Because of global economic and socio-political changes, an increase of conflicts near the world's coastlines is anticipated. The littoral zone is characterized by intense regular vessel traffic. The conduct of Maritime Security Operations and Peace support Operations therefore means that navies have to control instead of dominate the sea, allowing regular vessel traffic in the area of operations, and act against irregular adversaries who nevertheless also can possess military armaments. Piracy, drug trafficking and other threatening events become obscured in the crowd of everyday fisheries, cargo traders, ferries and pleasure cruises, hindering the detection of anomalies and suspect behavior, and resulting in insufficient situation awareness. For controlling these situations information superiority and adequate situation awareness is a necessity. For the purpose to achieve information superiority a research program at TNO, in collaboration with the RNLN, has started aiming at improving maritime situation awareness. To improve situation awareness and threat detection capabilities in maritime scenarios the combination of sensor-based information with context information and intelligence from various sources is required. In the study the fusion and analysis for revealing anomalies and suspect from normal behavior are based on domain ontologies. A test bed allows the study of various exploitation and assessments techniques applied to these domain ontologies. Using an appropri- ate scenario we have simulated suspect and normal behaviour to test the applicability of these techniques.