{ "_meta": { "__meta__": "synthetic", "disclaimer": "Synthetic demo data inspired by real Baltic geography, MMSI/OUI conventions, and infrastructure. Not real observations.", "dataset": "s4-spoofed-ais-identity/timeline", "version": "1.0", "anchor_ts": "2025-05-14T05:55:00Z", "window_open_ts": "2025-05-14T03:00:00Z", "window_close_ts": "2025-05-14T09:00:00Z", "spoof_ais_start_ts": "2025-05-14T05:55:00Z", "spoof_ais_stop_ts": "2025-05-14T08:05:00Z" }, "events": [ {"ts_iso": "2025-05-14T03:40:00Z", "t_rel": "T-02:15:00", "actor": "F/V TAHTI (real)", "event": "Departs Hanko fishing harbour; AIS Class B normal, SOG 5.6 kn, COG 195", "lat": 59.8230, "lon": 22.9720, "signals": ["ais"], "notes": "Routine coastal loop start (legitimate vessel)."}, {"ts_iso": "2025-05-14T03:45:00Z", "t_rel": "T-02:10:00", "actor": "MAC-HKO-PORT-02", "event": "First scan of TAHTI shows expected fingerprint (P-TAH-OWNER iPhone + 2 guest MACs + onboard router)", "lat": 59.8228, "lon": 22.9710, "signals": ["mac"], "notes": "Baseline fingerprint match (Jaccard ~1.0)."}, {"ts_iso": "2025-05-14T04:10:00Z", "t_rel": "T-01:45:00", "actor": "MAC-HKO-COAST-01", "event": "Hanko outer-mole hand-off of TAHTI; RSSI geometry matches 10-visit running mean", "lat": 59.7700, "lon": 22.9550, "signals": ["mac", "ais"], "notes": "Coastal anchor sensor confirms baseline."}, {"ts_iso": "2025-05-14T05:30:00Z", "t_rel": "T-00:25:00", "actor": "F/V SILAKKA (decoy)", "event": "Legitimate fishing vessel departs Porkkala marina toward Helsinki, AIS clean (MMSI 230888022, SOG 8.5 kn)", "lat": 59.9850, "lon": 24.4200, "signals": ["ais"], "notes": "Decoy; must NOT trigger spoof alert."}, {"ts_iso": "2025-05-14T05:55:00Z", "t_rel": "T+00:00:00", "actor": "Spoof platform X", "event": "Begins broadcasting AIS with MMSI 230199540 from central GoF (59.780N 24.100E), claimed sog 6.0 kn, claimed type 30", "lat": 59.7800, "lon": 24.1000, "signals": ["ais"], "notes": "Spoof onset; duplicate-MMSI condition becomes true within minutes."}, {"ts_iso": "2025-05-14T06:00:00Z", "t_rel": "T+00:05:00", "actor": "AIS aggregator", "event": "Two messages with same MMSI arrive within 5 s, ~78 NM apart -> duplicate_mmsi_score = 1.0", "lat": null, "lon": null, "signals": ["composite"], "notes": "Latent duplicate-MMSI detector trips first."}, {"ts_iso": "2025-05-14T06:10:00Z", "t_rel": "T+00:15:00", "actor": "RAD-PLN-01", "event": "Patrol Dornier 228 enters operating area; begins 4 s sweep cadence", "lat": 59.7000, "lon": 23.8000, "signals": ["plane_radar"], "notes": "RAD-PLN-01 is the sole continuous truth-source for the spoof."}, {"ts_iso": "2025-05-14T06:20:00Z", "t_rel": "T+00:25:00", "actor": "RAD-PLN-01", "event": "Track T-7741 acquired over spoof position; length est 31 m, SOG 16.8 kn, COG 071", "lat": 59.7880, "lon": 24.1150, "signals": ["plane_radar"], "notes": "First independent ground truth of spoof hull."}, {"ts_iso": "2025-05-14T06:22:00Z", "t_rel": "T+00:27:00", "actor": "Fusion engine", "event": "Radar length 31 m and SOG 16.8 kn inconsistent with AIS-claimed 12 m / 6 kn -> dimension_speed_plausibility_score = 0.92", "lat": null, "lon": null, "signals": ["composite"], "notes": "Plausibility breach posted to incident draft."}, {"ts_iso": "2025-05-14T06:35:00Z", "t_rel": "T+00:40:00", "actor": "MAC-HKO-PORT-02", "event": "Real TAHTI re-acquired at Hanko at expected location with full baseline fingerprint - proves spoof is NOT the legitimate hull relocated", "lat": 59.8228, "lon": 22.9710, "signals": ["mac", "ais"], "notes": "Critical disambiguation."