The Challenge: Detecting Deception at Sea
By Steven Carrell, Konstantinos Giannakopoulos, Vincent Good, Thomas Spriggs
AIS spoofing has become one of the most sophisticated methods used to conceal vessel activity, with an observed 20x increase in events detected between 2022 and 2024. Rather than switching off AIS transmissions entirely, vessels now broadcast false positions, appearing active and compliant within maritime tracking systems while masking their true movements and activities.
For compliance teams, insurers, regulators, and maritime intelligence professionals, this creates a significant challenge. The data appears complete, yet the vessel may not be where it claims to be.
At Lloyd’s List Intelligence, we have invested heavily in detecting these deceptive behaviours. Using a combination of maritime domain expertise, rule-based analytics, machine learning models, and our proprietary AIS receiver network, we can identify patterns strongly associated with spoofing activity.
Our models look for indicators such as:
- Physically implausible movement - positions implying unachievable speeds, or unnaturally little positional variation over long periods
- AIS positions geographically incompatible with the terrestrial receiver that captured them
- Navigation behaviour inconsistent with the vessel's characteristics or operational profile
- Historical patterns observed across known spoofing events
By combining multiple detection techniques, we can identify vessels exhibiting strongly suspicious behaviour with a high degree of confidence.
However, there is an important distinction between detecting spoofing and proving it.
The Gap Between Detection and Confirmation
Even the most advanced machine learning models ultimately provide probabilities rather than certainty.
A vessel’s AIS data may exhibit every characteristic associated with spoofing, but to conclusively demonstrate that a vessel was not where it claimed to be requires independent verification. Up until recently, this verification was performed manually by an investigating analyst who would typically:
- Search satellite imagery providers for coverage of the reported vessel location,
- Identify imagery captured sufficiently close to the AIS transmission timestamp,
- Assess image quality, cloud cover, and suitability for analysis,
- Manually inspect the imagery to determine whether a vessel is present at the reported position,
- Then compare the visual evidence against the AIS data.
If no vessel is present at the reported location within the expected time and position tolerances – and the imagery is good and accurate that a vessel would have been visible if present – the spoofing event is confirmed.
While highly effective, this process requires specialist knowledge, access to satellite imagery, and significant analyst effort. As spoofing activity grows, manual confirmation becomes increasingly difficult to scale. This is the gap we set out to close.
Automating Satellite-Based Validation
To address this challenge, the Data Science team at LLI led a project to develop an automated satellite validation capability designed to transform probable spoofing detections into confirmed spoofing events.
The solution automatically combines AIS intelligence with Earth Observation data from satellite imagery providers.
When a spoofing event is detected, the system:
- Identifies suitable satellite imagery covering the reported vessel position
- Evaluates temporal proximity to ensure the imagery was captured close to the AIS transmission time
- Applies quality controls, including cloud-cover and image suitability checks
- Extracts imagery around the reported vessel location
- Uses computer vision models to determine whether a vessel is present at the reported position
If the imagery confirms that no vessel exists where AIS reports one should be, the event can be automatically elevated from a probable spoofing event to a confirmed spoofing event.
Combining Maritime Intelligence with Computer Vision
At the heart of the solution are advanced computer vision models trained to identify vessels within satellite imagery.
Using optical and SAR (Synthetic Aperture Radar) satellite data, these models can automatically analyse imagery and detect the presence or absence of vessels without requiring manual review.
This creates a powerful combination:
- LLI spoofing models identify suspicious vessel behaviour
- Satellite imagery provides independent visual evidence
- Computer vision automates the validation process
Together, these technologies provide a significantly higher level of confidence than any individual source could achieve alone.
What is optical and SAR imagery?
Optical Imagery
Optical satellites capture images using sunlight reflected from the Earth's surface, much like a conventional camera. They can provide detailed visual information about vessels, including their location, size, shape and colour. However, optical imagery is limited by cloud cover and daylight conditions.
Synthetic Aperture Radar (SAR)
SAR satellites use radar signals (microwave pulses) rather than sunlight to build images of the Earth's surface. This allows them to detect vessels day and night, even through cloud cover and adverse weather conditions, though image detail is generally more limited than high-resolution optical imagery.
Delivering Greater Confidence for Customers
For our customers, the benefits extend beyond improved detection.
Automated verification of spoofing events provides:
- Higher confidence in spoofing alerts
- Independent evidence supporting investigations
- Reduced analyst workload and faster identification of deceptive vessel activity
- More scalable monitoring across global fleets and trade routes
Most importantly, it helps move maritime intelligence from inference toward verification.
Instead of asking whether a vessel might be spoofing its location, customers can increasingly determine whether a spoofing event has been independently confirmed.
The Road Ahead
AIS spoofing techniques continue to evolve, and so must the methods used to detect them. Automated satellite validation represents the next step in maritime transparency, combining machine learning, computer vision, satellite imagery, and maritime expertise to deliver stronger evidence and greater confidence.
As the volume and quality of Earth Observation data continue to improve, we see significant opportunities to further expand automated validation capabilities, helping customers distinguish genuine vessel activity from increasingly sophisticated attempts at deception.
Conclusion
Detection identifies potential concerns; confirmation provides an additional layer of confidence. By combining advanced spoofing detection models with automated satellite imagery analysis, Lloyd’s List Intelligence is helping transform probable spoofing events into confirmed evidence of deception.
The result is a more transparent maritime domain, better-informed decision making, and stronger protection against sanctions evasion, illicit trade, and other deceptive shipping practices.
Satellite Confirmed Spoofing in action:
