The self-organizing map (SOM) is a neural network-based method that is trained in an unsupervised way using a competitive learning (Kurasova and Molytė, 2011; Dzemyda et al., 2012). A distinctive characteristic of this type of neural networks is that they can be used for both visualization and clustering of multidimensional data. The most important property of SOM can be utilized for many tasks, such as reduction of the amount of data, speeding up of learning nonlinear interpolation and extrapolation, generalization, and efficient compression of information (Kohonen et al., 1996). SOM is one of the most analysed neural networks, that is learned in an unsupervised manner. In our case, SOM represents a set of neurons, connected to one another via a rectangular topology. The rectangular SOM is a two-dimensional array of neurons W = w i j , i = 1 , … , k , j = 1 , … , s. Here k is the number of rows, and s is the number of columns. Each element of the input observation vector is connected to every individual neuron in the rectangular structure. Any neuron is entirely defined by its location on the grid by its specific index at the row i and the column j, and by its weight (so-called code book) vector. After SOM training, the data are presented to SOM and the winning neuron for each data vector are found. The winning neuron is the one to which the Euclidean distance of the input data vector is the shortest. In such a way, the data vectors are distributed on SOM, and some data clusters can be observed.

The results of a SOM map depend on the selected learning parameters. Learning rates and neighbourhood functions h i j are the necessary parameters that influence the results. The neighbourhood function determines how strongly the neurons are connected to each other and influences the training result of SOM. Therefore, it is important to choose the proper neighbourhood function. There are different kinds of neighbourhood functions: bubble, Gaussian, Cut Gaussian (Vesanto et al., 2000; Liu et al., 2006), heuristic (Dzemyda, 2001), Mexican hat (Kohonen, 1982), triangular (Kohonen, 1982), rectangular (Kohonen, 1982) and others. In this research, we have compared five neighbourhood functions: Gaussian, triangular, cut Gaussian, bubble, Mexican hat and its influence on the classification results obtained by the modified SOM method. These functions are presented in Table 1, where d i j is a distance between the current observation vector and the winning neuron, η i j is the neighbourhood radius, F is a step function: F ( x ) = 0, if x < 0 and F ( x ) = 1, if x ⩾ 0.

As mentioned before, the learning rate also influences the results of SOM. Usually, linear, inverse-of-time, and power series learning rates are used for the SOM training (Stefanovic and Kurasova, 2014, 2011). In this research, the learning rate is constant and equal to 0.5, both the initial neighbourhood radius and the radius decay parameter are set to − 0.1.

The application areas of SOM are data clustering and graphical result presentation. To use the gathered knowledge about clusters and with a view to classify observations, we exploit the biologically-inspired notion of a virtual pheromone. The idea is based on the observations of ant colonies. To mark the way to the food source, the ants use a chemical substance called pheromone. Other ants follow the pheromone trail to reach the discovered food source. Pheromone evaporates in time, and the trail on the road slowly disappears. The ants must continually travel by the same route to strengthen the evaporating pheromone trail.

In the proposed approach, the training process of a modified SOM method is the same as the original one except that the virtual pheromone intensity value is introduced in the last epoch. The epoch of the SOM network is completed when all possible pairs of vectors from the training data set are shown to SOM. Further, taking into account the number of vectors that were assigned to the same cluster, it can be calculated how this cluster represents a majority. To count the number of vectors in the cluster, it is necessary to assign the vectors from the training data set to winning neurons.

In the beginning, each winning neuron has its pheromone value intensity of which is equal to the cluster size of this neuron. The value of a pheromone mark Q is calculated as follows: when the winning neuron is selected, the pheromone intensity is increased by one, i.e. the pheromone mark is attached to the neuron. Thus, the more observation vectors are assigned to the same winning neuron, the higher its virtual pheromone intensity is.

In order to adjust the pheromone evaporation procedure, after each SOM network re-training, the virtual pheromone intensity value τ i j is updated according to the formula (Yingying et al., 2003; Venskus et al., 2015): (1) τ i j ( t 2 ) = ( 1 − ρ ) · τ i j ( t 1 ) + Q i j , where τ i j is a virtual pheromone intensity; t 1 is the previous state of the virtual pheromone intensity; t 2 is the recent state of the virtual pheromone intensity. The parameter ρ represents a virtual pheromone intensity evaporation speed ( 0 < ρ < 1). In the formula, similarly to the ant colony system, the pheromone trail will evaporate unless it is renewed within a particular time. The intensity evaporation is slower than its renewal process.

The pheromone intensity threshold used for abnormal movement detection is calculated using the validation data set. The precision and sensitivity of the algorithm can be adjusted by changing the threshold value. To adjust the threshold, the classification error cost function has been optimized according to: (2) J ( Θ ) = − β PPV log ( PPV Θ ) − β TPR log ( TPR Θ ) , (3) PPV Θ = TP Θ TP Θ + FP Θ , (4) TPR Θ = TP Θ TP Θ + FN Θ . Here J ( Θ ) is a classification error rate by choosing Θ as a threshold value; PPV Θ is a classification precision; TPR Θ is a classification sensitivity; β PPV and β TPR are the influence of classification parameters on the classification error cost function; TP Θ is the count of true positive (assigned to an abnormal state) observations; FP Θ is a false positive (assigned to a false abnormal state); TN Θ is a true negative (assigned to a normal state); FN Θ is a false negative (assigned to a false normal state). The gradient descent method has been used to find a local minimum of the function depicted by equation (2).

