRIT) produce high valuable alerts.