# AIS Data Vulnerability Indicated by a Spoofing Case-Study
## 4 Case Study on Spoofing Large Amounts of AIS Fake Targets Nearby Elba Island and Its Impact on VDL
### VDL Load and Spoofing Source Analysis  
In this part, we must first point out that the ITCG has provided us with received data from other vessels (VDM), which shows that most of the AIS messages are received via the Monte Capanne AIS BS located on Elba Island. From the database, we can deduce that only 20 messages sent by artificial ships were received by the AIS BS in Corsica. At the same time, we have analyzed the signals of the real ships, almost all of which were received from another AIS BS, such as Monte Agentario or La Castellana. In Figure 8, the range of MMSI numbers used in spoofing was shown along with the number of repetitions (1 to 4) of each MMSI. From the same figure, the missing MMSIs can be seen. Received data indicates that a spoofing algorithm was run with auto-incrementing MMSI numbers. Missing MMSIs in received data sets are likely due to transmission collisions with nearby vessels. Figure 7: Spatial and temporal distribution of the received AIS signals during the 2 nd burst. Figure 9 shows the distribution of the spoofed AIS targets during the second burst; the first part shows the principal component analysis with two principal axes of the distribution. The ship positions are shown in the Universal Transverse Mercator coordinate system. The second part of the figure shows the distribution of ships along each axis. It can be seen that it is most likely a parabolic spatial distribution, while the velocities of the ships and their courses are normally distributed. The Formula (4) show the most likely distribution model used. However, the right part of the figure also shows the Gaussian curves for the distribution along the primary axis for both bursts. It can be seen that the sources are shifted by about 5 km but have the same standard deviation of 7.7 km. \[ \begin{split}&\text{R}_{\text{max}}=11\text{NM}\\ &\alpha\ =360^{\circ}\cdot\text{RAND(r)};0<\text{r}<1\\ &\text{R}\ =\ \text{R}_{\text{max}}\left(1-\sqrt{1-\text{RAND(r)}} \right)\\ &\text{x}\ =\ \text{R}\cdot\cos(\alpha);\text{y}\ =\ \text{R}\cdot\sin(\alpha)\\ \end{split}  \tag{4}\]  
Figure 8: AIS bursting—MMSI temporal occurrence and repetition. Figure 9: AIS bursting—(**a**) PCA analysis; (**b,c**) \"Normal Mixture\" distribution. The manipulation of the AIS system is also illustrated in Figure 10. The EMODnet method showed a shipping density of up to 45 ships/km\({}^{2}\)[26]. Considering the VDL load, the number of slots with received signal strength indicator (RSSI) above the noise level indicates that the spoofer has generated almost 100% VDL load. AIS message 4 (BS report) shows that the memory of the BS station is saturated, which means that the AIS BS in Monte Capanne has received more than 2048 different AIS station reports in the last 9 min. It is difficult to find the position of the AIS generator because the signals were not transmitted synchronously with the AIS frame, so the time of arrival (TOA) information cannot be relied on to calculate the distance to the receiving station [51]. The first potential candidate is the vessel identified with the MMSI 99999999. The figure shows these MMSI trajectories over several months, with the vessel being most frequently in and off the main naval base in the area, as presented in Figure 11. It is very likely that the ship from the naval base is a different one from that received near the island of Elba, which in turn may be the same as the one received again near Bonifacio a few hours later. This might indicate the probability of several naval vessels sharing the same artificially generated MMSI, which is not unusual for warship AIS devices. Warship systems can generate such a spoofing event. Figure 10: AIS spoofing—shipping density near Elba Island (Screenshot of ECDIS Navi Simulator, Wartsila) [40]. Ships with MMSI 312320000 and MMSI 367309390 are also suspected. It is noticeable that the jitter error and RSSI level of these two targets match those of the spoofed messages with the Dutch MMSIs, as well as MMSI 999999999.