4.1.4 — Maritime Intelligence — maturity: live

Vessel Behaviour Analytics

Detecting anomalous, illicit or commercially significant vessel behaviour from AIS time-series and supporting data — meeting points, loitering, port avoidance, identity manipulation.

Once you can see every vessel, the next question is what each one is doing. Vessel behaviour analytics applies pattern recognition to AIS time-series and contextual data to flag activity that an operator should look at: a tanker meeting another tanker for hours in the middle of nowhere (likely a sanctions-evading ship-to-ship transfer); a fishing vessel loitering inside a marine protected area; a cargo ship turning off its AIS as it crosses into territorial waters; a vessel changing its declared identity mid-voyage. The category includes EMSA's STAR Automated Behaviour Monitoring service, commercial offerings from Windward, Pole Star, Lloyd's List Intelligence, Kpler and others, and increasingly large-language-model-based reasoning over multi-source vessel records.

The economic users are insurance underwriters (sanctions risk, route risk, claims fraud), commodity traders (oil-on-water inventory, freight rates), banks doing trade finance compliance, and government agencies (sanctions enforcement, customs, fisheries). For middle-power states the application is doubly valuable — it surfaces the suspicious activity their own ISR cannot cover, and it produces evidence packages that hold up in international forums.

What matters

Behaviour analytics is where AIS and SAR data convert into operational and commercial value.
EMSA's STAR ABM service is a useful operational reference — it scores vessels and routes for risk in near-real-time.
Sanctions evasion (ship-to-ship transfers, identity manipulation, port avoidance) is the highest-stakes commercial use today.
The buyers are diverse: insurers, traders, banks, governments — each wants a slightly different cut of the same data.

Sovereignty score: 7/10 — Important — but the analytics layer is partially substitutable.

The data sources (AIS, SAR) and the fundamental algorithms are increasingly commodity.
Where sovereignty matters most is in which behaviours get flagged for the host country's authorities. A foreign vendor's flagging logic reflects its own clients' interests.
Recommended pattern: foreign data, sovereign analytics layer, integrated into the national MDA platform of §4.1.3.

Reference architecture

Payload: None — pure software / analytics layer.
Bus class: N/A.
Orbit: N/A.
Ground segment: Cloud deployment (sovereign cloud preferred for sensitive flagging logic).
Software & data
Latency
Cost band
Lead time

References

EMSA — Integrated Maritime Services (includes STAR Automated Behaviour Monitoring) — the EU operational reference for behaviour-anomaly detection over AIS.
Global Fishing Watch — Technology overview — open-source models for fishing-vs-non-fishing classification from movement patterns.