Vessel-Class Kinematic Signatures: Tanker Noise, Bulk Precision, and the 6× Gap Where Spoofing Hides

Kinematic fingerprinting treats each vessel class as its own behavioral distribution. Across 1,555 observed vessels at Santos and 804 in the global fingerprint set, the residuals vary by a factor of 6× and the prior-vs-actual divergence hits 6.6× — each gap is a different kind of spoofing opportunity.

The Setup

The kinematic fingerprint library computes acceleration, turn rate, and residual variance baselines per vessel class. "Residual" is the delta between observed motion and what a physics-plausible trajectory would predict. A low residual means the vessel's observed track is consistent with legitimate navigation; a high residual means the track is noisier than physics permits. Spoofing shows up as an anomalous residual — but the threshold for "anomalous" depends entirely on which vessel class the vessel claims to be.

The per-class medians in the current fingerprint set (n=804 for the global sample, larger for individual classes):

• Bulk carriers, medium (n=404): residual p50 = 0.0122, turn rate p50 = 13.4°/s, acceleration p50 = 1.0 m/s².
• Tankers (n=400–1,456 depending on sub-sample): residual p50 = 0.0185–0.021 (1.5–1.7× bulk), turn rate p50 = 20.34°/s.
• General cargo (n=44): residual p50 = 0.0738 — 6.1× bulk carriers.
• "Other" class (n=276): residual p50 = 0.0043 — lower than bulk — but turn rate p50 = 37.4°/s, 4.2× bulk.
• LNG carriers (n=42 in the scored fleet): small sample, but 4.8% critical-risk rate versus 0.9% for tankers (5.3× higher).
• Laden bulk carriers (n=26): residual 0.0281, acceleration 2.26, turn rate 23.6 — all 2.0–2.3× higher than the medium-load bulk baseline.

Plus one global calibration finding: across 1,555 observations at Santos, the prior-vs-actual divergence is 6.6×. The priors — calibrated from fleet averages — predicted 0.34 m/s² acceleration for laden bulk carriers; actual is 2.26. They predicted 4.8°/s turn for medium "other" class; actual is 75.1. The priors were wrong by almost an order of magnitude for the extremes, and spoofing detectors calibrated to those priors inherited the miscalibration.

The Chain

Kinematic fingerprinting works by learning the distribution of "normal" motion per vessel class and flagging deviations. The detection chain is:

1. Stream AIS positions into the pipeline.
2. Compute per-segment acceleration, turn rate, and residual against a physics-plausible fit.
3. Look up the per-class baseline.
4. Flag positions whose residuals exceed class-specific thresholds (typically p95 or p99).

The class-to-class residual gap governs how much spoofing can hide per class:

Tankers run at 1.5–1.7× the bulk residual. A tanker that deviates by a value invisible against the tanker distribution would have triggered against the bulk distribution. This is why tankers — carrying crude, petroleum products, and (increasingly) sanctioned Russian oil — are over-represented in spoofing literature: their baseline noise gives them more room to hide. The 52% residual gap between tankers (0.0185) and bulk (0.0122) defines that room.

General cargo is the hardest class. At 6.1× the bulk residual (0.0738 vs 0.0122), the general-cargo distribution swallows almost any signal. An anomaly detector tuned to the bulk distribution would fire 90% of the time on normal general-cargo traffic. An anomaly detector tuned to the general-cargo distribution catches almost nothing — there's no signal left. The 44-vessel sample size is the other problem: the distribution itself is uncertain, and any threshold drawn from it carries wide confidence intervals.

"Other" class vessels are the most interesting. The residual p50 of 0.0043 is lower than bulk — these vessels move cleanly — but their turn rate p50 of 37.4°/s is 4.2× bulk's 8.95°/s. The combination of "clean motion plus extreme turn rates" suggests the "other" class contains tugs, harbor craft, and pilot boats doing legitimate but unusual maneuvers. A spoofer replicating the "other" signature would need to combine near-zero residual with sharp turn rates — much harder to fake than tanker noise.

