GNSS spoofing anomaly detection for vessel position integrity
AIS-broadcast positions can be fabricated or spoofed at the transmitter. Cross-referencing them against SAR detections, spaceborne AIS, and GNSS-RO data exposes discrepancies that self-reported transponders cannot hide.
Sensors
- Sentinel-1 SAR (ESA Copernicus): C-band SAR at 5.405 GHz. Interferometric Wide Swath mode delivers 250 km swath at 5×20 m ground resolution. Revisit is 6 days at the equator, 1–3 days at higher latitudes with both satellites. Detects vessel hull position independently of any transponder, providing the ground-truth coordinate against which AIS claims are tested.
- Spire Global spaceborne AIS: A constellation of more than 100 LEO cubesats receiving VHF AIS messages (161.975 MHz and 162.025 MHz) from vessels globally. Revisit is sub-hourly in most ocean basins. Captures the self-reported MMSI, position, speed and heading that a spoofing vessel transmits, forming one side of the discrepancy comparison.
- Spire Global GNSS Radio Occultation: The same Spire constellation carries GNSS-RO receivers that can detect anomalous signal propagation consistent with deliberate GPS signal injection near coastlines. Not a direct vessel tracker, but an independent witness to RF environment conditions that correlate with known spoofing clusters.
- HawkEye 360 RF geolocation: A cluster-flying LEO constellation that geolocates RF emissions using time-difference-of-arrival and frequency-difference-of-arrival across satellite pairs. Revisit is several times daily over most ocean areas. Can detect AIS transmitters and correlate their geolocated RF origin with the position the AIS message itself claims, flagging mismatches directly.
- Sentinel-1 Vessel Detection (CSAR-based): ESA's Maritime Safety Information service and the Copernicus Marine Service both run operational vessel detection on Sentinel-1 imagery. Minimum detectable vessel length is approximately 30–50 m in standard processing, with smaller targets detectable in calm sea states. Archive extends to 2014, allowing retrospective spoofing pattern analysis.
What spoofing actually looks like in the data
GNSS spoofing involves broadcasting a false GPS signal strong enough to override the genuine constellation signal received by a vessel's navigation system. The ship's own instruments then report a fabricated position, which the AIS transponder dutifully re-broadcasts. From a shore-based AIS receiver or a naive data aggregator, the vessel appears to be somewhere it is not. Clusters of vessels apparently circling airports, drifting inland, or sitting stationary inside a port whilst SAR imagery shows open water have all been documented in open literature, particularly around the Black Sea, the Persian Gulf approaches, and Chinese ports near sanctioned terminals.
The discrepancy becomes visible the moment you introduce an independent position estimate. SAR does not care what a vessel's transponder says. It illuminates the ocean surface with microwave pulses and records the backscatter. A 200-metre tanker hull produces a distinctive high-backscatter signature that can be geolocated to within tens of metres in Sentinel-1 Interferometric Wide Swath imagery. If that SAR-derived position differs from the contemporaneous AIS-broadcast position by more than the combined geolocation uncertainty of both systems (typically a few hundred metres for well-processed Sentinel-1 data), the discrepancy is real and requires explanation.
Three independent witnesses, one verdict
The cross-validation architecture rests on treating each data source as an independent witness with its own error budget. Spaceborne AIS from Spire captures the claimed position. Sentinel-1 SAR captures the physical position. HawkEye 360 RF geolocation captures where the AIS transmitter's radio signal actually originated in space. When all three disagree with the AIS claim in the same direction, the case for deliberate manipulation is strong. When only SAR disagrees, the explanation might be timing: SAR acquisitions are not instantaneous, and a vessel moving at 15 knots travels roughly 450 metres in two minutes, so temporal offsets between AIS ping and SAR pass must be corrected before a discrepancy is declared.
GNSS-RO data from Spire adds a fourth layer. It does not directly track vessels, but it can characterise the RF environment in a region. Anomalous signal conditions consistent with high-power spoofing transmitters have been studied in academic literature for the Black Sea region. Correlating those RF environment anomalies with the timing and geography of AIS position clusters strengthens attribution: it shifts the hypothesis from 'this vessel's GPS receiver malfunctioned' to 'this region had an active spoofing environment at the time'.
Where the method reaches its limits
Sentinel-1 revisit is the binding constraint for near-real-time applications. At the equator, a given location may be imaged only once every six days. Vessels transiting sanctioned waters can complete a rendezvous and depart long before the next SAR pass. Tasking commercial SAR constellations (ICEYE, Capella, Umbra) closes that gap to hours, but at cost and with coverage prioritisation decisions that require prior intelligence to make well.
Optical imagery is largely useless here. Cloud cover is frequent over key spoofing regions, and optical sensors cannot see through it. SAR can, which is precisely why it is the anchor sensor for this use case. Small vessels below roughly 30 metres are also at the edge of reliable Sentinel-1 detection in moderate sea states; spoofing by fishing vessels or small coasters may go undetected by SAR alone. HawkEye 360 RF geolocation has a positional accuracy of approximately 1–3 km in published figures, which is sufficient to flag gross AIS position fraud but not to resolve ambiguity between vessels anchored close together.
Sanctioned ports and the geography of deception
Open-source researchers at organisations including SkyTruth and C4ADS have documented specific spoofing clusters. Iranian ports under sanctions, Russian Black Sea ports following 2022, and certain Chinese coastal terminals have all appeared in published analyses as locations where AIS tracks show vessels in physically impossible positions or executing implausible manoeuvres. The common pattern is a vessel that needs to obscure a port call: it broadcasts a position in open water whilst physically alongside a berth, or it broadcasts a slow transit whilst actually stationary.
