A Multi-Agent System for Tracking the Intent of Surface Contacts in Ports and Waterways

1. A Multi-Agent System for TrackingtheIntent of Surface Contacts in Ports and Waterways Tan, Kok Soon Oliver Project Manager C4IT-IKC2 DSTA tkoksoon@dsta.gov.sg

2. Agenda • Introduction • Concepts • Multi-agent System Design • System Validation Scenarios • Recommendations and Conclusion

3. Introduction • A thesis on modeling the intent of surface contacts with a multi-agent system (MAS) for asymmetric threat identification in busy ports and waterways • Inspired by similar work done in the area of air threat assessment in Air Defense Laboratory (ADL) [Ozkan 2004, NPS]

4. Thesis Questions • How can surface contact intent be modeled with a MAS for the identification of potentially hostile behaviors and threats in ports and waterways? • Will the models be sufficiently realistic to be used as a decision aid in maritime security?

5. Why a MAS? A multi-agent model is a distributed intelligence model that is a “natural” solution of a large-scale real-world problem1 • The real world problem is physically distributed • Every surface contact is an autonomous entity that we are interested in knowing its probable intentions; • The knowledge to solving the real world problem is widely distributed and heterogeneous • No one agent or system is "knowledgeable" enough to trawl and mine databases, process real-time sensor data, monitor for rule violations or suspicious behaviours etc; • The sources of data are distributed over networks • Naturally this encourages us to take a distributed view of a solution for the real world problem; and • The real world problem is too complex to be analysed as a whole • There are too many parameters and constraints to be considered altogether. Local approaches, partitioning the large problem into smaller and more tractable sub-problems, can produce results quickly. 1. Ferber, J., Multi-Agent Systems An Introduction to Distributed Artificial Intelligence, Addison-Wesley, 1999.

6. MAS Objectives A multi-agent system (MAS) • To help the human operator sieve through hundreds of surface contacts • To integrate intelligence and information from as many sources as possible • To highlight any suspicious or potentially hostile surface contacts

7. Requirements of the MAS • Support rules and regulations of a Vessel Traffic Service (VTS) such as: • Traffic Separation Scheme (TSS), part of the International Navigation Rules defined by the International Maritime Organization • the 1972 Collision Regulations (72 COLREGS) • International Ships and Port Facilities Security (ISPS) Code (To be implemented) • all other practices of safe navigation and prudent seamanship • Predefined safe speed limits in TSS • Safe speed limits for different surface track types

8. Requirements of the MAS cont… • Use Surface Warfare Threat Assessment cues and corresponding perception of threat [Liebhaber 2002, SPAWAR Systems Center, San Diego] • Obtained through empiricaland observational studies of the threat assessment process by experienced surface warfare officers • Each cue has a Threat Level Change Rating (TCR) that changes the threat level posed by a surface contact

9. Requirements of the MAS cont… • Use information from ship-borne • Automatic Identification system (AIS) • Transponder for large vessels (>300gt) • International Maritime Organization (IMO) recommendation • Harbor Craft Transpondersystem (HARTS) • For smaller vessels • Applies to the Port of Singapore only

10. Thesis Scope • Identify and track the intent of surface contacts • Borrowing the ideas and techniques suggested for identifying air threats in the Air Defense Laboratory (ADL) and use them to identify asymmetric maritime threats • The thesis does not cover the issue of track detection i.e. assumes perfect instantaneous detection with 100% reliability • The issue of interdiction when a potentially hostile track has been identified is also beyond the scope of this thesis

11. Some Concepts • Traffic Separation Scheme (TSS) • Security Zones for HVUs • Security Zones for Restricted Areas • Areas-To-Be-Avoided (ATBA) • Safe Speed Limits Skip Concepts

12. Traffic Separation Scheme (TSS) • A TSS is a sea lane with a predefined traffic direction • A TSS may also has a predefined safe speed (for prudent seamanship) • A violation occurs when a track is traveling against traffic direction or is traveling at an excessive speed

13. Radius = 0.2nm, Alert Time = 15min Radius = 0.5nm, Alert Time = 10min Radius = 0.8nm, Alert Time = 5min Security Zones for HVUs • Every High Value Unit (e.g. cruise liner, tanker) have their own predefined multiple security zones • Only some type of tracks (e.g. Police Coast Guards) are allowed within these security zones • Each security zone is defined with an alert time threshold (represents a measure of urgency when these zones have been infringed)

