Unsupervised Anomaly Detection for Aircraft Condition
Monitoring System
Mohamed Cherif DANI
Airbus
LIPADE Descartes University
0033-561 933-333
mohamed-cherif.dani@airbus.com
mohamed.nadif@parisdescartes.fr
Abstract—Anomaly detection is an important field for the an-
ticipation of aircraft maintenance operations, working as an
enabler of diagnostic and prognostic functions. A method has
been implemented to detect abnormal data in Aircraft Condi-
tion Monitoring System (ACMS) records. Rather than using
already known and usual detection triggers which are partial
detectors and insensitive to new flight and system conditions,
this method automatically extracts abnormal data points with-
out requiring any a priori information about the system and its
conditions. To accomplish this objective, we propose to combine
a segmentation based and density clustering approaches for
detecting and filtering anomalies. This method was applied on
A340 ACMS data recordings. The detection logics associated
with the new anomalies can be used as new detection conditions
to be potentially implemented onboard, further extending legacy
detection capabilities.
TABLE OF C ONTENTS
1 I NTRODUCTION . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
2 ACMS AND PREDEFINED CONDITIONS . . . . . . . . .
3 U NSUPERVISED ANOMALY DETECTION . . . . . . . . .
4 A NOMALY DETECTION . . . . . . . . . . . . . . . . . . . . . . . . . .
5 CONCLUSION . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
R EFERENCES . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
B IOGRAPHY . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
1. I NTRODUCTION
Industrial systems progress quickly and become more and
more critical and complex. Maintaining performance, oper-
ational flexibility and reliability of these systems during the
service life under a predefined service level indicator is an
important phase for good productivity. Aircraft operators,
manufactures and maintenance services have shown a grow-
ing interest in optimizing the usage of airplanes and their
support apparatus to improve the operational reliability while
reducing maintenance cost during the aircraft life. With the
fast growth of aviation safety in this last decade, anomaly
detection remains a challenging subject. The ACMS (Aircraft
Condition Monitoring System) acquires stores and process
aircraft data for operation and maintenance. Some of these
parameters are checked by triggers (predefined conditions)
actively to detect anomalies, The great volume of the data
generated from modern aircraft (e.g. flight data, support lo-
978-1-4799-5380-6/15/$31.00 c 2015 IEEE.
Cassiano FREIXO François-Xavier JOLLOIS
Airbus Paris Descartes University
Toulouse, 31707 Paris, 75005
0033-561 933-333 0033-017-653-4827
cassiano.freixo@airbus.com francois-xavier.jollois@parisdescartes.fr
Mohamed NADIF
Paris Descartes University
Paris, 75005
0033-183-945-808
gistic data, maintenance reports, sensors, etc.) implies a high
complexity of understanding and improving the maintenance
process, the vast majority of airlines are limited to look back
for the cause of the failure that already happened. ACMS uses
predefined conditions (triggers, also known as exceedance
detection) to detect incident (anomalies). A priori knowledge
of the system is required and a list of parameters with the
characteristics of each parameter needs to be specified in ad-
vance by the expert (system designer, maintenance engineer,
etc), or by airlines to program effective triggers, but in some
cases the triggers are not reliable, for example, the Rotary
Variable Differential Transducer sensor measures the position
of the nose wheels during steering operation. This sensor
could change behavior unexpectedly after a maintenance
action, water accumulation, sensor problems, etc., resulting
unverified triggers or continuous false alarm.
Unsupervised techniques detect anomalous patterns through
identifying some new or unknown behaviors that are ab-
1 normal or inconsistent relative to most of the data. Many
2 studies and research interested in anomaly detection ap-
peared. Several techniques have been specifically developed
3 for certain application domains. Furthermore, a large number
5 of surveys, reviews were performed on anomaly detection.
6 Recently, Gupta 2013 [1], Chandola 2009 [2] structured and
6 overviewed different algorithms by research areas, applica-
6 tion domains and data nature.
Anomalies vary between domains and objectives, Lishuai [3]
detects abnormal flights from DFDR (Digital Flight Data
Recorder) data, and from QAR (Quick Access Recorder)
data, where they are transformed into high dimensional vec-
tors, reduced and clustered. This approach is limited to the
takeoff and approach phase only. Based on clustering analysis
and Bayesian model, Sequence Miner [4] detects anomalies
in discrete symbol sequences (cockpits sensor) using Longest
Common Subsequence [5] (LCS), the algorithm is unable
to detect anomalies in continuous data, unlike MKAD [6]
which is designed to heterogeneous data (e.g. continuous and
discrete parameters), Multiple Kernel Anomaly Detection
(MKAD) reforms SVM one-class [7] approach to be able to
handle heterogeneous data.
Some other algorithms such as Gecko [8] transforms the
time series into segments (states), finds their characteristics
and the logic transition between the states to build a finite
state automaton. Gecko splits the time series into clusters
using a method based on knee of the curve (L method) [9].
The algorithm requires a phase of supervised learning and
involvement of an expert. For voluminous unlabeled data, the
learning process is complicated.
1
The Kmeans algorithm is commonly used on several times are generated and data are recorded. The ACMS Reports are
for detection anomalies, depending on the domain area (fraud the basis for the aircraft monitoring function, which collect
detection, intrusion, aerospace, etc.). Several case studies and parameters upon detection of predefined system conditions.
reviews have been proposed. For instance, Gerhard [10] built These can be either very typical conditions (e.g. for per-
normal and abnormal clusters and then computes the mini- formance monitoring used for trend reports) or abnormal
mum distance between new arrival points and cluster centers. conditions (event reports for trouble shooting), to support
Gupta [11] used also Kmeans PCA-based similarity measures system performance trending, assessment and/or to get in-
for multivariate time series anomaly detection, minimum advance indications of incipient system failures.
information about data are required to be able to distinguish
between abnormal and normal data. In such approaches all
data points should belong to a cluster.
The Symbolic Aggregate approXimation (SAX) [12], based
on symbolic representation of a time series, is used by many
algorithms for anomaly detection and unusual time series
subsequence. In order to find the most distant subsequence,
the algorithm maps all segments produced by PAA algorithm
[13], replaces segments by symbols (alphabet) and then mea-
sures the distance between symbols, in order to find the most
distant subsequences.