The spatial signature of a spoofing cluster is itself informative. When dozens of vessels simultaneously report positions at the same fictitious coordinate (a phenomenon observed near Shanghai Pudong airport in 2019 and documented by the MIT Media Lab), the spoofing transmitter's location can sometimes be reverse-engineered from the geometry of the false positions. That transmitter location is operationally significant intelligence in its own right, independent of identifying any individual vessel.
Building a position-integrity score
The analytic output of this workflow is a per-vessel position-integrity score, updated each time new SAR, RF, or spaceborne AIS data is ingested. A vessel accumulates negative score weight each time its AIS-reported position cannot be reconciled with its SAR-detected position within the expected uncertainty envelope, or each time its RF-geolocated transmitter origin diverges from its claimed coordinates. Repeated incidents, or incidents near known sanctioned terminals, trigger a high-confidence flag.
Satellize structures this kind of multi-source cross-validation into persistent monitoring feeds for government maritime intelligence clients. The methodology is the same class of geospatial fusion used in the Copernicus Maritime Surveillance service, applied with additional commercial RF and SAR layers. Analysts reviewing the output receive a timestamped evidence package per flagged vessel: the SAR chip, the AIS track, the RF geolocation result, and the computed offset in nautical miles. That package is designed to survive legal and diplomatic scrutiny, not merely to trigger an alert.
What a buyer should ask before commissioning this analysis
The most important question is coverage priority. Global persistent SAR coverage at daily revisit does not exist on open constellations alone. A client needs to define the geographic areas of interest so that commercial SAR tasking can be layered in where Sentinel-1 cadence is insufficient. The second question is threshold calibration: what offset, in nautical miles, constitutes a reportable discrepancy for your use case? A sanctions-enforcement client may want a lower threshold than an insurance underwriter, accepting more false positives in exchange for fewer missed events.
Archive depth matters for pattern-of-life analysis. Sentinel-1 data runs back to 2014. HawkEye 360 commercial archive availability varies by region and contract. Spire AIS archive is commercially licensed. A retrospective investigation into a vessel's historical behaviour across multiple port calls requires negotiating access to those archives before the analysis begins, not after.
Typical figures
| SAR spatial resolution (Sentinel-1 IW mode) | 5 × 20 m (range × azimuth); approximately 10 m after multi-look processing |
| SAR revisit (Sentinel-1, equatorial) | 6 days single satellite; 3 days with Sentinel-1A and 1C combined |
| SAR revisit (higher latitudes, >50°) | 1–2 days, increasing overlap of ascending and descending passes |
| Spaceborne AIS revisit | Sub-hourly in most ocean basins with Spire 100+ satellite constellation |
| HawkEye 360 RF geolocation accuracy | Approximately 1–3 km CEP (published figures); sufficient to flag gross position fraud |
| Minimum detectable vessel (Sentinel-1 SAR) | ~30–50 m length in standard processing; smaller in calm sea states |
| AIS frequency bands monitored | VHF 161.975 MHz and 162.025 MHz (ITU-designated AIS channels) |
| Sentinel-1 SAR archive depth | From April 2014 (Sentinel-1A launch); enables retrospective pattern analysis |
| Position discrepancy threshold (typical reportable) | Greater than 0.5 nautical miles after correcting for AIS-SAR timing offset; client-configurable |
| Delivery latency (SAR-based flag) | 2–6 hours after SAR acquisition for operational processing pipelines |
Analytics Satellize can run
| Per-vessel position-integrity score | Geospatial offset computation between SAR-detected hull centroid and contemporaneous AIS-reported position, with timing correction for vessel speed | Scored vessel watchlist, updated per SAR pass; GIS layer and JSON feed |
| Spoofing cluster map | Density clustering (DBSCAN or similar) of AIS positions that are physically inconsistent with SAR detections in the same area and time window | Polygon shapefile of active spoofing zones with timestamp and confidence rating; monthly PDF report |
| RF transmitter origin vs AIS claim discrepancy alert | TDOA/FDOA geolocation of AIS VHF transmitter via HawkEye 360, compared against the position embedded in the AIS message payload | Per-event alert with transmitter origin coordinate, claimed coordinate, and offset distance; delivered via API webhook |
| Sanctioned port call evidence package | Fusion of SAR chip showing vessel at berth, AIS track showing claimed open-water position, and RF geolocation corroborating physical berth location | Timestamped PDF evidence dossier per vessel per incident, structured for compliance or legal review |
| Historical spoofing pattern-of-life | Retrospective analysis across Sentinel-1 archive (2014–present) and licensed AIS archive to identify repeat offenders and route reconstruction | Vessel history report with timeline of flagged incidents, port call reconstruction, and flag-state summary |
| GNSS environment anomaly correlation | Overlay of Spire GNSS-RO signal quality metrics against AIS cluster geography and timing to assess whether regional spoofing transmitters explain observed position anomalies | Regional RF environment assessment note; updated when GNSS-RO data shows anomalous conditions in priority areas |
Who does the work
We can get this done for you. Satellize runs its own analyst desk and a strong science team. You do not buy a data feed and work out what it means; our people source the imagery, run the analysis described on this page, and hand you the answer with its confidence limits stated. Discuss this requirement.