A Multi-Agent System for Tracking the Intent of Surface Contacts in Ports and Waterways

1
A Multi-Agent System for Tracking the Intent of
Surface Contacts in Ports and Waterways

• Tan, Kok Soon Oliver
• Project Manager
• C4IT-IKC2
• DSTA
• tkoksoon_at_dsta.gov.sg

2
Agenda

• Introduction
• Concepts
• Multi-agent System Design
• System Validation Scenarios
• Recommendations and Conclusion

3
Introduction

• A thesis on modeling the intent of surface
  contacts with a multi-agent system (MAS) for
  asymmetric threat identification in busy ports
  and waterways
• Inspired by similar work done in the area of air
  threat assessment in Air Defense Laboratory (ADL)
  Ozkan 2004, NPS

4
Thesis Questions

• How can surface contact intent be modeled with a
  MAS for the identification of potentially hostile
  behaviors and threats in ports and waterways?
• Will the models be sufficiently realistic to be
  used as a decision aid in maritime security?

5
Why a MAS?

• A multi-agent model is a distributed
  intelligence model that is a natural solution
  of a large-scale real-world problem1
• The real world problem is physically distributed
• Every surface contact is an autonomous entity
  that we are interested in knowing its probable
  intentions
• The knowledge to solving the real world problem
  is widely distributed and heterogeneous
• No one agent or system is "knowledgeable" enough
  to trawl and mine databases, process real-time
  sensor data, monitor for rule violations or
  suspicious behaviours etc
• The sources of data are distributed over networks
• Naturally this encourages us to take a
  distributed view of a solution for the real world
  problem and
• The real world problem is too complex to be
  analysed as a whole
• There are too many parameters and constraints to
  be considered altogether. Local approaches,
  partitioning the large problem into smaller and
  more tractable sub-problems, can produce results
  quickly.

1. Ferber, J., Multi-Agent Systems An
Introduction to Distributed Artificial
Intelligence, Addison-Wesley, 1999.
6
MAS Objectives

• A multi-agent system (MAS)
• To help the human operator sieve through hundreds
  of surface contacts
• To integrate intelligence and information from as
  many sources as possible
• To highlight any suspicious or potentially
  hostile surface contacts

7
Requirements of the MAS

• Support rules and regulations of a Vessel Traffic
  Service (VTS) such as
• Traffic Separation Scheme (TSS), part of the
  International Navigation Rules defined by the
  International Maritime Organization
• the 1972 Collision Regulations (72 COLREGS)
• International Ships and Port Facilities Security
  (ISPS) Code (To be implemented)
• all other practices of safe navigation and
  prudent seamanship
• Predefined safe speed limits in TSS
• Safe speed limits for different surface track
  types

8
Requirements of the MAS cont

• Use Surface Warfare Threat Assessment cues and
  corresponding perception of threat Liebhaber
  2002, SPAWAR Systems Center, San Diego
• Obtained through empirical and observational
  studies of the threat assessment process by
  experienced surface warfare officers
• Each cue has a Threat Level Change Rating (TCR)
  that changes the threat level posed by a surface
  contact

1. Platform/Weapon Envelope/ESM
2. Origin-Flag
3. Range/Distance from Own-Ship (subsumed under CPA)
4. Heading (subsumed under CPA)
5. Closest Point of Approach (CPA)/Speed
6. Number of vessels (To be implemented)
7. Own support in area (To be implemented)
8. Destination
9. History/Voice communication
10 Sea Lane/Other intelligence
11. Superstructure Type (To be implemented)
12. Coordinated Activity (To be implemented)
9
Requirements of the MAS cont

• Use information from ship-borne
• Automatic Identification system (AIS)
• Transponder for large vessels (gt300gt)
• International Maritime Organization (IMO)
  recommendation
• Harbor Craft Transponder system (HARTS)
• For smaller vessels
• Applies to the Port of Singapore only

1. Track Type
2. Callsign (To be implemented)
3. IMO Number (Lloyds Register Number) (To be implemented)
4. Maritime Mobile Service Number (To be implemented)
5. ETA (To be implemented)
6. Destination (To be implemented)
10
Thesis Scope

• Identify and track the intent of surface contacts
• Borrowing the ideas and techniques suggested for
  identifying air threats in the Air Defense
  Laboratory (ADL) and use them to identify
  asymmetric maritime threats
• The thesis does not cover the issue of track
  detection i.e. assumes perfect instantaneous
  detection with 100 reliability
• The issue of interdiction when a potentially
  hostile track has been identified is also beyond
  the scope of this thesis