The purpose of this study is to detect anomalies on ACMS

data records. We aim to detect anomalous subsequences
by watching and comparing parameters of same type. The
approach is summarized in the figure 1 and is based on two
steps: segmentation and clustering.
Figure 2. Concept of ACMS recording.

The predefined condition is programmed by the system de-

signers and customers from a priori knowledge of the system.
Because of system complexity, the predefined known condi-
tions (static knowledge) do not cover all system conditions
with potential use for health monitoring (potentially linked to
new faults or degradation indicators).
As consequence, during the flight, ground monitoring today
is limited. Only reports are explored (figure 3), data between
reports are stored for ground use only, because sending the
whole data is technically difficult due to the cost, the volume,
and the velocity.

Figure 1. Anomaly detection methodology.

- Segmentation: (also referred to summarization approach)

aims to find an accurate approximation of time series, by
reducing dimensionality, eliminating noise while retaining its
essential features. Segmentation helps us to get a simplified
time series presentation, and to reduce time execution for
clustering process, etc.
- Clustering: ACMS data are not labeled or referenced, we
don’t have any a priori knowledge of the system, and hence
we propose to use density-based clustering to detect anoma- Figure 3. Snapshot of data (before and after the event) to
lies using segmented data, rather than use original data where be sent to the ground.
we have more than 42.103 measured data per parameter.
The figure 3, illustrates how reports are generated when an
2. ACMS AND PREDEFINED CONDITIONS anomaly is detected using predefined conditions. The report
is a set of data recorded before and after the event [trigger
ACMS monitors and records parameters in the aircraft in instant+tx, trigger instant+tx], where tx is a fixed period
order to perform trend monitoring, system troubleshooting before and after the event. This report is sent in real time
and servicing monitoring (support Flight Operation Quality during the flight to the ground for trouble shooting and health
Assurance (FOQA), transmit avionics parameters to open- monitoring, without the rest of data, which can implies a
world applications, etc.). The figure 2 illustrates how reports partial analysis.
2
 3. U NSUPERVISED ANOMALY DETECTION
In order to find new potential triggers, the objective is to
propose an algorithm, with fewer possible inputs, capable
to detect anomalies. With A340 ACMS data records only,
clustering appears convenient, and density-based clustering
is retained.
We chose DBSCAN [14] (Density-Based Spatial Cluster-
ing of Applications with Noise) that can identify clusters
with also outliers (potential anomalies) without requiring the
knowledge of the number of clusters.
Data composition is important in our problematic. Each sys-
tem contains a set of parameters Pm represented by sensors
data. Considering this composition we looked for an efficient
data representation which should helps us to mine parameters
efficiently.
The following table (table 1) illustrates the data composition
and how we gather the parameters from different flight to-
gether.
P1 Pm

Time series
The analysis in time series data inspects the irregularities f1 t111 . . . t11w ...... tm m
11 . . . t1w
across the time. The nature of data and anomalies define the .. ..
approach to apply. Two main types of anomaly detection for . .
time series exist in data mining community. The single time fx t1x1 . . . t1xw ...... tm m
series also known as univariate time series and multivariate x1 . . . txw
time series. .. ..
. .
A Single time series T = t1 , . . . , tm (univariate time series) .. ..
is a set of observations recorded sequentially over equal time . .
increments, for example a financial time series or sensors
data. In the aircraft single time series corresponds to data fn t1n1 . . . t1nw ...... tm
n1 . . . tm
mw
coming from single sensor. Multivariate time series is a set
of single time series generated simultaneously with the same
time range. Table 1. Data representation.

