Ships involved in commercial activities tend to follow set patterns of behaviour depending on the business in which they are engaged. If a ship exhibits anomalous behaviour, this could indicate it is being used for illicit activities. With the wide availability of automatic identification system (AIS) data it is now possible to detect some of these patterns of behaviour. Monitoring the possible threat posed by the worldwide movement of ships, however, requires efficient and robust automatic data processing to create a priority list for further investigation. This paper outlines five anomalous ship behaviours: deviation from standard routes, unexpected AIS activity, unexpected port arrival, close approach, and zone entry. For each behaviour, a process is described for determining the probability that it is anomalous. Individual probabilities are combined using a Bayesian network to calculate the overall probability that a specific threat is present. Examples of how the algorithms work are given using simulated and real data.