The brief
The ITG & Universidade da Coruña Datathon 2026 handed teams a dump of real AIS (Automatic Identification System) maritime traffic — 171,750 incidents covering vessel movements, anomalies, and reported events. The task was open-ended: turn it into something a port authority could actually use to prioritise attention. No single model was going to cover detection, risk scoring, forecasting, and geographic pattern-finding well, so the platform ended up as six specialised models rather than one general one.
Splitting the problem into six models
Instead of forcing one architecture to do everything, I mapped each sub-problem to whichever model was the best fit for its data shape and evaluation criteria:
- Anomaly detection — XGBoost, 97.6% accuracy flagging incidents that deviate from expected vessel behaviour.
- Risk classification — Random Forest, 92.6% accuracy grouping incidents into severity tiers.
- Incident typing — XGBoost again, 99.9% accuracy categorising the nature of each incident (this task turned out to be close to linearly separable given the feature set, which explains the very high score).
- Cost regression — Gradient Boosting, R² = 0.70 estimating the operational cost impact of an incident.
- Temporal forecasting — Prophet, decomposing incident volume into trend, weekly seasonality, and changepoints to forecast near-term incident load.
- Geographic clustering — HDBSCAN, grouping incidents into geographic hotspots.
None of this needed deep learning. The data was tabular and moderately sized, so gradient-boosted trees and classical statistical models were faster to iterate on and easier to validate under hackathon time pressure than a neural network would have been.
Why HDBSCAN over K-Means for the hotspots
Geographic incident clustering was the one place a naive first choice (K-Means) would have quietly produced misleading results. Maritime incidents don't cluster into neat, similarly-sized, spherical groups — they concentrate densely around ports and shipping lanes, then thin out into isolated open-water events. K-Means forces every point into a cluster and assumes roughly equal-sized, round clusters, which would have dragged isolated outliers into the nearest hotspot and diluted it.
HDBSCAN doesn't have either of those assumptions: it finds clusters of arbitrary shape and density, and — critically — it's allowed to label sparse points as noise instead of forcing them into a cluster. That distinction mattered directly for the dashboard: an isolated incident in open water is a very different signal from a cluster forming near a port, and the clustering needed to preserve that difference rather than average it away.
Making it usable, not just accurate
A model that only exists as an offline notebook doesn't help a port operator during a shift. The second half of the project was a Next.js dashboard that turned the six models' outputs into something actionable:
- Geographic hotspot maps built from the HDBSCAN clusters.
- Incident timelines combining historical data with the Prophet forecast.
- A P0–P4 severity prioritisation scheme derived from the risk classifier and cost regression, so the highest-impact incidents surface first.
What I'd take from this
The main lesson wasn't a modelling trick — it was resisting the urge to reach for a single unified model because it feels more elegant. Six specialised models, each evaluated on its own metric (accuracy, R², or cluster quality rather than one blended score), were easier to validate individually and easier to debug when something looked off. That decomposition, plus keeping the storage and modelling choices boring and battle-tested (XGBoost, Random Forest, Prophet, HDBSCAN), left more time for the part that actually needed creativity: turning six sets of predictions into one dashboard a person could use to make a decision in under a minute.
The project placed 2nd at Datathon 2026 (ITG & Universidade da Coruña). The code is on GitHub, and there's a fuller write-up of the architecture on the project page.