ACMS Data representation

During a flight thousands of different sensors (analogue,
discrete, etc.) are measured, collected, converted to specific Density-based clustering
format (depend on the aircraft manufacture) and transmitted DBSCAN does not require a specific number of clusters. A
to QAR and others devices. ACMS receives about 75000 cluster is formed if the minimum points (minpts) are within a
parameters per second, some of these parameters are saved neighborhood distance eps. The cluster grows until no point
continuously in the QAR. The QAR is an airborne flight data is reachable. With the same density criterion other clusters
recorder designed to provide quick and easy access to raw will be created. An outlier is identified when a point or a
flight data (PCMCIA, USB) and can records 1024 words per sequence does not fit to any cluster.
second.
In this study, the ACMS recordings concern the bleed system
with more than 200 parameters. In several flights, we gather
parameters of the same type together, which form a set of
multivariate time series as in figure 4.

Figure 5. DBSCAN clustering process illustration.

DBCAN is sensitive and the selection of the inputs (density

criterion) can produce a major impact on the results (clus-
tering format and outliers detection). For example, a small
minimum points (minpts) creates clusters from noise, and
big eps gathers outliers to the normal clusters. The same
segments repeated more than five times are considered as
normal i.e. that minpts is fixed to five (mintps = 5). In our
case the minpts represents the minimum number of similar
Figure 4. Bleed system, parameter n125120 in 7 segments to form a normal cluster. We will vary the radius
different flights. (eps) and compare the results, in order to get an efficient
3
detection and a precise idea about abnormal segments. The
figure 5 illustrates DBSCAN process with minpts = 5, the
algorithm is detailed in the section.
DBSCAN algorithm
Algorithm 1: DBSCAN pseudo-code.
Input:
D: the dataset
Eps: the neighborhood distance
minpts: the minimum number of points
Output:
Discovered outliers and clusters
Begin
- Select the values of eps and minpts for a data set P to be
clustered.
- Start with an arbitrary point p and retrieve all points
density-reachable.
if p is a core point that contains at most minpts points then
- A cluster is formed.;
- Otherwise, label p as an outlier.
end
- A new unvisited point is retrieved and processed leading to
the discovery of further clusters of core points.
- Repeat step the previous step until all the points has been
visited.
- Label any points not belonging to any cluster as outliers
(Outliers).
End
Reachability and density connectedness between points is an
important aspect for cluster construction. DBSCAN labels
the data as core points where at least minpts are in the circle
of an eps radius. The neighbors of the core points around the
circle are labeled as border points, and the rest is labeled as
outliers.
Basically, y is density-reachable from x if there is a sequence
of points directly density-reachable form x, a point y is
directly density reachable from x if y is within eps-neighbors
of x and x has at least minpts neighbors. If two point x, y
are density reachable through another point z, than x, y are
density connected.
Segmentation
The ACMS data size is voluminous regarding the monitored
parameters. Some systems generate more than 42x103 points
for one parameter in a flight. This amount of data is difficult
to explore on the ground or onboard using standard hardware.
Consequently, it is easy to segment, index these data respect-
ing a minimum error and then explore these segments instead
of real data point. The segmentation allows us to reduce
data with an optimal and simple representation, optimize time
executing for the clustering process.
We segment the ACMS recordings in order to reduce the
complexity of the signals, and to get a faster clustering and
detection execution.
APCA [15] (Adaptive piecewise constant approximation)
approximates each time series by a set of constant values that
form segments with different lengths. This algorithm uses
Haar wavelet for segmentation. It takes the problem to a
4
wavelet compression problem for which a minimal solution
exist, then looks for a valid APCA representation, by sorting
the coefficients and truncating the smaller. Finally the algo-
rithm replaces the approximate segment mean values with the
exact ones for a valid APCA representation.
Algorithm 2: APCA segmentation algorithm.
Input:
T : Time series
M : Number of segments
Output:
Segmented time series
Begin
if length(C) is not a power of two then
pad it with zeros to make it so.
end
- Perform the Haar Discrete Wavelet Transform on C.
- Sort coefficients in order of decreasing normalized
magnitude, truncate after M.
- Reconstruct approximation (APCA representation)of C
from retained coefficients.
if C was padded with zeros, truncate it to the original length.
then
Replace approximate segment mean values
with exact mean values.
end
while the number of segments is greater than M do
Merge the pair of segments that can be merged
with least rise in error
end
End
The flexibly of APCA, allows to place a segment in low activ-
ity and more segments for areas of high variance, also allows
to get segments of different variables. APCA requires the
mean value of the points and the length of the segment for the
representation. For example, in the figure 6, the original time
series (parameter from bleed systems) of 45 ∗ 103 data points
is transformer into 145 segments, these segments resume the
global state of the time series with an optimal error.
Figure 6. Segmentation using APCA algorithm.
Block segmentation
For a huge amount of data, most of segmentation algorithms
(top-down and bottom-up) have different performance prob-
lems. For example, the considerable time of execution for
some of segmentation algorithms. Moreover, we need some
times to determine the number of segments. To overcome
this problem, rather than using the entire time series for
segmentation, we can use APCA in a small time window
(block), with a fixed number of segments.
The APCA approximates each block by a set of segments
with a constant value and a minimum error reconstruction.
will not, for example, cluster the pressure parameters with
other parameters, but only with pressure parameters of the
other flights. The purpose behind this choice is to find which
subsequence in a known parameter is anomalous regarding
the other flights.The figure 8 illustrates the definition of
abnormal subsequences:

Algorithm 3: Block Segmentation pseudo-code.

Input:
T: Data
bl: block length (power of 2)
Output:
Segmented time series
Begin
- Fix the number of clusters (depend of bl).
- Charge data and split it into x (data length/bl) blocks of bl
length Figure 8. Abnormal points illustration in univariate time
- Use APCA for each block series.
- Concatenate segments
End DBSCAN will detect abnormal points do not fit any of
clusters, we varied eps between 20% and 70%. The num-
ber of abnormal points decrease when we increase eps, as
The block segmentation is simple and does not require neces- summarized in table 2 :
sarily the number of segments. This approach can be adapted Table 2. Abnormal points using different eps.
for an online or parallel segmentation versions. The figure
7 illustrates the concept of segmentation into time windows
(block), the number of segments is the same for each block, Abnormal
also the length of the time window. Multivariate ACMS data eps(minpts = 5)
segments
0.2 85
Bleed system 0.5 69
0.7 45

A good detection depends on the flights number. We tested

our approach for only 10 flights test, which explain the several
abnormal sequences. We plotted the results of DBSCAN
with eps=0.5 in figure 9, each color represents a cluster, the
outliers are uncolored.

Figure 7. Example of using APCA into time windows.

4. A NOMALY DETECTION
Anomaly detection consists in detecting abnormal data that
do not belong with normal behavior. We noticed that most
of measured parameters in ACMS have the same behavior.
In fact, data that recur for several flights will be clustered as Figure 9. dimension representation of DBSCAN with
normal. eps=0.5 (outliers = non colored data, clusters = colors).
The approach that we propose is performed in two stages. We
summarize data by the segmentation approach proposed in
section 3, where each segment contains a value that represents We used PCA (Principal component analysis) for visualizing
the original data. we transfer then the problem of collective clusters. Technically the majority of data belong to the
detection (subsequences) to point anomaly detection. DB- normal groups, since the sensor is supposed to have a normal
SCAN is applied to the parameters of the same type only. We behavior. We have an efficient results when the number of
5
flights is high. Otherwise, we are confronted to huge number
of false alarms when we don’t have enough flight data. In
the figure the uncolored segments do not belong to any of the
normal cluster.
5. CONCLUSION
The approach that we applied was more sensitive to abnormal
sequences then other types of anomalies. In our approach we
assume that normal data have generally the same behaviors
and normal patterns are frequently repetitive from a flight
to other. Given the enormous amount of generated data
containing noise and incomplete data, we used segmentation
approach to simplify the data. APCA with a slight adjustment
was the perfect candidate. Clustering time execution is better
using segmentation data than real data.
With our approach, the potential anomalies are more visible,
and the times series are easier to manipulate and visualize.
The visualization tool helps experts to decide whether each
anomaly should be programmed or not, with the possibility
to score or penalize the detection. Then a data base is
updated, which will allow us to test new algorithms and other
approaches.
R EFERENCES
[1] Manish Gupta and Jing Gao and Charu C. Aggarwal
and Jiawei Han, Outlier Detection for Temporal Data: A
Survey, 201.
[2] Chandola, V., Banerjee, A., Kumar, V. (2009). Anomaly
detection: A survey ACM Computing Surveys, 41(3), 15.
[3] Lishuai Li and R. John Hansman, Anomaly detection in
airline routine operations using flight data recorder data,
Report No. ICAT-2013-4 June 2013
[4] A. N. Srivastava S. Budalakoti and M. E. Otey. Anomaly
detection and diagnosis algorithms for discrete symbol
