A Review of Flight Abnormal Behavior Analysis and Trajectory Anomaly Detection Methods

Abstract

Air traffic is increasingly complicated, and with the expansion of the aviation industry, a growing emphasis on the safety of flight is being driven. According to flight experience and safety regulation standards, flight abnormal behavior is typically manifested through trajectories as well as other behavioral characteristics. Trajectory anomaly detection is a critical component for ensuring flight safety. This paper presents a comprehensive review that covers flight abnormal behavior analysis and trajectory anomaly detection. The definition of flight abnormal behavior and trajectory is clarified at first. Then, this paper proposes a framework of anomaly detection in flight trajectory. On this basis, the review expounds upon the methodologies that have been employed in three primary types of trajectory anomaly detection: speed anomalies, altitude anomalies, and heading deviations. The main applications in this field consist of anomaly warning, online real-time anomaly detection, and the quantitative evaluation of flight abnormal behavior. Future research should encompass studies on the classification of flight traffic behavior classification, the integration of flight trajectory, and other data sources to identify flight abnormal behaviors. This study contributes to furnish more actionable insights for the advancement of trajectory anomaly detection technologies, offering significant implications for an in-depth comprehension of flight abnormal behavior.

1. Introduction

The safety of flight is the basis of high-quality aviation. With the burgeoning development of the aviation industry, there has been a steady growth of air traffic flow complexity improving, which has put forward higher requirements for flight safety, efficiency, and the quality of air traffic management services. According to the annual safety report released by the International Civil Aviation Organization (ICAO) [1], the number of global aviation accidents has increased since 2020, a trend that correlates with the concurrent growth in flight volume. Consequently, as the volume of air traffic increases, flight safety becomes significantly more pronounced.

Commercial flights, carrying passengers and cargo, are nominally expected to maintain stable and smooth trajectories. However, the analysis of aviation accidents has revealed that the flight often manifests abnormal trajectory prior to the occurrence of unsafe events. For instance, in the Air France Flight 447 accident, the aircraft experienced a highly abnormal trajectory, characterized by a rapid climb to 38,000 feet at a high rate, followed by a sustained stall and a severe descent within a brief three minutes. Therefore, the early detection of such trajectory deviations can provide short-term risk warnings for impending accidents.

Anomaly detection in trajectory is a contributor to the safety of aviation. The research on flight trajectory anomalies has been ongoing for a long time, having historically evolved into two primary methodological approaches. The first approach involves warning of abnormal behaviors based on relevant safety regulations and flight experience. According to the “Upset Prevention and Recovery Training (UPRT) Guidance Material for Transport Category Airplane” issued by the Civil Aviation Administration of China (CAAC) [2], flight abnormal behaviors refer to states where the aircraft deviates from the pilot’s expectations or unintentionally diverges from normal operating parameters, involving variations in pitch, roll, and speed inconsistent with conditions. When an aircraft enters such an abnormal state, its flight parameters may exceed expectations or deviate from the normal envelope, which in turn triggers an alert. The second approach is grounded in statistical theory, where an anomaly is defined as “data deviating from or nor being in agreement with what is considered normal, expected or likely in terms of the data probability distribution, or the shape and amplitude of a signal in time series” [3]. In contrasts to the first approach having obvious practical engineering implications, the second type is more analogous to statistical outliers. Whether these outliers possess clear operational significance of guidance requires further analysis. Therefore, synthesizing these two approaches and raising a comprehensive framework for academic research are of great significance for subsequent studies.

To establish a rigorous framework, this paper explicitly defines flight abnormal behavior as the operational deviation from safety envelopes. In the context of civil aviation technical standards, the safety envelope represents the multidimensional safe flight regime. It is bounded by critical limits on parameters such as airspeed, load factor, angle of attack, and attitude. Adherence to this envelope ensures that the aircraft maintains both structural integrity and aerodynamic controllability. On the other hand, trajectory anomaly is the statistical manifestation of these behaviors in multidimensional data. Their synergistic relationship lies in trajectory detection providing the quantitative evidence needed to identify and mitigate underlying abnormal behaviors.