14. Security Zone Violation Example • A security zone violation occurs i.e. a track is coming in too near,too soon,if an unauthorized track has • a CPA (Closest Point of Approach) within a zone, and • a TCPA (Time to CPA) below alert time threshold “Too near! Too soon!” CPA TCPA = 3min Radius = 0.2nm, Alert Time = 15min Radius = 0.5nm, Alert Time = 10min Radius = 0.8nm, Alert Time = 5min

15. Security Zones for Restricted Areas (Static HVUs) • Restricted areas (e.g. harbor, oil refineries, military installations) can have their own predefined multiple security zones • Only some type of tracks (e.g. Police Coast Guards) are allowed within security zones • Each security zone is defined with an alert time threshold Radius = 0.2nm, Alert Time = 15min Radius = 0.5nm, Alert Time = 10min Radius = 0.8nm, Alert Time = 5min

16. Areas-To-Be-Avoided (ATBA) • Restricted areas (e.g. harbor, oil refineries, military installations) • Only allow certain types of tracks (e.g. Police Coast Guards) or certain types of track activity within these areas • An ATBA violation occurs when an unauthorized track intrudes into a restricted area

17. Safe Speed Limits • Some locations or restricted areas (e.g. harbor) may only allow tracks to travel at predefined speed limits • Speed limits can be defined for different track types • A violation occurs when a track exceeds any of these speed limits

18. The Compound Multi-agent System • A compound multi-agent system (MAS) designed for surface contact intent tracking • Each surface contact is represented by a track agent • Every track agent has a nested MAS (“Russian Doll”)

19. Anatomy of a Track Agent Friendly Intent Agent Neutral Intent Agent Potentially Hostile Intent Agent Unknown Intent Agent Composite Agents ATBA Zone Track Activity Violation Blend ATBA Zone Track Type Violation Blend Security Zone Violation Blends Speed Threshold Violation Blend Speed Violation Blend TSS Heading Violation Blend Security Zone Violation Blends Cognitive Agents Speed Violation Agent Location Agent TSS Heading Violation Agent Area-To-Be-Avoided (ATBA) Violation Agent Speed Threshold Violation Agent Security Zone Violation Agent Reactive Agents Track Flag Data Ticket Track Origin Data Ticket Track Destination Data Ticket Track ESM Data Ticket Track Type Data Ticket Track Position Data Ticket Track Activity Data Ticket Track Comm Data Ticket Track Heading Data Ticket Track Speed Data Ticket

20. The Compound Multi-agent System cont… • Agents in the nested MASs continuously process incoming information about their respective surface contacts • Agents communicate and co-ordinate in order to discover the likely intent of surface contacts

21. Conceptual Blending • Conceptual Blending1 is a theory about how humans process the information coming from the environment and how humans rationalize the events happening around them • Blending is a set of mental operations for combining cognitive models in a network of mental spaces • Mental spaces are small conceptual packets 1. Gilles, F., Turner, M., The Way We Think, Basic Books, New York, 2002

22. Conceptual Blending cont… • Mental spaces are connected to long-term schematic knowledge called “frames” e.g. • The frame of sailing along a ferry route, or • The frame of traveling inside a maritime traffic separation scheme (TSS), • Long-term specific knowledge such as a memory of an event such as past track incursions into Area-To-Be-Avoided (ATBA) zones. • Mental spaces are interconnected in working memory which can be modified dynamically

23. Conceptual Blending cont… • Building a conceptual integration network involves setting up several mental spaces. • Two input mental spaces with cross-space mapping to connect counterparts in these input mental spaces • However not all elements and relations from the input spaces are projected into the blend. • Generic spaces are used for the generic structures they contain to guide the selective projection of elements from the input spaces into blended spaces • The blended space is the mental space where, during blending, the structure from the input mental spaces is projected onto, represented by the dotted lines Generic Space A Basic Conceptual Integration Network Input Space 1 Input Space 2 Blend

24. Conceptual Blending cont… • Any mental space can participate in multiple networks. • Complex integration networks can be built with arrays of mental spaces that are connected through blending operations.

