Ships use GPS to navigate and find their way around the open sea, while also broadcasting this information to avoid collisions and increase maritime awareness. In consequence, some party interfering with their ability to navigate can cause great harm.This map shows regions around the globe where GPS spoofing -- the deliberate manipulation of GPS signals to confuse or interfere with users -- may occur based on ship movement patterns.
How it works
Global terrestrial AIS data is queried every two minutes to get a snapshot of all current ship coordinates, the time of their last update as well as metadata like their MMSI identifier, an approximate heading and more.Every hour, a job takes all records from the last hour and analyzes the movement of each ship for multiple spoofing indications: sudden jumps, clustering and unrealistic speeds over a longer time frame. While this is not a perfect approximation and real attacks may be much more sofisticated, it gives a good-enough approximation. Results of this analysis are then clustered using H3 indices and each region is assigned a score that indicates the likelihood of spoofing occuring based on the number of ships that are experiencing any of the mentioned properties in their track during any hour. The last, fully-elapsed hour is shown, meaning if the UTC hour file equals nine, the results between 09:00 and 10:00 am are presented.
Limitations
As mentioned, the algorithm for assigning a spoofing score is based on heuristics that indicate the possibility of spoofing. A ship may simply have bad GPS reception or experience temporary issues that do not indicate an active adversary. Sometimes, such signatures are also deliberate to hide the location of a ship or confuse other parties as to where it is at any moment. In any case, it is impossible to judge who is responsible for such interference and this map is merely an indication if it possibly happening.
Possible Extensions
This map is limited to coastal zones due to using terrestrial AIS receivers only. It would be nice to get access to satellite-based AIS data to be less-dependent on terrestrial receviers, but acquiring such data is very expensive.It would also be nice to get raw data from individual receivers and test Multilateration (MLAT) like many ADS-B aggregators are doing. MLAT uses the time-of-arrival difference of one signal at multiple receivers to bound the location of an object. By correlating the position derived from MLAT and the AIS-based location, this would give a very clear indication of malfunctioning GPS receivers.
Technologies Used
The processing is done using Python and DuckDB, where the algorithm is implemented in DuckDB. Results are stored as GeoJSON and served directly from object storage. The map itself uses Deck.GL to pull data from object storage and display it. All this works without any server and is fully done on the client side.