# Abnormal Ship Behavior Detection Based on AIS Data
## 3 Materials and Methods
### Detection of Abnormal Ship Behavior Based on Thematic Attributes
#### 3.3.2 Anomaly Detection Based on the Isolation Forest Algorithm by Using Thematic Attributes  
The work described in Section 3.2 mainly detected abnormal behaviors based on the spatial attributes of ships and then introduced the detection of abnormal behavior for ship thematic attributes based on the isolation forest algorithm. The existing method of detecting abnormal behavior usually provides results of 0-1; that is, the result is abnormal or non-abnormal, but it does not provide a score for the abnormal behavior of the target. Therefore, we chose the isolation forest algorithm to obtain the anomaly score for the input dataset.  
Isolation forest is composed of multiple isolated trees, and it divides and detects outliers in a layer-by-layer manner based on the characteristic of \"few but different\" outliers [33]. We divided the thematic attributes into two feature sets: an instantaneous attribute feature set and average attribute feature set. The instantaneous attribute features include the speed over ground and the variation of the course over ground, which were used to describe the instantaneous changes in the ship's behavior. The average attribute feature set includes the average velocity and average acceleration attributes in the ship thematic attribute feature to describe the changes related to the time period of the ship in the process of traveling. In the conventional isolation forest construction, a random selection of features is used, and a partition value is selected randomly and iteratively to build an isolation tree until the dataset is iteratively segmented and until one of the following conditions is met: (1) the isolation tree has been constructed to a tree height, (2) there is only one node on a node of the binary tree, or (3) all the sample features on the node are identical. It can be observed that in that process of isolation, a normal point usually belongs to the deep end of the tree, and an abnormal point is usually located near the root of the tree. Therefore, we defined the total path length from the parent node along the corresponding path to a leaf node as the degree of the abnormality of the leaf node. In a feature dataset containing \(n\) pieces of data, its average length path in multiple trees is as follows:  
\[c(n)=2H(n-1)-\frac{2(n-1)}{n} \tag{5}\]  
where \(H(i)\) is the harmonic number. Since \(c(n)\) is the average of \(h(x)\) after \(n\) is provided, we can normalize it for \(h(x)\). The normalized exception score formula is as follows:  
\[s(x,n)=2-\frac{E(h(x))}{c(n)} \tag{6}\]  
In the formula, \(s\) denotes the abnormal score obtained after training \(n\) pieces of data. \(E(h(x))\) is the average of the isolation tree \(h(x)\). The following evaluation criteria can be obtained from the formula:  
1. The data are abnormal when \(s\) approaches 1;
2. The data are more normal when \(s\) is far less than 0.5;
3. If the score of the entire set of data is around 0.5, there is no significant outlier in the set of data.  
Considering that different attributes represent different types of ship motion, we used the entropy weight method to integrate the abnormal scores generated by the isolation forest. The entropy weight method determines the objective weight according to the magnitude of the index variability. On the one hand, this has a smaller computational cost. On the other hand, it belongs to the objective weighting methods and is more suitable for the same data-driven type of isolated forest algorithm. The final composite score is the abnormal score of the input feature set. The flow chart for ship anomaly detection based on isolation forest is shown in Figure 6.  
Figure 6: Flowchart of detection of abnormal ship behavior with thematic attributes based on isolated forest.