Regarding flight trajectory, most research has primarily and predominantly employed the offline analysis of historical trajectory data to inform studies on flight operations, flight course design, safety management, and other aspects. The main research affiliations for this field are National Aeronautics and Space Administration (NASA), European Union Aviation Safety Agency (EASA), and CAAC, which have carried out a series of studies [3,4,5,6,7]. In 2007, Federal Aviation Administration (FAA) [8] initiated the Distributed National FOQA Archive (DNFA) project. NASA researchers [9] launched the Aviation Safety Technology Portal (ASTEP) project. Relying on the flight data collected by DNFA, this project developed and applied key technologies for anomaly detection. This initiative also released several open-source tools specifically for flight data, such as Nu-Anomica, Sequence-Miner, Multiple Kernel Based Anomaly Detection (MKAD), ClusterAD-Flight, and so on [10]. NASA’s Airspace Operation and Safety Program (AOSP) [11] developed anomaly detection algorithms like Automatic Discovery of Precursors in Time series (ADOPT) and deep temporal multiple-instance learning (DT-MIL), utilizing Reinforcement Learning (RL) and Multi-Instance Learning (MIL) theories.

In 2024, The latest European Plan for Aviation Safety (EPAS) was published by EASA [12]. It introduced new rulemaking tasks (RMTs), including safety concerns related to take-off parameters and position errors, a regulatory framework for artificial intelligence trustworthiness, and the European Safety Management process. This initiative provides a substantial boost to active safety management for aviation.

Almost in sync with European and American countries, CAAC has released key strategic documents, such as the “14th Five-Year Plan for Civil Aviation Development” [13] and the “Roadmap for Smart Civil Aviation Development” [14], which explicitly point out the need to build a prominent aviation safety management system to effectively address challenges in continuous safety, autonomous assurance, and emergency response. Notably, it puts forward the research and development imperatives for monitoring flight abnormal behavior and trajectory, intelligent warning system, as well as air–ground collaborative intervention.

Modern aviation safety is increasingly transitioning from traditional reactive methods to proactive and predictive safety management. According to the ICAO Safety Management Manual [15], proactive management involves actively seeking to identify safety risks through the analysis of an organization’s activities, while predictive management aims to discover potential future problems by analyzing system performance. This study follows the Accident Chain Theory [16,17], positing that major accidents are preceded by numerous minor, often fuzzy, flight events. Timely identification and reporting of precursors provide an intervention window to break the sequence of events before they culminate in a disaster.

Beyond specific industry initiatives, methodological research in anomaly detection has provided a robust framework for analyzing high-dimensional flight data. Chandola et al. [18] reviewed anomaly detection applications in fault detection, intrusion detection, and medicine. Focusing on specific data characteristics, Chandola et al. [19] synthesized anomaly detection methods for discrete sequence data, encompassing sequence-based, continuous subsequence-based, and pattern frequency-based techniques. Similarly, Gupta et al. [20] concentrated on outlier detection specifically within temporal data, analyzing time series properties that align with the dynamic evolution of flight paths. To address the heterogeneity of multidimensional datasets, Akoglu et al. [21] reviewed introduced graph-based approaches, emphasizing the significance of anomaly attribution in complex systems. In response to the application needs, several surveys have focused on data analytics with machine learning methods [22,23,24], causal analysis for identified anomalies [25], and aero-engine fault diagnosis [26]. The focus of this review is strictly concentrated on the applicability of these data-driven paradigms to flight safety. Although these studies are grounded in diverse data types, they provide valuable methodological insights for the flight trajectory research, which is the focus of this paper.

This paper aims to review the scientific literature related to anomaly detection across flight behavior and trajectory from 2010 to 2025. There is a mixed methodology with qualitative and quantitative analysis. The motivation of this paper is to explore the key technical issues and current research progress in trajectory anomaly detection, striving to build and construct a technical framework for two types of anomaly detection methods by qualitative analysis. And the highest cited literature is listed by quantitative analysis. Additionally, the analysis for the correlation between behavior and trajectory provides professionals with existing knowledge to guide future management and decision-making.

Key contributions of this study:

• Comprehensive Review: This work systemically reviews the challenges, methodologies, and techniques used for traffic behavior analysis and anomaly detection in flight trajectory.
• Conceptual Synthesis and Foundational Definition: We synthesize the two primary anomaly paradigms, namely regulation-based and data-driven. We establish a clear definition of flight abnormal behavior and elucidate the conceptual underpinnings of flight trajectory anomaly, creating a unified framework for analysis.
• Proposing an Integrated Research Framework: We establish a comprehensive research framework that bridges statistical detection and operational reality for trajectory anomalies. This framework establishes a logical mapping from qualitative abnormal behaviors to quantitative multivariate trajectory models, providing a methodological foundation for transforming statistical outliers into actionable operational insights.
• Actionable Insights for Flight Abnormal Behavior Analysis: By synthesizing existing research, we provide a foundation for the development of more effective early warning and proactive intervention strategies in anomaly detection of flight behavior.