11
Some Concepts

• Traffic Separation Scheme (TSS)
• Security Zones for HVUs
• Security Zones for Restricted Areas
• Areas-To-Be-Avoided (ATBA)
• Safe Speed Limits

Skip Concepts
12
Traffic Separation Scheme (TSS)

• A TSS is a sea lane with a predefined traffic
  direction
• A TSS may also has a predefined safe speed (for
  prudent seamanship)
• A violation occurs when a track is traveling
  against traffic direction or is traveling at an
  excessive speed

13
Security Zones for HVUs

• Every High Value Unit (e.g. cruise liner, tanker)
  have their own predefined multiple security zones
• Only some type of tracks (e.g. Police Coast
  Guards) are allowed within these security zones
• Each security zone is defined with an alert time
  threshold (represents a measure of urgency when
  these zones have been infringed)

14
Security Zone Violation Example

• A security zone violation occurs i.e. a track is
  coming in too near, too soon, if an unauthorized
  track has
• a CPA (Closest Point of Approach) within a zone,
  and
• a TCPA (Time to CPA) below alert time threshold

Too near! Too soon!
CPA
TCPA 3min
Radius 0.2nm, Alert Time 15min
Radius 0.5nm, Alert Time 10min
Radius 0.8nm, Alert Time 5min
15
Security Zones for Restricted Areas (Static HVUs)

• Restricted areas (e.g. harbor, oil refineries,
  military installations) can have their own
  predefined multiple security zones
• Only some type of tracks (e.g. Police Coast
  Guards) are allowed within security zones
• Each security zone is defined with an alert time
  threshold

Radius 0.2nm, Alert Time 15min
Radius 0.5nm, Alert Time 10min
Radius 0.8nm, Alert Time 5min
16
Areas-To-Be-Avoided (ATBA)

• Restricted areas (e.g. harbor, oil refineries,
  military installations)
• Only allow certain types of tracks (e.g. Police
  Coast Guards) or certain types of track activity
  within these areas
• An ATBA violation occurs when an unauthorized
  track intrudes into a restricted area

17
Safe Speed Limits

• Some locations or restricted areas (e.g. harbor)
  may only allow tracks to travel at predefined
  speed limits
• Speed limits can be defined for different track
  types
• A violation occurs when a track exceeds any of
  these speed limits

18
The Compound Multi-agent System

• A compound multi-agent system (MAS) designed for
  surface contact intent tracking
• Each surface contact is represented by a track
  agent
• Every track agent has a nested MAS (Russian
  Doll)

19
Anatomy of a Track Agent
Friendly Intent Agent
Neutral Intent Agent
Potentially Hostile Intent Agent
Unknown Intent Agent
Composite Agents
ATBA Zone Track Activity Violation Blend
ATBA Zone Track Type Violation Blend
Security Zone Violation Blends
Speed Threshold Violation Blend
Speed Violation Blend
TSS Heading Violation Blend
Security Zone Violation Blends
Cognitive Agents
Speed Threshold Violation Agent
TSS Heading Violation Agent
Speed Violation Agent
Location Agent
Area-To-Be-Avoided (ATBA) Violation Agent
Security Zone Violation Agent
Reactive Agents
Track Flag Data Ticket
Track Origin Data Ticket
Track Destination Data Ticket
Track ESM Data Ticket
Track Type Data Ticket
Track Position Data Ticket
Track Activity Data Ticket
Track Comm Data Ticket
Track Heading Data Ticket
Track Speed Data Ticket
20
The Compound Multi-agent System cont

• Agents in the nested MASs continuously process
  incoming information about their respective
  surface contacts
• Agents communicate and co-ordinate in order to
  discover the likely intent of surface contacts

21
Conceptual Blending

• Conceptual Blending1 is a theory about how humans
  process the information coming from the
  environment and how humans rationalize the events
  happening around them
• Blending is a set of mental operations for
  combining cognitive models in a network of mental
  spaces
• Mental spaces are small conceptual packets

1. Gilles, F., Turner, M., The Way We Think,
Basic Books, New York, 2002
22
Conceptual Blending cont

• Mental spaces are connected to long-term
  schematic knowledge called frames e.g.
• The frame of sailing along a ferry route, or
• The frame of traveling inside a maritime traffic
  separation scheme (TSS),
• Long-term specific knowledge such as a memory of
  an event such as past track incursions into
  Area-To-Be-Avoided (ATBA) zones.
• Mental spaces are interconnected in working
  memory which can be modified dynamically

