Session G2b: Resilient and Secure PNT Against Interference and Emerging Threats 1

Wide Marine Area GNSS Interference Detection by Using AIS and Deep Spatiotemporal Anomaly Networks
Ye Zhou, Xin Chen, School of Automation and Intelligent Sensing, Shanghai Jiao Tong University; Peng Chen, Jingsong Yang, State Key Laboratory of Satellite Ocean Environment Dynamics, Second Institute of Oceanography, Ministry of Natural Resources
Location: Palm

I. Introduction
Maritime navigation, timing, and safety services rely on Global Navigation Satellite Systems (GNSS), yet GNSS integrity and resilience are increasingly challenged by intentional and unintentional interference, including jamming, spoofing, and meaconing. These threats can degrade positioning continuity and trust, especially in littoral congested sea lanes and areas with complex electromagnetic environment. Despite substantial progress in signal authentication and receiver-level interference mitigation, continuous wide-area monitoring remains challenging in practice. Dedicated radio-frequency (RF) sensing networks and dense reference infrastructures are costly to deploy and maintain, and authenticated services are not uniformly available across these areas, particularly along open sea routes. Consequently, there is a growing need for complementary, infrastructure-light monitoring methods that can provide timely situational awareness and actionable warning for resilient position, navigation, and timing (PNT) operations.
Automatic Identification System (AIS) offers a unique opportunity to fill this gap. AIS is a standardized maritime cooperative surveillance system mandated for most commercial vessels, in which onboard transponders periodically broadcast identification and navigation messages over VHF channels to nearby ships and coastal receivers, and increasingly to satellite constellations for wide-area coverage. These reports routinely include vessel-reported position, course, speed, and vessel identification information, enabling large-scale tracking without requiring any dedicated sensing infrastructure from the monitoring side. From a monitoring perspective, AIS can be viewed as a crowd-sourced sensor of navigation consistency: when GNSS is degraded, vessel-reported kinematics and spatiotemporal traffic patterns may exhibit anomalous behaviors that are spatially coherent and temporally persistent, such as abrupt position discontinuities, inconsistent motion states, and abnormal transitions across maritime corridors. Unlike RF-based sensing, AIS-enabled monitoring does not require dedicated measurement hardware or direct GNSS signal access, making it appealing for wide-area applications.
However, exploiting AIS for interference monitoring remains difficult because AIS data streams are inherently noisy and heterogeneous, with irregular reporting intervals, duplicated messages, unreliable kinematic information, and occasional spike-like outliers originating from transponders, channel congestion or other communication effects. These issues can easily deceive naive anomaly detectors and cause high false-alarm rates, undermining operational utility.
Existing AIS-based anomaly detection methods typically fall into two categories. Rule-based approaches rely on manually crafted thresholds for unrealistic speed or position jumps. While interpretable, they often generalize poorly across regions, vessel types, and traffic regimes, and they are particularly sensitive to AIS sampling irregularities and transient glitches. Data-driven approaches, including classical outlier detection and time-series anomaly detection models, can reduce manual tuning but frequently operate at the vessel level and do not explicitly model the spatial coherence expected under wide-area GNSS interference. Moreover, many approaches treat input features as independent or adopt simplified temporal assumptions, limiting their ability to capture coupled changes across motion consistency, traffic density, and maritime traffic flow structure.
II. Proposed Method
In wide-area maritime GNSS interference monitoring, the target is not merely to flag an anomalous vessel trajectory, but to infer where and when regional maritime behaviors deviate from normal patterns in a method consistent with interference, and to do so with interpretable evidence supporting downstream decision-making. To achieve the objective, we propose an end-to-end framework for wide-area GNSS interference detection using AIS as a sensor of opportunity, designed to produce map-level situational awareness rather than isolated vessel alarms. The proposed pipeline converts raw AIS reports into a grid-window spatiotemporal representation and applies an unsupervised deep generative model to generate grid-level anomaly scores.