The remainder of this paper is organized as follows: Section 2 reviews transportation behavior research, defines flight abnormal behavior based on safety regulations, and elaborates on the concept of flight trajectory anomalies; Section 3 outlines the research methodology, identifies existing challenges, and proposes a comprehensive framework for trajectory anomaly detection; Section 4 discusses recent progress for flight abnormal behavior identification based on trajectory, namely speed, altitude, and heading; particularly, it presents the main relevant applications; Section 5 proposes the future research of flight behavior and trajectory; Section 6 concludes the work and innovations of this paper.

2. Definition and Characteristics of Flight Abnormal Behavior and Trajectory Anomalies

2.1. Flight Behavior

Flight behavior is conceptualized as the systematic observation and interpretation of intrinsic attributes of air traffic, including speed, heading, and positional information [27]. Inefficient behaviors can be systematically identified from flight trajectory datasets. Observation of extensive historical flight trajectories [28] reveals that, to minimize fuel consumption and flight time, flights generally endeavor to maintain straight-level flight or continuous descent profiles, except at designated turning points. Accordingly, an idealized flight trajectory can be seen as consisting only of waypoint turns and straight segments, with corresponding behavioral patterns of turning and straight flight. Nevertheless, when affected by sudden weather or traffic conflict resolution, flights may be required to enter holding patterns or execute step-down descents. These non-ideal maneuvers inevitably extend flight time and distance, manifesting as a form of inefficient behavior. Inefficient behaviors can be systematically identified from flight trajectory datasets.

According to the Global Air Navigation System Performance Manual published by ICAO [29], efficiency is defined along two primary dimensions: time and distance. Inefficiency behavior refers to flights that take longer or cover more distance than necessary. Huang et al. [30] detected loitering by examining continuous changes in trajectory heading, identifying circular maneuvers where horizontal heading shifts exceeded 360$°$. Guastalla [31] measured the efficiency of detour trajectories by comparing actual flight distances with the shortest possible trajectory, using their ratio as the metric. Zhao et al. [32] employed an optimal performance reference profile, measuring vertical deviations to evaluate vertical efficiency and the ratio of extra to unimpeded approach time to assess horizontal efficiency. Their analysis distinguished efficient continuous descent operations from inefficient stepwise descents. The team [33] further found the impact of detour and holding patterns on overall approach efficiency.

In contrast to merely inefficient behaviors, safety-related abnormal behaviors warrant paramount concern. Thus, CAAC, ICAO and other institutes have promulgated dedicated regulatory frameworks, as summarized in

Table 1. The flight abnormal behaviors based on safety regulations.

