SeaSpoofFinder -- Potential GNSS Spoofing Event Detection Using AIS

TL;DR

This paper presents SeaSpoofFinder, a framework that analyzes AIS data to detect potential GNSS spoofing events in maritime regions by identifying anomalous vessel movements and clustering patterns.

Contribution

The study introduces a novel two-stage data-processing framework for large-scale detection of GNSS spoofing using AIS data, reducing false positives through spatial clustering.

Findings

Recurrent spoofing patterns identified in multiple maritime regions.

AIS data reveals large footprints of potential spoofing events.

Non-spoofing artifacts can pass heuristic filters, indicating detection challenges.

Abstract

This paper investigates whether large-scale GNSS spoofing activity can be inferred from maritime Automatic Identification System (AIS) position reports. A data-processing framework, called SeaSpoofFinder, available here: seaspooffinder.github.io/ais_data, was developed to ingest and post-process global AIS streams and to detect candidate anomalies through a two-stage procedure. In Stage 1, implausible position jumps are identified using kinematic and data-quality filters; in Stage 2, events are retained only when multiple vessels exhibit spatially consistent source and target clustering, thereby reducing false positives from single-vessel artifacts. The resulting final potential spoofing events (FPSEs) reveal recurrent patterns in several regions, including the Baltic Sea, the Black Sea, Murmansk, Moscow, and the Haifa area, with affected footprints that can span large maritime areas. The analysis also highlights recurring non-spoofing artifacts (e.g., back-to-port jumps and data gaps) that can still pass heuristic filters in dense traffic regions. These results indicate that AIS-based monitoring can provide useful evidence for identifying and characterizing potential spoofing activity at scale, while emphasizing that AIS-only evidence does not provide definitive attribution.