About one week of AIS (Automatic Identification System) data are analysed to derive indicators for discriminating between suspect and fiducial vessels. This data is obtained from approximately 1100 vessels along the Dutch North Sea coast including the entrance to the main port of Rotterdam. The indicators are used to learn about normal vessel behaviour, which is needed for comparison to detect suspicious vessels. Possibly, the investigated indicators may be used in classification algorithms or for direct interpretation by e.g. border patrols to detect suspicious vessels pro-actively, i.e. before they cross the maritime (land-sea) border