sequences with applications to airline safety. IEEE Trans-
actions on Systems, Man, and Cybernetics, Part C: Ap-
plications, 39:101113, Jan 2009.
[5] C. Brodley et al. T. Lane. Sequence matching and learn-
ing in anomaly detection for computer security. In AAAI
Workshop: AI Approaches to Fraud Detection and Risk
Management, page4349, 1997.
[6] Santanu Das, Bryan L. Matthews, Ashok N. Srivastava,
and Nikunj C. Oza. 2010. Multiple kernel learning for
heterogeneous anomaly detection: algorithm and avia-
tion safety case study. In Proceedings of the 16th ACM
SIGKDD international conference on Knowledge discov-
ery and data mining (KDD ’10). ACM, New York.
[7] B. Scholkopf, J. C. Platt, J. Shawe-taylor, A. J.Smola
and R. C. Williamson, Estimating the Support of a High-
Dimensional Distribution, 2001, Vol. 13, No.7, Neural
Computation, issn 0899-7667, MIT Press, Cambridge,
MA, USA, pages 14431471.
[8] Stan Salvador and Philip Chan and John Brodie, Learning
States and Rules for Time Series Anomaly Detection,
2003.
[9] Stan Salvador and Philip Chan, Determining the num-
ber of clusters/segments in hierarchical clustering-
segmentation algorithm, 2003
[10] Gerhard Munz, Sa Li, Georg Carle, Traffic Anomaly
6
Detection Using K-Means Clustering,
[11] M. Gupta, H. C., A. B. Sharma, Jiang, G. (2013). Con-
text aware time series anomaly detection for complex
systems.
[12] Eamonn Keogh, Jessica Lin, Ada Fu, HOT SAX: Find-
ing the Most Unusual Time Series Subsequence: Algo-
rithms and Applications, ICDM ’05 Proceedings of the
Fifth IEEE International Conference on Data Mining.
[13] Kulahcioglu B., Ozdemir S., Kumova B.I., Application
of Symbolic Piecewise Aggregate Approximation (PAA)
Analysis to ECG Signals, The 17th IASTED Interna-
tional Conference on Applied Simulation and Modelling
(ASM 2008) .
[14] M. Ester, H.-P. Kriegel, J. Sander, and X. Xu, A density-
based algorithm for discovering clusters in large spatial
databases with noise, in Proceedings of the 2nd Inter-
national Conference on Knowledge Discovery and Data
mining, 1996, pp. 226231.
[15] Keogh, E., Chakrabarti, K., Pazzani, M. Mehrotra, S.
(2001). Locally adaptive dimensionality reduction for
indexing large time series databases. In proceedings of
ACM SIGMOD Conference on Management of Data,
May. pp 151-162
B IOGRAPHY [
Mohamed Cherif DANI Airbus R&D
engineer in machine learning and e-ops
maintenance. He received in 2012 a
master degree in computer science from
Paris Descartes university. He works
actually on Embedded anomaly detec-
tion and Prognostic using data driven
techniques. In collaboration with Paris
Descartes University, he is preparing a
thesis in the automatic and autonomous
detection of anomalies in Aircraft.
Cassiano FREIXO Prognostic and
Health Management Expert, Airbus.
His current research activities include
Aeronautical Maintenance, Prognostic
Health Monitoring, Maintenance De-
cision Support and Ground Informa-
tion Tools (BITE/CMS, MEL). He has
more than seven years of experience in
Technology and Product Development
(Loads Design, Operational Loads Mon-
itoring, Structural Health Monitoring, Prognostic and Health
Monitoring) with Embraer.
 François-Xavier Jollois FX Jollois is an
assistant professor in Computer Science,
at University Paris Descartes, since
September 2004. His research concerns
unsupervised learning, especially clus-
tering, with mixture models approach on
binary, categorical and numerical data.
He uses EM algorithm and its derivative
(CEM, SEM, ...)

Mohamed NADIF Mohamed Nadif is

Professor at the University of Paris-
Descartes, France, where he is a mem-
ber of LIPADE (Paris Descartes com-
puter science laboratory) in the Math-
ematics and Computer Science depart-
ment. His research interests include ma-
chine learning, data mining, modelbased
cluster analysis, coclustering, factoriza-
tion and data analysis.