When it is necessary to obtain a new observation state, the vector representing this state is assigned to a winning neuron of the SOM network. Thus, a winning neuron should be found for each new observation, and the classification is performed according to its pheromone value. The marine traffic observation is classified as normal if the pheromone value is greater than the threshold value, or abnormal if less.

As mentioned before, the combination of a self-organizing map and a virtual pheromone is proposed to classify events for abnormal movement detection in maritime traffic. It is important to identify whether the observation data show the abnormal vessel behaviour and to react accordingly. Therefore, creating and testing the algorithm, the trained SOM neural network is transferred to a system where it classifies real time data, based on the existing network settings without additional re-training. However, as the amount of new data increases, in order to ensure a high classification accuracy, there is a necessity to re-train the network periodically. The re-training process of the neural network is run by adding new observation data to the training set.

A general scheme of the proposed algorithm (SOM_Pheromone) is presented in Fig. 1. Its implementation steps are described as follows:

A comparison of the obtained results of the proposed algorithm with other similar methods has been carried out. Another SOM-based algorithm for abnormal movement detection in marine traffic is presented in Riveiro (2011), Riveiro et al. (2008a). This anomaly detection method (SOM_GMM) is a combination of SOM and Gaussian Mixture Models (GMM). The implementation steps of the algorithm is as follows:

In Riveiro (2011), a division of the anomaly detection process into on-line and off-line subprocesses has been proposed. The on-line data processing refers to the analysis of incoming data in real-time, the off-line processing relates to the establishment of normal models from the training data and rules used during the on-line detection process. The method, presented in Riveiro (2011), Riveiro et al. (2008b), is based on two assumptions: unusual events have to be sufficiently different from the normal events in order to be detectable; the training set should be free from unusual events. The same assumptions and conditions were met while carrying out the experiments described in Section 4.

Data from the region of medium maritime traffic at the Klaipeda seaport were selected for a comparative algorithm analysis. Marine traffic data were taken from the marine traffic monitoring system (AIS) which provides multidimensional vessel movement data (see Table 3). Meteorological data for the relevant time period were provided by the Lithuanian meteorological service. Three data sets were used for the experiments: Cargo Vessels, Passenger vessels, Tugs and Pilot vessels (see Table 2).

Data sources:

Data set limitations:

Data set splitting:

The modified SOM network was trained, using different neighbourhood functions in order to establish which has the best impact on the classification results. The experiments have been performed with the Cargo Vessels data set, using the following learning parameters for the SOM network training: a shape of the grid is square; grid dimension is 20 × 20. The experimental results, presented in Table 4, show that using the Mexican hat neighbourhood function the best classification accuracy is obtained (marked in bold in Table 4). The results were compared with the classification accuracy obtained by other methods: a combination of SOM and Gaussian mixture models (SOM_GMM), introduced in Riveiro et al. (2008b), and classification carried out by experts. To ensure correctness of the results, additional experiments were carried out with different grid dimensions. An example of the influence of the neighbourhood function on the classification accuracy with SOM grid dimension 25 × 25 is presented in Table 5. In all further experiments, the Mexican hat neighbouring function is used.

The comparison of the classification results obtained by the proposed algorithm (SOM_Pheromone) and the SOM_GMM algorithm is presented in Table 6. The experiments have been performed using the Cargo Vessels data set. All the experiments have been performed under the same conditions with the same parameters by increasing the SOM network grid dimension from 10 × 10 to 40 × 40 by step 5. By comparing the obtained results in Table 6, it can be concluded that using the SOM_Pheromone algorithm for teh Cargo Vessels data set, the classification accuracy is better than that of SOM_GMM (the best results are marked in bold for each grid dimension). Another conclusion from the obtained results is that the optimal size of the SOM grid for the SOM_Pheromone and SOM_GMM is 25 × 25.

The experiment was repeated with the Passenger vessels data set and the Tugs and Pilot vessels data set. The classification results are presented in Tables 7 and 8. The learning parameters for the SOM network training are the same as in the previous experiment, the grid size of SOM is 25 × 25. The experimental results, presented in Table 7, show that, using the SOM_Pheromone algorithm, the best classification accuracy (marked in bold in Tables 7 and 8) is achieved.

Figure 2 presents the visualization results of the Passenger vessels data set, obtained using the SOM_Pheromone algorithm with 25 × 25 SOM size. The sign ’∘’ represents the neurons whose pheromone value is greater than the threshold value and those neurons classify the maritime traffic as normal. The sign ‘×’ represents the neurons whose pheromone value is less than the threshold value, and the maritime traffic is classified as abnormal. The sign ‘▲’ represents the real traffic data of three passenger vessels.