Estimating vessel intent

A non-transitory computer-readable storage medium storing instructions that, when executed by a processor, cause the processor to perform operations comprising:

• receiving maritime vessel automatic identification system (AIS) data from a vessel;
• determining that the maritime vessel AIS data includes anomalous data;
• estimating a first likelihood of malicious vessel intent based on a comparison of the anomalous data to first data;
• estimating a second likelihood that the anomalous data is associated with a typographical error;
• in response to the first likelihood of malicious vessel intent satisfying a threshold and in response to the second likelihood indicating that the anomalous data does not correspond to a typographical error, generating an alert that includes an indication of an inferred intent of the vessel;
• estimating a third likelihood of malicious vessel intent based on a comparison of the anomalous data to second data;
• and
• in response to the third likelihood of malicious vessel intent satisfying a second threshold and in response to the second likelihood indicating that the anomalous data does not correspond to the typographical error, generating a second alert that includes a second indication of a second inferred intent for the vessel, wherein the threshold is distinct from the second threshold.

A system comprising:

• a processor;
• a memory in communication with the processor, the memory including instructions . executable by the processor to perform operations including:
• receiving maritime vessel automatic identification system (AIS) data from a vessel;
• determining that the maritime vessel AIS data includes anomalous data;
• estimating a likelihood of malicious vessel intent based on a comparison of the anomalous data to first data;
• estimating a second likelihood that the anomalous data is associated with a typographical error by comparing an anomalous identifying parameter of the anomalous data to an expected identifying parameter to generate a matching percentage, and wherein the anomalous data corresponds to the typographical error responsive to the matching percentage failing to satisfy a threshold percentage of matching between the anomalous identifying parameter and the expected identifying parameter;
• and
• in response to the likelihood of malicious vessel intent satisfying a threshold and in response to the second likelihood indicating that the anomalous data does not correspond to a typographical error, generating an alert that includes an indication of an inferred intent for the vessel.