}, {"ts_iso": "2025-05-14T07:05:00Z", "t_rel": "T+01:10:00", "actor": "RAD-PLN-01", "event": "Track T-7741 continues toward Helsinki at sustained 16.9 kn; AIS still claims fishing-vessel attributes", "lat": 59.8860, "lon": 24.5950, "signals": ["plane_radar", "ais"], "notes": "ais_radar_delta_score climbs above 0.85."}, {"ts_iso": "2025-05-14T07:12:00Z", "t_rel": "T+01:17:00", "actor": "F/V SILAKKA (decoy)", "event": "SILAKKA enters Helsinki South Harbour roads at 6.0 kn; her MAC fingerprint observed at MAC-HEL-PORT-05 (distinct from TAHTI and from spoof)", "lat": 60.1500, "lon": 24.9400, "signals": ["ais", "mac"], "notes": "Decoy fingerprint consistent with her own baseline."}, {"ts_iso": "2025-05-14T07:18:00Z", "t_rel": "T+01:23:00", "actor": "MAC-HEL-PORT-04", "event": "Katajanokka dense sensor logs 14 unknown MACs during 9-min dwell; mix dominated by Huawei (00:E0:FC) and ZTE (34:DE:1A)", "lat": 60.1480, "lon": 24.9600, "signals": ["mac"], "notes": "Spoof-window fingerprint capture."}, {"ts_iso": "2025-05-14T07:22:00Z", "t_rel": "T+01:27:00", "actor": "Fusion engine", "event": "Jaccard(spoof_window_fingerprint, TAHTI baseline) = 0.00; manufacturer cosine = 0.06 -> mac_fingerprint_anomaly_score = 0.95", "lat": null, "lon": null, "signals": ["composite"], "notes": "Three-way join (AIS x MAC x radar) now fully populated."}, {"ts_iso": "2025-05-14T07:25:00Z", "t_rel": "T+01:30:00", "actor": "Fusion engine", "event": "Weighted spoof_score for MMSI 230199540 ~= 0.94 (above 0.70 alert threshold)", "lat": null, "lon": null, "signals": ["composite"], "notes": "Operator alert prepared."}, {"ts_iso": "2025-05-14T07:26:00Z", "t_rel": "T+01:31:00", "actor": "Fusion engine", "event": "Weighted spoof_score for MMSI 230888022 (SILAKKA) ~= 0.05 - correctly NOT flagged", "lat": null, "lon": null, "signals": ["composite"], "notes": "Decoy proves detector selectivity."}, {"ts_iso": "2025-05-14T07:30:00Z", "t_rel": "T+01:35:00", "actor": "Operator console", "event": "Alert raised: 'AIS identity spoof - MMSI 230199540 (claimed F/V TAHTI) - recommend visual ID via patrol craft'", "lat": null, "lon": null, "signals": ["composite"], "notes": "INC-S4-2025-05-14-001."}, {"ts_iso": "2025-05-14T07:45:00Z", "t_rel": "T+01:50:00", "actor": "RAD-PLN-01", "event": "Aircraft turns south; last track point logged for T-7741", "lat": 59.9650, "lon": 25.0200, "signals": ["plane_radar"], "notes": "Hand-off window to coastal radar opens."}, {"ts_iso": "2025-05-14T07:50:00Z", "t_rel": "T+01:55:00", "actor": "RAD-COAST-HEL-01", "event": "Coastal radar picks up the spoof hull entering 6 NM zone; continues independent track without AIS", "lat": 60.0500, "lon": 25.0500, "signals": ["coastal_radar"], "notes": "Hand-off complete; alert remains open."}, {"ts_iso": "2025-05-14T08:05:00Z", "t_rel": "T+02:10:00", "actor": "Spoof platform X", "event": "AIS broadcasts cease abruptly with no normal arrival/moored sequence", "lat": 59.9400, "lon": 24.8800, "signals": ["ais"], "notes": "AIS-claimed track terminates."}, {"ts_iso": "2025-05-14T08:07:00Z", "t_rel": "T+02:12:00", "actor": "Fusion engine", "event": "Hull now radar-only; alert sub-case set to 'ghost / went dark'", "lat": null, "lon": null, "signals": ["composite"], "notes": "Spoof platform continues being tracked physically."}, {"ts_iso": "2025-05-14T08:30:00Z", "t_rel": "T+02:35:00", "actor": "Analyst", "event": "Case closed as confirmed spoof; TAHTI baseline unchanged; spoof MAC set archived as adversary fingerprint candidate", "lat": null, "lon": null, "signals": ["composite"], "notes": "TAHTI returns to Hanko harbour unaffected."} ] }