25. Conceptual Blending Examples • Example of how a Security Zone violation is detected Generic Space CPA < Security Zone Radius TCPA < Security Zone Alert Time Track Type ≠ Allowed Track Types Track Type Allowed Track Types Identity Vital Relation Distance Vital Relation Security Zone Radius Track CPA (Closest Point of Approach) Time Vital Relation Security Zone Alert Time High Value Unit Track TCPA (Time to CPA) Track Blend Security Zone Violation

26. Conceptual Blending Examples • Example of how a ATBA Zone Track Activity violation is detected Generic Space Track Activity ≠ Allowed Activity Type Track Location = Zone Name Track Activity Allowed Activity Type Activity Vital Relation Activity Vital Relation Track Location Location Vital Relation Zone Name ATBA Zone Track Blend ATBA Zone Track Activity Violation

27. The CMAS Library • The communication and coordination among many different agents in the nested MAS is achieved using the Connector-based Multi-agent Simulation Library (CMAS) [John Hiles, NPS] • The basic elements for agent communication and control within the CMAS framework are connectors. • The agents use these connectors to externalize portions of their internal states into the multi-agent environment. • Connectors are like plugs and receptacles that can be extended or retracted • Signaling and coordination between the two agents occur when there are matching pairs of plug-receptacle connectors and the connectors get connected • Stimergy (communication through change of local environment) among agents Agent 2 Extended response connector (Receptacle) Plug-Receptacle match Extended stimulus connector (Plug) Agent 1 Retracted connector

28. A MAS of MASs (“Russian Doll”) • A track agent appears as a single agent that exists in another external MAS environment • In this external MAS environment, there is a layer of regional agents that monitor behaviors of all track agents • Two types of regional agents detect coordinatedbehavior that resembles an impending swarm or a “wolf-pack attack

29. Detection of Coordinated (Swarm/ “Wolf-pack”) Attack on a moving HVU “Too near!Too soon! Too many!” • If two or more track have • CPAs to a HVU (High Value Unit) that are very close e.g. 0.1 nm, and • TCPAs violations against the same HVU that are about to occur within a veryshort period of time e.g. 5 mins The MAS will consider multiple near-simultaneous security zone violations a possible sign of an impending coordinated attack i.e. too near, too soon, too many Note: A “wolf-pack” attack is a common maritime terrorist attack tactic comprising of a cluster of small terrorist craft approaching and surrounding a larger target craft from multiple directions simultaneously

30. Detection of Coordinated (Swarm/Wolf-pack) Attack on a static HVU “Too near!Too soon! Too many!” • If two or more track have • CPAs to a restricted location (static HVU) that are very close e.g. 0.1 nm, and • TCPAs violations against the same location that are about to occur within a very short period of time e.g. 5 mins The MAS will consider this a possible sign of an impending coordinated attack i.e. Too near, Too soon, Too many

31. Regional Agent 2 Regional Agent 1 Cognitive Agents Swarm Detection (Track) Agent Swarm Detection (Track) Blend Swarm Detection (Location) Agent Swarm Detection (Location) Blend Track Agent 1 Track Agent 2 Swarm Detection (Location) Weighting Agent Swarm Detection (Location) Weighting Agent Swarm Detection (Track) Weighting Agent Swarm Detection (Track) Weighting Agent Security Zone (Location) Violation Blend Security Zone (Track) Violation Blend Security Zone (Location) Violation Blend Security Zone (Track) Violation Blend Anatomy of a Regional Agent

32. Conceptual Blending Examples • Example of how a Coordinated Attack (Swarm/Wolf-pack) by 2 or more different tracks on the same HVU is detected by a Regional Agent Too much of a coincidence? Generic Space HVU(A) == HVU(B) (CPA(A) – CPA(B)) < CPA_DIFFERENCE_THRESHOLD (TCPA(A) – TCPA(B)) < TCPA_DIFFERENCE_THRESHOLD HVU (A) HVU (B) Identity Vital Relation Distance Vital Relation CPA(B) CPA(A) Time Vital Relation Track B Track A TCPA(B) Security Zone Violation Blend B Security Zone Violation Blend A TCPA(A) Blend Swarm Detection Blend

33. The Intent Agent • The top layer of agents of the nested MAS environment inside a track agent • Each intent agent has a corresponding intent model • Four intent agents: • Friendly, • Neutral, • Potentially Hostile, and • Unknown • Intent agents use information provided by internalagents from the lower layers as well as from externalregional agents

34. Anatomy of an Intent Agent MARSEC Level (bias) Weighting Strategy Swarm Detection (Location) Swarm Detection (Track) Weighting Agents ATBA Zone Track Activity Violation ATBA Zone Track Type Violation Security Zone Violation Speed Threshold Violation Speed Violation TSS Heading Violation Track Type Track Flag Track Origin Track Destination Track ESM Track Comm