Two tightly coupled innovations enable robust detection and interpretation. First, we implement a physically informed AIS preprocessing and feature-engineering pipeline to mitigate AIS data noise while retaining signatures consistent with GNSS interference. The pipeline performs staged Maritime Mobile Service Identity (MMSI)-based static screening (including removal of illegal transmitters listed in a blacklist provided by maritime authorities) and discards messages with missing position or speed fields, then stabilizes vessel motion via geodesic kinematic recomputation and symmetric-window speed reconstruction Building on the reconstructed motion, we derive a kinematic-difference consistency feature to emphasize short-timescale inconsistencies, and we also extract flow-aware origin–destination (OD) descriptors that distinguish near-neighbor transitions from nonlocal ‘jump’ movements. The cleaned and augmented AIS stream is aggregated into overlapping sliding time windows over a spatial grid, producing an 18-dimensional grid-window representation that jointly encodes traffic density, OD flow structure, motion consistency, and anomaly prevalence, and is assembled into regular spatiotemporal feature tensors for wide-area learning. Second, we propose an unsupervised deep generative model that learns normal spatiotemporal patterns from historical AIS-derived grid features and assigns anomaly scores to deviations, implemented as a Transformer-conditional variational autoencoder (Transformer-CVAE) tailored for heterogeneous grid-window data. Each training sample consists of a fixed-length history of grid-window feature tensors, and the model is trained to generate the next window’s features, encouraging it to capture normal temporal evolution and flag unexpected changes at the next step. To match the structure of grid-based AIS features, the encoder is factorized into three attention stages: a feature-axis encoder that treats each scalar feature within a grid cell and time step as a token (via value projection plus learned feature-identity embeddings) and uses self-attention with pooling to learn cross-feature correlations; a temporal-axis encoder that applies self-attention along the history sequence for each grid cell with learned time-position embeddings to capture persistence, drift, and bursts; and a spatial-axis encoder that applies self-attention across grid cells at each time step with learned grid embeddings to model cross-cell coupling and wide-area coherence. The resulting context embedding for each grid cell is then projected into per-feature context vectors, enabling feature-specific predictions and uncertainty modeling. For each grid cell and feature dimension, the CVAE introduces a context-dependent latent variable: during training, a context-conditioned posterior additionally incorporates the observed target feature value, while during inference a context-dependent prior is used, allowing the model to represent normal variability and avoid over-confident predictions in naturally unstable maritime traffic. A probabilistic decoder maps the per-feature context and latent variables to predicted means and uncertainties under a diagonal Gaussian assumption, supporting likelihood-based anomaly scoring. Training minimizes a reconstruction loss based on Gaussian negative log-likelihood (NLL) together with a KL regularization term that aligns posterior and prior, where a beta weight controls the strength of regularization and is tuned to balance fidelity and generalization.
III. Experiment and Result
Open-source reporting in late May 2024 described a sustained GNSS interference event affecting both aircraft and maritime receivers near the Korean Peninsula, with South Korean authorities noting that the impacts extended to unusually low altitudes and to vessels at sea. Motivated by this reported wide-area event, we conducted experimental evaluation on a large-scale AIS dataset, covering 28.5°N–35.5°N and 124°E–127°E. The data span May 1 to May 29, 2024 and comprise 33798161 AIS messages from 9838 vessels, providing a realistic and highly heterogeneous setting for regional monitoring. Based on operational records for the study region, no significant GNSS interference incidents were reported during May 1 to May 28, whereas open-source intelligence indicates a large-scale GNSS spoofing event on May 29. Leveraging historical trajectories and expert knowledge, we constructed a message-level reference by labeling 120617 AIS reports on May 29 as interference-affected, including both spoofed points that form false tracks and boundary points immediately before and after the spoofing interval to capture transition dynamics. We divided the dataset into three sets: a training set from May 1 to May 20, a validation set from May 21 to May 28, and a test set of May 29. After robust preprocessing and feature engineering, AIS reports were aggregated into a 10×10 spatial grid with one hour sliding windows and a 30 minutes stride, yielding an 18-dimensional feature vector for each grid cell and time window. This grid-window representation enables the detector to learn not only local motion consistency but also regional traffic-flow structure and its temporal evolution.
Using this representation, the proposed Transformer-CVAE was trained in a fully unsupervised manner on normal data and validated on a subsequent normal period to capture normal spatiotemporal dynamics without access to interference labels. In our implementation, the model leverages a 24-step history context and a multi-axis Transformer backbone with 128-dimensional embeddings (4 attention heads, 6 layers), combined with an 8-dimensional latent space per grid-feature, and is optimized using Adam (learning rate 1e-3, batch size of 16) for 50 epochs. At inference, the model outputs grid-level negative log-likelihood scores as anomaly indicators, thereby accounting for predictive uncertainty rather than relying solely on reconstruction error. To ensure operational realism and avoid test-time tuning, decision thresholds are determined from a high-percentile quantile of validation NLL scores to control false alarms and then applied unchanged to the event day.
Results demonstrate strong discriminability at the grid scale. Using expert-labeled abnormal AIS messages on May 29 and a grid-labeling rule that marks a grid cell anomalous if it contains abnormal messages from at least K distinct vessels within the window, the proposed method achieves an ROC-AUC of 0.9641 and a best F1-score of 0.8318 under K=1. These outcomes indicate that the learned spatiotemporal model can effectively separate interference-consistent behaviors from normal maritime dynamics while maintaining practical alert performance. Additional analyses further support the effectiveness of the proposed method. Feature ablation experiments show a consistent upward trend in detection performance as the feature dimension is enriched, confirming that jointly modeling traffic density, OD flow structure, and motion-consistency descriptors provides complementary information for wide-area interference monitoring. Model ablations also verify the contribution of the multi-axis Transformer encoder, where removing feature-, temporal-, or spatial-axis encoding leads to clear performance degradation, demonstrating the necessity of capturing cross-feature coupling, temporal evolution, and spatial coherence. Finally, under identical grid-window inputs, comparative experiments against representative anomaly detection baselines—including classical methods (Isolation Forest and ARIMA) and deep models (VAE-LSTM, Anomaly Transformer, VT Transformer and CATCH) show that our approach achieves better grid-scale detection performance, highlighting the advantage of uncertainty-aware generative modeling combined with structured spatiotemporal attention for AIS-based GNSS interference monitoring. These results suggest AIS can serve as an effective sensor of opportunity for wide marine area interference monitoring, complementing RF sensing and authenticated GNSS services.