23
Conceptual Blending cont
Generic Space
A Basic Conceptual Integration Network
Input Space 1
Input Space 2
Blend

• Building a conceptual integration network
  involves setting up several mental spaces.
• Two input mental spaces with cross-space mapping
  to connect counterparts in these input mental
  spaces
• However not all elements and relations from the
  input spaces are projected into the blend.
• Generic spaces are used for the generic
  structures they contain to guide the selective
  projection of elements from the input spaces into
  blended spaces
• The blended space is the mental space where,
  during blending, the structure from the input
  mental spaces is projected onto, represented by
  the dotted lines

24
Conceptual Blending cont

• Any mental space can participate in multiple
  networks.
• Complex integration networks can be built with
  arrays of mental spaces that are connected
  through blending operations.

25
Conceptual Blending Examples
Generic Space
CPA lt Security Zone Radius
TCPA lt Security Zone Alert Time
Track Type ? Allowed Track Types
Track Type
Allowed Track Types
Identity Vital Relation
Security Zone Radius
Distance Vital Relation
Track CPA (Closest Point of Approach)
Time Vital Relation
Security Zone Alert Time
High Value Unit
Track TCPA (Time to CPA)
Track
Blend
Security Zone Violation

• Example of how a Security Zone violation is
  detected

26
Conceptual Blending Examples
Generic Space
Track Activity ? Allowed Activity Type
Track Location Zone Name
Track Activity
Allowed Activity Type
Activity Vital Relation
Activity Vital Relation
Location Vital Relation
Track Location
Zone Name
ATBA Zone
Track
Blend
ATBA Zone Track Activity Violation

• Example of how a ATBA Zone Track Activity
  violation is detected

27
The CMAS Library

• The communication and coordination among many
  different agents in the nested MAS is achieved
  using the Connector-based Multi-agent Simulation
  Library (CMAS) John Hiles, NPS
• The basic elements for agent communication and
  control within the CMAS framework are connectors.
• The agents use these connectors to externalize
  portions of their internal states into the
  multi-agent environment.
• Connectors are like plugs and receptacles that
  can be extended or retracted
• Signaling and coordination between the two agents
  occur when there are matching pairs of
  plug-receptacle connectors and the connectors get
  connected
• Stimergy (communication through change of local
  environment) among agents

Agent 2
Extended response connector (Receptacle)
Plug-Receptacle match
Extended stimulus connector (Plug)
Agent 1
Retracted connector
28
A MAS of MASs (Russian Doll)

• A track agent appears as a single agent that
  exists in another external MAS environment
• In this external MAS environment, there is a
  layer of regional agents that monitor behaviors
  of all track agents
• Two types of regional agents detect coordinated
  behavior that resembles an impending swarm or a
  wolf-pack attack

29
Detection of Coordinated (Swarm/ Wolf-pack)
Attack on a moving HVU
Too near! Too soon! Too many!

• If two or more track have
• CPAs to a HVU (High Value Unit) that are very
  close e.g. 0.1 nm, and
• TCPAs violations against the same HVU that are
  about to occur within a very short period of time
  e.g. 5 mins

The MAS will consider multiple near-simultaneous
security zone violations a possible sign of an
impending coordinated attack i.e. too near, too
soon, too many Note A wolf-pack attack is a
common maritime terrorist attack tactic
comprising of a cluster of small terrorist craft
approaching and surrounding a larger target craft
from multiple directions simultaneously
30
Detection of Coordinated (Swarm/Wolf-pack) Attack
on a static HVU
Too near! Too soon! Too many!

• If two or more track have
• CPAs to a restricted location (static HVU) that
  are very close e.g. 0.1 nm, and
• TCPAs violations against the same location that
  are about to occur within a very short period of
  time e.g. 5 mins

The MAS will consider this a possible sign of an
impending coordinated attack i.e. Too near, Too
soon, Too many
31
Anatomy of a Regional Agent
32
Conceptual Blending Examples
Too much of a coincidence?
Generic Space
HVU(A) HVU(B)
(CPA(A) CPA(B)) lt CPA_DIFFERENCE_THRESHOLD
(TCPA(A) TCPA(B)) lt TCPA_DIFFERENCE_THRESHOLD
HVU (A)
HVU (B)
Identity Vital Relation
Distance Vital Relation
CPA(B)
CPA(A)
Time Vital Relation
Track B
Track A
TCPA(B)
Security Zone Violation Blend B
Security Zone Violation Blend A
TCPA(A)
Blend
Swarm Detection Blend