35. Competitive Intent Models • An Intent agent is a composite agent • Family of weighting agents is responsible for obtaining information • User-defined weights (similar to Threat Level Change Ratings) assigned to each piece of track information (attributes and violations) • The intent model in an intent agent is represented by a weighting strategy • Weighting agents receive track information on track attributes and track violations and informs the weighting strategy • Weighting strategy computes a weighted score using a set of user-defined weights • The intent models will compete and the one with the highest score represents the current intent of the track

36. Weighting Biases based on Regional Intelligence • Maritime Security (MARSEC) Levels • Warning against unidentified potential threats • Equivalent to HSAS • Heightens/Lowers the “alertness” of the weighting strategies by applying biases to the computed weighted scores.

37. The VTS-C2 MAS System

38. Features of the VTS-C2 system • A Java-based mock C2 (Command & Control) system • Supports geo-rectified maps, tactical overlays and symbol drawing, graphical and tabular displays of C2 information • Shows graphics representing tracks, TSSes, and restricted areas • Integrated CMAS-based (Connector-based Multi-agent Simulation Library) compoundMAS • Integrated Simkit-based DES (Discrete Event Simulation) simulator [Arnold Buss, NPS] • Tracks are linear uniform movers with delays at waypoints • Proximity sensors are used to report location of tracks

39. Capabilities of the VTS-C2 MAS • Ability to detect future incursions into the security zones of HVU (high value units) • Ability to detect future incursions into restricted areas e.g. cruise center, oil refineries, military installations • Ability to detect illegal activities in restricted areas e.g. fishing in non-fishing zone • Ability to detect TSS (traffic separation schemes) violations e.g. against traffic direction, stopping in TSS termination zones • Ability to detect speed violations in restricted areas e.g. harbor • Ability to detect atypical track behaviors e.g. excessive speed

40. Capabilities of the VTS-C2 MAS cont… • Ability to perform surface threat assessment based on tracks’ attributes e.g. platform, flag, origin, ESM, destination • Ability to detect VTS (Vessel Traffic Service ) violations e.g. collision detection, wrong/unknown destination, no verbal communication • Ability to detect coordinated maneuvers/attacks e.g. swarm/”wolf-pack” • Ability to incorporate regional intelligence e.g. MARSEC levels

41. System Architecture Databases (Lloyds, ICA) Pre-defined Information Java-based VTS-C2 system Hourly/Ad-hoc Reports (Police Coast Guards/ Military Patrols) MARSEC Level TSS Definitions (traffic direction, speed limits) Anecdotal Anomalies Detection CompoundMAS 24-hour Offshore Advance Reports (International Maritime Organisation Standard Ship Reporting System) MAS of MASs Security Zone Definitions (CPA radius and alert time) Operational Anomalies Detection Ship Manifests (Cargo/ Crew/ Passenger information) (ICA) ATBA (Area-To-Be-Avoided) Definitions (allowed track types, allowed track activity) Information Sources (MPA) Track Type, Callsign, IMO Number (Lloyd’s Register Number), Maritime Mobile Service Number, ETA, Destination Safe Speed Limits for each track type Automatic Identification System Track Position, Speed, Heading, Destination Maritime Sensors (Simkit-based Discrete Event Simulator) Harbor Craft Transponder System Safe Speed Limits for certain locations and zones To be implemented

42. Pre-defined Information Settings

43. Weight and Bias Settings

44. Agent Threshold Parameters

45. Intent Scores Information

46. Validation Process • Four validation sessions held with four groups of surface warfare assessment experts or naval officers from the Republic of Singapore Navy (RSN) and the US Navy • Participants have more than 100 years of harbor security, patrol or at-sea experience between them • Participants are first briefed on the features of the MAS and the mock VTS-C2 system • Participants are next presented with several discrete-event simulations on scenarios involving the Port of Singapore and the surrounding waterways

47. Validation Process cont… • Each scenario features multiple surface contacts of different types, moving in an area that is populated with traffic separation schemes and restricted areas • The scenarios will feature different kinds of hostilities that may exist but the participants are not told of the details in advance

48. VTS-C2 System Demo Validation Scenarios Skip Scenarios

49. Sample Scenario 1(TSS violations, Impending collision) TSS violation (speed and heading) and an impending collision between a leisure craft and a cruise liner

50. Sample Scenario 2(Coordinated attacks by multiple tracks) Possible coordinated attack by two fishing vessels on SZone3