Laden vs medium-load bulk carriers reveal a load-state signal the base fingerprint misses. Laden bulk carriers accelerate 2.26× harder, turn 1.76× faster, and show 2.31× the residual variance compared to medium-load bulks. A fingerprint detector that doesn't separate by load state treats laden spoofing as indistinguishable from medium-load honest motion — and vice versa. The 26-vessel laden sample is small, but the ratios are consistent enough to warrant a load-state split in the detector.

LNG carriers have a 4.8% critical-risk rate versus tankers' 0.9%. The sample is tiny (42 vessels scored) and includes specific vessels known to sanctions screening (GAS LUCKY, LNG NOBLE show up in the top-risk list), but the 5.3× differential across 42 vessels is more than small-sample noise. LNG is where tanker-like opacity meets grain-carrier-sized geopolitical stakes.

The Santos prior-vs-actual divergence at 6.6× is the meta-lesson. Fleet-average priors understated the tails by an order of magnitude. Detector thresholds drawn from those priors fire on too many honest vessels and miss the genuine anomalies. The fix is per-class-per-load-state baseline re-estimation, not a single global residual threshold.

The Implication

For kinematic-anomaly-based sanctions screening, the correct detector architecture is a per-class-per-load-state threshold set, not a global residual threshold. Specifically:

• Tanker detection should use threshold 0.021–0.025 (above the tanker p50 of 0.0185), not the global 0.015. The global threshold flags too many tankers as anomalous.
• Bulk carrier detection should split by load state. Medium-load threshold at 0.015, laden threshold at 0.035 — the 2.31× ratio between them is too large to ignore.
• General cargo detection requires a different strategy entirely. The residual signal is too noisy; complement it with track-continuity checks and port-call consistency.
• "Other" class detection should weight turn-rate anomalies above residual anomalies. The class's signature is "sharp turns in clean straight lines," and spoofing that doesn't reproduce that will stand out.
• LNG detection should inherit the tanker threshold initially but be monitored separately; the 5.3× critical-rate differential against tankers may reflect specific vessels rather than a class property, and a 42-vessel sample isn't enough to decide.

What to Watch

• Whether the Santos 6.6× prior-divergence replicates at Singapore, Rotterdam, and Houston. If it holds, the global fingerprint library needs to be re-fit from observed motion rather than fleet-average priors.
• The general-cargo sample size (currently n=44). As it grows, the residual p50 may stabilize; if it falls toward 0.03 with a larger sample, the class becomes detectable. If it stabilizes at 0.07+, general cargo is permanently harder to screen.
• The laden-bulk sample (n=26). Worth tracking closely because the load-state signal is the most actionable lever, and the sample is at the edge of statistical usefulness.
• LNG-specific events. With only 42 carriers scored and two specific vessels dominating the risk list, any new high-risk LNG observation materially moves the class-level stats.

Limitations

The Santos observations (n=1,555) are geographically biased — Santos is a grain-export port with specific maneuvering patterns that may not generalize to container ports or anchorage waters. The "other" class is heterogeneous (tugs, pilot boats, research vessels, fishing vessels); pooling them obscures the true within-class distribution. The residual metric depends on the physics-plausible fit, which itself has tuning parameters — different fit choices would shift the p50s by up to ±20%. GPS multipath in narrow channels (Singapore, Houston, Hamburg) inflates residuals artificially for all classes in those geographies. The 6.1× general-cargo ratio is based on 44 vessels; a 95% confidence interval on that ratio is wide enough to contain both 3× and 10×.

Data current as of 2026-04-23. Source: Axiom Overwatch kinematic fingerprint library, AIS positions from AISStream.io, prior-vs-actual calibration from Santos port observations. Consolidates prior posts on tanker residuals, bulk carrier load-state, general cargo noise, "other" class precision, LNG risk, and Santos kinematic priors.