• Example of how a Coordinated Attack
  (Swarm/Wolf-pack) by 2 or more different tracks
  on the same HVU is detected by a Regional Agent

33
The Intent Agent

• The top layer of agents of the nested MAS
  environment inside a track agent
• Each intent agent has a corresponding intent
  model
• Four intent agents
• Friendly,
• Neutral,
• Potentially Hostile, and
• Unknown
• Intent agents use information provided by
  internal agents from the lower layers as well as
  from external regional agents

34
Anatomy of an Intent Agent
MARSEC Level (bias)
Weighting Strategy
Swarm Detection (Track)
Swarm Detection (Location)
Weighting Agents
ATBA Zone Track Activity Violation
ATBA Zone Track Type Violation
Security Zone Violation
Speed Threshold Violation
Speed Violation
TSS Heading Violation
Track Type
Track Flag
Track Origin
Track Destination
Track Comm
Track ESM
35
Competitive Intent Models

• An Intent agent is a composite agent
• Family of weighting agents is responsible for
  obtaining information
• User-defined weights (similar to Threat Level
  Change Ratings) assigned to each piece of track
  information (attributes and violations)
• The intent model in an intent agent is
  represented by a weighting strategy
• Weighting agents receive track information on
  track attributes and track violations and informs
  the weighting strategy
• Weighting strategy computes a weighted score
  using a set of user-defined weights
• The intent models will compete and the one with
  the highest score represents the current intent
  of the track

36
Weighting Biases based on Regional Intelligence

• Maritime Security (MARSEC) Levels
• Warning against unidentified potential threats
• Equivalent to HSAS
• Heightens/Lowers the alertness of the weighting
  strategies by applying biases to the computed
  weighted scores.

37
The VTS-C2 MAS System
38
Features of the VTS-C2 system

• A Java-based mock C2 (Command Control) system
• Supports geo-rectified maps, tactical overlays
  and symbol drawing, graphical and tabular
  displays of C2 information
• Shows graphics representing tracks, TSSes, and
  restricted areas
• Integrated CMAS-based (Connector-based
  Multi-agent Simulation Library) compound MAS
• Integrated Simkit-based DES (Discrete Event
  Simulation) simulator Arnold Buss, NPS
• Tracks are linear uniform movers with delays at
  waypoints
• Proximity sensors are used to report location of
  tracks

39
Capabilities of the VTS-C2 MAS

1. Ability to detect future incursions into the
   security zones of HVU (high value units)
2. Ability to detect future incursions into
   restricted areas e.g. cruise center, oil
   refineries, military installations
3. Ability to detect illegal activities in
   restricted areas e.g. fishing in non-fishing zone
4. Ability to detect TSS (traffic separation
   schemes) violations e.g. against traffic
   direction, stopping in TSS termination zones
5. Ability to detect speed violations in restricted
   areas e.g. harbor
6. Ability to detect atypical track behaviors e.g.
   excessive speed

40
Capabilities of the VTS-C2 MAS cont

• Ability to perform surface threat assessment
  based on tracks attributes e.g. platform, flag,
  origin, ESM, destination
• Ability to detect VTS (Vessel Traffic Service )
  violations e.g. collision detection,
  wrong/unknown destination, no verbal
  communication
• Ability to detect coordinated maneuvers/attacks
  e.g. swarm/wolf-pack
• Ability to incorporate regional intelligence e.g.
  MARSEC levels

41
System Architecture
Databases (Lloyds, ICA)
Pre-defined Information
Java-based VTS-C2 system
Hourly/Ad-hoc Reports (Police Coast Guards/
Military Patrols)
MARSEC Level
TSS Definitions (traffic direction, speed limits)
Anecdotal Anomalies Detection
Compound MAS
24-hour Offshore Advance Reports (International
Maritime Organisation Standard Ship Reporting
System)
MAS of MASs
Security Zone Definitions (CPA radius and alert
time)
Operational Anomalies Detection
Ship Manifests (Cargo/ Crew/ Passenger
information) (ICA)
ATBA (Area-To-Be-Avoided) Definitions (allowed
track types, allowed track activity)
Information Sources (MPA)
Track Type, Callsign, IMO Number (Lloyds
Register Number), Maritime Mobile Service Number,
ETA, Destination
Safe Speed Limits for each track type
Track Position, Speed, Heading, Destination
Automatic Identification System
Maritime Sensors (Simkit-based Discrete
Event Simulator)
Harbor Craft Transponder System
Safe Speed Limits for certain locations and zones
To be implemented
42
Pre-defined Information Settings
43
Weight and Bias Settings
44
Agent Threshold Parameters
45
Intent Scores Information
46
Validation Process

