## 3 Traffic Model and Knowledge Discovery  
The proposed methodology, called Traffic Route Extraction and Anomaly Detection (TREAD), automatically learns a statistical model for maritime traffic from AIS data in an unsupervised way, _i.e._, without assuming any prior knowledge on the monitored scene. Building on the work in [26, 27, 33], the traffic knowledge used here is shaped by vessel objects, created and updated from the sequence of input AIS messages. A bounding box is selected and corresponds to the specific area under surveillance. The series of vessel state vectors can originate as discontinuous events, such as a break in observation updates. The clustering of such events, initiated by different vessels objects, \(Vs\), enables us to form waypoint objects, \(WPs\), which identify either stationary points, \(POs\), entry points, \(ENs\), and exit points, \(EXs\), within the selected bounding box. The linking of such waypoints ultimately leads to the detection and statistical characterization of route objects, \(Rs\). Anomalies can then be detected on the basis of the discovered knowledge and its interaction with real-time vessel traffic. The general assumption of the statistical model is that the feature values of the data points come from a stable (_i.e._, stationary) distribution of normal traffic, estimated using training data. The feature data points are considered as single trajectory points. In the literature, such an approach is referred to as a point-based approach (see, e.g., [8]), in contrast to trajectory-based approaches, where the traffic representation is based on complete trajectories (see, e.g., [14]). The approach presented here is a practical compromise to get a reliable traffic representation without increasing the model complexity: (i) it uses a point-based traffic representation and (ii) it integrates time information into the knowledge exploitation to include the relationship between successive data points. A practical advantage is that the TREAD methodology can easily handle trajectories of unequal length or with gaps. As a matter of fact, incomplete and segmented trajectories are frequent in maritime traffic, due to the refresh rate of AIS messages being highly variable for a number of legitimate reasons (since it was conceived for collision avoidance, AIS Class A units change the messages transmission rate depending on the need to refresh information, ranging from three minutes (ship at anchor) up to two seconds (fastand/or maneuvering vessel). Similarly, Class B devices for non-SOLAS (Safety of Life at Sea) vessels report at variable intervals, although transmitting at lower rates than Class A equipment [34].). This occurs when AIS tracks are \"lost\", because of (i) terrestrial coverage gaps in the network of receivers, (ii) intermittent AIS [35] or (iii) long time intervals between subsequent overpasses or low probability of detection of satellite-based receivers [36]. A vessel transponder could also be switched off intentionally, but that is a separate issue. TREAD Functional Architecture Manager:the discovery and exploitation of maritime traffic knowledge-based on AIS information follows the functional architecture shown in Figure 1; the stream of AIS messages is processed to incrementally learn maritime motion patterns through the \"Vessel Objects Manager\" activated by relevant events based on the temporal and spatial characterization of vessel behavior. The clustering of such events leads to the discovery of waypoints (stationary objects and entry/exit points). The knowledge discovery process is followed by potential exploitation, such as in route classification, prediction and anomaly detection. Vessel Objects Manager:As soon as a new vessel enters the monitored scene, a detection occurs, and the management of vessel objects is initialized (see Algorithm 1-_Unsupervised Route Extraction_, Annex A). The list of vessel objects, \(Vs\), is updated according to the information content of each decoded AIS message (or database record when performing historical data analysis).