Maritime domain awareness
Dark vessels, charted waters, one air-gapped desk.
A coverage-aware anomaly engine fuses terrestrial and satellite AIS, SAR / EO vessel detections and receiver-coverage modeling into calibrated, evidence-preserving events — a dark-gap candidate is scored against where you could actually hear, never just flagged. S-57 ENCs and the S-100 raster family render as situational-awareness chart layers, and every candidate can publish to the TAK mesh as an alert.
11 AIS sanity rulesDark-gap coverage modelYOLOv8-OBB / RT-DETR + CFARJPDA associationS-57 · Inland ENC · AMLS-102 · S-104 · S-111 · BAGSTS rendezvous detection
At a glance
- AIS inIn-house ITU-R M.1371 decoder (types 1/2/3/5/18/24) · rtl_ais SDR · TCP NMEA · satellite AIS connectors (aisstream.io WebSocket, Spire / Kpler GraphQL)
- Anomaly eventsAisAnomaly · AisGap · DarkVesselCandidate · GhostAisCandidate · IdentityManipulation · SuspiciousBehavior · AisRuleHit
- DetectionSAR / EO vessel detector sidecar (YOLOv8-OBB / RT-DETR, loopback-only) with CFAR fallback; Mahalanobis + gated Hungarian + JPDA association to AIS
- ChartsS-57 ENC (+ updates), Inland ENC, NATO AML → S-52-inspired MVT; S-102 / BAG as depth COG + DEM source; S-104 water level; S-111 currents; BSB / KAP rasters
- RegistryVessel registry with OFAC / EU sanctions lists; 30-day archive + replay; port-call / ETA; pattern-of-life baselines
- OutAIS→CoT bridge (a-f-S-U-C), alert SSE, STANAG 4676 track export, FeatureServer over maritime.gpkg
Capabilities
From pings to defensible candidates
AIS sanity and anomaly rules
Eleven rules run on every position report: validity, speed-vs-ship-type caps, turn rate, course / heading mismatch, impossible jumps, duplicate MMSI, future timestamps, stale bursts, duplicate transmissions, gated land intersection and nav-status inconsistency.
- Tiers Information → High, plus ghost-AIS tiers
- Every hit carries the evidence that produced it
Coverage-aware dark gaps
A receiver-coverage model (terrestrial 6 min half-life, satellite 3 h) answers the question that matters: should we have heard this vessel here? A gap only becomes a DarkVesselCandidate when coverage says silence was surprising.
- GapSuspicionThreshold default 0.6
- Never a “guilty” label — candidates, scored and calibrated
Imagery-confirmed detection
SAR and EO scenes run through the vessel-detector sidecar (CFAR fallback when it is absent); detections associate to AIS tracks with Mahalanobis gating, Hungarian assignment and JPDA — an unmatched detection in a coverage hole is the classic dark-ship cue.
/api/maritime/detect·/api/maritime/associations/{detectionId}- Ship-and-wake work rides the same SAR tier as coherence and amplitude change
Behavior chains
Ship-to-ship rendezvous (CPA under 500 m at relative speed under 3 kn), loitering, STS / dark-activity chains, port-call and ETA reasoning, and pattern-of-life baselines over the 30-day archive with replay.
- Analyst decisions and labels persist per event
- Calibration endpoint reports Brier score and ECE
Charts as SA layers
Drop an ENC exchange set and get a marine.gpkg, S-52-inspired MVT tiles with day / dusk / night palettes, safety-contour shading, soundings, lights and decoded identify — BOYLAT reads as “buoy, lateral”, not a code.
- SCAMIN and display categories precomputed at ingest
- S-102 / BAG bathymetry doubles as terrain: viewshed and LOS over the seabed
- Original symbol artwork — no IHO PresLib, no GPL assets
Into the COP
Vessels bridge to CoT for every ATAK on the net, candidates raise alerts on the same bus as geofences and C-UAS, and the whole picture exports as STANAG 4676 for JISR exchange.
- Field Sentinel bridge pushes candidates as maritime-envelope alerts or TAK CoT
- CPA alerts against protected assets ride the fusion tier
Watch-floor workflow
A dark-vessel candidate, end to end
The chain is built to survive an analyst’s cross-examination: every event keeps its inputs, its rule hits and its coverage context.
- ListenTerrestrial AIS from the SDR or a TCP feed; satellite AIS from your provider account; the coverage model learns what each receiver actually hears.
- ScreenThe 11 rules and the gap model raise anomalies with calibrated suspicion scores and tiers.
- ConfirmTask or ingest a SAR / EO scene over the gap; the detector and JPDA association either explain the contact or harden the candidate.
- ContextualizeRegistry, sanctions lists, port calls, rendezvous chains and pattern-of-life baselines frame the vessel’s behavior.
- DisseminatePublish to TAK, alert the watch floor over SSE, export STANAG 4676 or hand the GeoPackage to the next analyst.
Specifications
Inputs, engines, outputs
AIS & feeds
- DecoderITU-R M.1371 types 1/2/3/5/18/24, in-house
- SDRrtl_ais; TCP NMEA
- Satelliteaisstream.io WebSocket · Spire / Kpler GraphQL
- Archive30-day rolling with replay panel
- RegistryVessel registry + OFAC / EU sanctions
Charts
- VectorS-57 ENC with .001+ updates · Inland ENC · NATO AML → MVT + GL style
- RasterS-102 · BAG · BSB / KAP → COG
- DynamicS-104 water level · S-111 currents with timestep queries
- IdentifyDecoded object classes and attributes, air-gapped
- Serving
/api/marine/tiles/{z}/{x}/{y}.pbf+ FeatureServer facades
Anomaly engine
- Events7 types, 6 tiers
- CoverageTerrestrial 6 min · satellite 3 h half-life
- AssociationMahalanobis + Hungarian + JPDA
- RendezvousCPA < 500 m ∧ rel-speed < 3 kn
- CalibrationBrier + ECE at
/api/maritime/calibration - Storemaritime.gpkg + FeatureServer
Honest scope
What ships, what is optional, what is next
Defense buyers get burned by overclaims. This is the plain-language scope for this capability, drawn from the product’s own documentation.
- Shipped Anomaly engine, coverage model, detection association, charts, registry, archive — The maritime workstreams through pattern-of-life baselines are in the build, with the dark-gap coverage fix landed.
- Optional sidecar / gated Vessel detector sidecar — YOLOv8-OBB / RT-DETR runs as a loopback-only sidecar; CFAR is the built-in fallback. Satellite AIS needs a provider account.
- Roadmap Own-ship CPA — CPA math ships, but no own-ship feed is wired yet, so own-vessel CPA/TCPA alerts are not operational.
- Roadmap Not covered — DNC / VPF (needs an OGDI-capable GDAL), S-101 (reports false until validated against IHO test data), encrypted S-63 / ARCS / CM93, RF geolocation, LRIT / VMS, metocean GRIB. Audit trail is append-only but not yet tamper-proof — no authN tier.
- Roadmap Not for navigation — Charts are a situational-awareness display; this is not a type-approved ECDIS and does not implement the full IHO S-52 presentation library.
GeoTactical Insights · powered by 3D Map Explorer
See it on a disconnected machine.
A 30-minute guided demo on your own data: ingest, exploit, fuse, share to TAK and export — with the network cable out. We will also tell you exactly what is a sidecar, what is gated and what is still roadmap.
GeoTactical Insights
GEOINT and defense workflows powered by 3D Map Explorer, the air-gapped geospatial intelligence platform from Tech Maven Geospatial.