• Four validation sessions held with four groups of
  surface warfare assessment experts or naval
  officers from the Republic of Singapore Navy
  (RSN) and the US Navy
• Participants have more than 100 years of harbor
  security, patrol or at-sea experience between
  them
• Participants are first briefed on the features of
  the MAS and the mock VTS-C2 system
• Participants are next presented with several
  discrete-event simulations on scenarios involving
  the Port of Singapore and the surrounding
  waterways

47
Validation Process cont

• Each scenario features multiple surface contacts
  of different types, moving in an area that is
  populated with traffic separation schemes and
  restricted areas
• The scenarios will feature different kinds of
  hostilities that may exist but the participants
  are not told of the details in advance

48
VTS-C2 System Demo

• Validation Scenarios

Skip Scenarios
49
Sample Scenario 1(TSS violations, Impending
collision)
TSS violation (speed and heading) and an
impending collision between a leisure craft and a
cruise liner
50
Sample Scenario 2 (Coordinated attacks by
multiple tracks)
Possible coordinated attack by two fishing
vessels on SZone3
51
Sample Scenario 3 (Incursion into security zone
around HVU)
Detected incursion by fishing vessel in the
security zone around tanker
52
Validation Results

• Very encouraging responses from the participants
• good proof of concept that demonstrates how a
  decision support tool can help the decision maker
  identify potentially hostile contacts
• Officers from the RSN commented that the MAS can
  be an important decision support tool in their
  existing C2 systems

53
Validation Results cont

• Some concerns
• Although the system is able to process large
  amount of information, there may still be an
  overwhelming information glut
• Intent labels not semantically suitable according
  to operational doctrine if the MAS was to be
  integrated into an existing C2 system
• False alarms that may arise due to the heavy
  traffic conditions in the Port of Singapore
  compounded by clutter caused by non-moving
  surface contacts Need to select weights
  carefully to reduce the number of false alarms
  False alarms is better than no alarms
• System is highly dependent on accuracy and
  reliability of information sources e.g. sensors,
  humans etc.

54
Future Work To Be Done

• Need to fine-tune the MAS and verify that system
  works well against real world vessel traffic
  situations in the waters of Singapore.
• The system may be tested during maritime security
  experiments
• Further validation with objective measures of
  performance
• Type I (false negatives) and Type II (false
  positives) errors,
• Number of factors that the system can process as
  compared to a human operator,
• Time taken by the system to identify hostilities
  as compared to a human operator i.e. amount of
  lead time the system is able to provide in
  situations of hostilities

55
Future Work To Be Done cont

• Detect more unusual track maneuvers
• Many maneuvers / zig-zags
• Suspicious course changes that seem to match the
  movement of a HVU
• Monitor course/heading of tracks in more detail
  (e.g. in terms of Steady and closing/opening or
  Turn to closing/opening)
• Hiding or evading from PCG/Military Patrols
• More co-ordinated activities among tracks e.g.
  Simultaneous attacks on multiple HVUs or
  restricted areas
• Additional VTS violations
• Failure to submit Offshore Advance reports, and
• Wrong/unknown destinations
• Incorporate specific intelligence based on
• track attributes e.g. track type, origin,
  activity and
• historical data e.g. piracy reports

56
Future Work To Be Done cont

• Beyond more than just rules, it is also possible
  to have complex cognitive agents that can learn
  and adapt
• automatically learn appropriate weight settings
  to reduce false alarms, or
• automatically retire agents that are producing
  too many false alarms, or
• Automatically re-adjust security zone radii
  according to traffic conditions, or
• have the ability to forgive, over time, tracks
  for their past violations
• Act as proxies to external entity/relationship
  engines, information fusion/search engines or web
  services i.e. distributed intelligence
• Pro-active search by agents for anecdotal
  anomalies i.e. form a paper trail from
  information sources such as ship registries, sail
  plans, Offshore Advance reports, cargo/passenger
  manifests etc

57
Conclusion

• Thesis question 1 How can surface contact
  intent be modeled with a MAS for the
  identification of potentially hostile behaviors
  and potential threats in ports and waterways?
• A multi-agent system has been developed to track
  the intent of multiple surface contacts moving in
  ports and waterways.
• Four intent models have been developed based on
  VTS rules, surface warfare threat assessment cues
  and track behaviors
• Thesis question 2 Will the models be
  sufficiently realistic to be used as a decision
  aid in maritime security?
• Face validation showed that the system can be a
  useful decision support tool in the maritime
  security of Singapore