From one odd position to a decision.
Four steps, and a person at the end of them.
Predict.
For each vessel, GHAST predicts the next position from its recent track: where it was, how fast it was going, which way it was turning. Reports normally land close to that prediction.
A report that lands far from it, further than the vessel could physically manage, is a flag.
Place it.
One vessel off while its neighbours are fine points to spoofing aimed at that ship. Many vessels off in the same area point to jamming. A list of known jamming areas adds to the picture.
It is a different situation for an analyst to walk into, so GHAST says which one it looks like before anyone opens the incident.
Investigate.
An agent pulls the vessel's track, checks it against known jamming areas, and looks at the vessel's history. It states a hypothesis, how sure it is, and keeps a log of every step it took.
It never declares that something is spoofing. It reports what it found and how strong the evidence is.
- 1. TrackPull the last several hours of the vessel's positions.
- 2. AreasCheck whether the position sits inside a known jamming area.
- 3. HistoryLook for earlier incidents on this vessel, and the same pattern elsewhere.
- 4. ConcludeName the most likely cause and say how sure it is.
Decide.
An analyst reads the evidence and records a verdict: confirmed spoof, jamming, equipment fault, benign, or unclear.
Those verdicts are how GHAST finds out how often it is right. Until enough of them exist, it does not claim a number.