Operational forecasting system based on anomalous behaviors in complex systems

1 . A non-transitory machine-readable storage media having machine readable instructions that, when executed, cause one or more machines to perform a method comprising:

receiving, via a satellite, real-time data that includes records of locations of objects, wherein the satellite receives the real-time data from one or more location transponders on the objects;

storing the records, received via the satellite, in memory;

processing the records, received via the satellite, by applying a distributed process, wherein processing the records comprises identifying nearest one or more predictors related to the locations of the objects to forecast changes based on the real-time data or projections of future records, and wherein the one or more predictors comprise oceanographic predictors;

calculating pairwise nearest neighbor Haversine distances of the objects in a region;

predicting for a future time, based on the forecasted changes in the one or more predictors, an anomalous behavior among the objects with a prediction scheme, wherein the prediction scheme includes a machine-learning model configured to classify regions where illegal activity is likely to occur in the future time, and wherein the machine-learning model is trained using historical maritime vessel movement patterns and oceanographic predictors;

calculating, for a time period, probability density functions of the pairwise nearest neighbor Haversine distances;

measuring a distance between two probability density functions of the probability density functions, wherein measuring the distance between two probability density functions comprises measuring a distance between a current probability density function and each of a plurality of lagged probability density functions from previous time periods by applying a Kolmogorov-Smirnov statistic;

computing mean and kurtosis of the distance to create anomaly indices indicative of illegal activity; and

issuing an electronic notification, based on the prediction, that assists maritime law enforcement to prevent or intervene in activities that are illegal, wherein the electronic notification is issued if the mean or kurtosis is greater than a threshold.

2 . The non-transitory machine-readable storage media of claim 1 , wherein the threshold is substantially 95th percentile of a null distribution calculated from null periods where illegal activities were suspected to not have occurred.

3 . The non-transitory machine-readable storage media of claim 1 , wherein the threshold is programmable.

4 . The non-transitory machine-readable storage media of claim 1 , wherein measuring the distance between the two probability density functions comprises:

applying one of: Kolmogorov-Smirnov statistic, Hamming distance, or Kullback-Leibler divergence.

5 . The non-transitory machine-readable storage media of claim 1 , wherein predicting for the future time comprises:

classifying the objects as illegal or legal operating objects based on the machine-learning model; and

retraining the machine-learning model based on classifying the objects.

6 . The non-transitory machine-readable storage media of claim 5 , wherein the electronic notification is issued if classification of the objects provides a prediction of an illegal operating object.

7 . An apparatus comprising:

a memory to store real-time data including received records of locations of vessels received from another device; and

a processor circuitry coupled to the memory, wherein the processor circuitry is to execute one or more instructions to:

process the received records by application of a distributed process, and identify nearest one or more predictors related to the locations of the vessels to changes based on the real-time data or projections of future records, wherein the one or more predictors comprise oceanographic predictors;

predict for a future time, based on forecasted changes in the one or more predictors, with a prediction scheme an anomalous behavior among the vessels, wherein the prediction scheme includes a machine-learning model configured to classify regions where illegal activity is likely to occur in the future time;

calculate pairwise nearest neighbor Haversine distances of the vessels in a region;

calculate, for a time period, probability density functions of the pairwise nearest neighbor Haversine distances;

measure a distance between two probability density functions of the probability density functions by measuring a distance between a current probability density function and each of a plurality of lagged probability density functions from previous time periods by applying a Kolmogorov-Smirnov statistic;

compute mean and kurtosis of the distance to create anomaly indices indicative of illegal activity; and

issue an electronic alert based on the prediction that assists maritime law enforcement to prevent or intervene in activities that are illegal, wherein the electronic alert is issued if the mean or kurtosis is greater than a threshold.

8 . The apparatus of claim 7 , wherein the threshold is substantially 95th percentile of a null distribution calculated from null periods where illegal activities were suspected to not have occurred.

9 . The apparatus of claim 7 , wherein to measure the distance between the two probability density functions, the processor circuitry is to:

apply one of: Kolmogorov-Smirnov statistic, Hamming distance, or Kullback-Leibler divergence.

10 . The apparatus of claim 7 , wherein to apply the prediction scheme, the processor circuitry is to:

classify the vessels as illegal or legal operating vessels based on the machine-learning model; and

retrain the machine-learning model based on classifying the vessels.

11 . A method comprising:

receiving, by a satellite, real-time data that includes transponder records of locations of vessels, wherein the satellite receives the real-time data from one or more location transponders on the vessels;

storing the transponder records, received by the satellite, in a memory;

processing the transponder records, stored in the memory, by applying a distributed process, wherein the distributed process provides a prediction scheme that measures a distance between two probability density functions associated with the locations of the vessels to forecast changes based on the real-time data;

predicting for a future time, based on forecasted changes with a prediction scheme, an anomalous behavior among the vessels, wherein the prediction scheme includes a machine-learning model configured to classify regions where illegal activity is likely to occur in the future time;

calculating pairwise nearest neighbor Haversine distances of the vessels in a region;

calculating, for a time period, probability density functions of the pairwise nearest neighbor Haversine distances;

measuring a distance between two probability density functions of the probability density functions, wherein measuring the distance between two probability density functions comprises measuring a distance between a current probability density function and each of a plurality of lagged probability density functions from previous time periods by applying a Kolmogorov-Smirnov statistic;

computing mean and kurtosis of the distance to create anomaly indices indicative of illegal activity; and

issuing an electronic notification on identification of the anomalous behavior, wherein the electronic notification is issued based on a mean or a kurtosis in relation to a threshold, wherein the electronic notification assists maritime law enforcement to prevent or intervene in activities that are illegal, wherein the electronic notification is issued if the mean or kurtosis is greater than a threshold.