Institute	Policy	Document Content	Observation and Measurement of Flight Abnormal Behaviors
CAAC	Real-time guide to air carrier operational control risk management system [34]	Provides a detailed specification of an operational control risk management system grounded in system safety management. Builds a flight operations database, quantifying relevant risk factors and developing a corresponding evaluation model. Introduces nine monitoring indicators for assessing operational control risks during flight.	When variations in risk factors cause the flight’s operational risk level to increase from low to high, the system generates alerts for the dispatcher. These include indications of insufficient fuel, temporary system malfunctions, and abnormal flight states such as deviations in altitude, speed, or trajectory.
	Airplane upset prevention and recovery training aid [2]	1. An aircraft upset state refers to an unanticipated condition in which the aircraft exhibits unintentional departures form nominal operation parameters, including deviations in pitch and roll, as well as airspeed inconsistent with conditions. 2. For unexpected states, proactive monitoring of the operational environment, the aircraft’s energy state, and its flight path is required.	Through a proactive, knowledge-driven monitoring process, both expected and actual flight states are continuously assessed to detect flight abnormal behaviors, including turbulence-induced deviations in airspeed, altitude or attitude, rapid departures from stable flight paths, icing-related performance loss, system failures, and improper flight handling.
	Flight operations quality assurance (FOQA) implementation and guidelines [35]	For Airbus and Boeing aircraft, each flight phase has predefined monitoring parameters. When recorded values reach or exceed set thresholds, the deviation from the standard is used to classify the event severity and improve crew handling performance.	Leveraging data from ADS-B and QAR, the system evaluates parameter deviations and risk levels by checking whether features like airspeed, landing-gear status, and flap position exceed their thresholds at key monitoring points. Indicators such as minor/major deviation and exceedance duration are used to detect abnormal behaviors, including speed or altitude exceedances, abnormal roll/pitch angels, incorrect takeoff or go-around configurations, flight-path deviations, and alert-system activations.
	Civil aviation control traffic management rules [36]	1. Low-altitude warnings; 2. Continuous changes in heading due to air traffic control (ATC)-directed go-around and holding patterns; 3. The aircraft actively reports abnormal information.	Low-altitude anomalies are detected using automated alerting systems. Go-arounds and holding patterns are identified based on ATC approach requirements. If the radar shows an aircraft using transponder code 7500 or 7700, the controller is required to report the abnormal condition proactively and maintain continuous surveillance of the flight path.
EUROCAE	Minimum aviation system performance specification for criteria to detect in-flight aircraft distress events to trigger transmission of flight information [37]	Sets the minimum standards governing the detection and trigger logic of in-flight distress events, and additionally designates the minimum exceedance duration as a criterion for determining abnormal conditions.	According to threshold definitions for flight-data parameters, four categories of abnormal flight behaviors are detected: abnormal attitudes (excessive roll, pitch, or yaw values and their associated rates of change), speed anomalies (high vertical speed, stall, low-altitude speed, overspeed), risk of controlled flight into terrain (proximity to terrain or inadequate altitude for the aircraft’s position), and complete loss of engine thrust.
ICAO	Operation of aircraft annex 6 [38]	Specifies in detail the safety operational standards applicable to aircraft during the takeoff, climb, cruise, descent, and approach/landing phases, including requirements associated with systems such as the Ground Proximity Warning System (GPWS) and the Airborne Collision Avoidance System (ACAS).	Abnormal behaviors that activate the aircraft’s automated alerting systems during flight.
	Global aeronautical distress & safety system (GADSS) [39]	Depending on the applicable airspace, flight phase and flight conditions, the aircraft’s 4D trajectory is tracked. The onboard system reports its status every 15 min, including position, altitude, and time.	Utilizing functions such as continuous flight tracking and autonomous distress-tracking capabilities, the system monitors the aircraft’s operational state in real time, allowing for prompt detection and reporting abnormal behaviors such as position-update irregularities and altitude deviations.

.

Beyond these regulations, the academic community has developed a variety of anomaly identification methodologies. The fundamental distinction is that regulations rely on rules and indicator thresholds, whereas academic studies employ more sophisticated analytical methods, such as K-Means [40], K-Medoids [41], and DBSCAN [42] along with neural network techniques like autoencoders [43]. These models are designed to conduct multi-factor anomaly analysis, identifying specific deviations such as speed anomalies [44], anomalous energy states [45], and heading anomalies [46]. Miyamoto et al. [47] characterized flight behavior within the terminal airspace. Leveraging ADS-B data, they identified common trajectory patterns to establish a baseline model for nominal behavior to detect deviations as anomalies. From a statistical standpoint, anomaly detection can be achieved by extracting common patterns from historical trajectory datasets, where deviations from such patterns are classified as anomalies [48].

Flight behavior research can be categorized into inefficient behaviors and abnormal behaviors from efficiency and safety perspectives. Owing to the paramount importance of safety, abnormal behavior research understandably attracts far greater focus. Regarding research objects, flight trajectories and derived variables like speed and acceleration are the main sources for behavior identification. Besides this, other critical data sources for analysis include parameters from the Quick Access Recorder (QAR), such as angular rotation rates and onboard system alert information. Methodologically, aside from the predefined parameter alert thresholds specified in regulations in Table 1 for engineering implementation, the prevailing research on inefficient and abnormal behaviors relies on clustering historical trajectories to derive representative behavioral benchmark models. The degree of a trajectory’s deviation from the benchmark is then used to classify it as inefficient or abnormal [48]. Other studies employ flight-mechanics analytical models to derive optimized trajectory benchmarks form flight plans [49,50,51], or adopt Standard Operating Procedures (SOPs) as benchmark references [52]. In view of the foundational role of the flight trajectory in behavioral analysis, the subsequent sections of this study are developed upon trajectory-based research.

2.2. Flight Trajectory Analysis

Trajectory data is mainly derived from secondary surveillance radar (SSR) used in air traffic control and Automatic Dependent Surveillance-Broadcast (ADS-B). SSR employs an interrogation/response mode for target observation, estimating the kinematic parameters of aircraft through received data. ADS-B is an air traffic control surveillance technology based on the Global Positioning System [53]. Aircraft automatically broadcast data such as their position, altitude, flight identification number, speed, and heading. Consequently, the aircraft trajectory of an aircraft can be defined as a set of discrete points:

$$\overrightarrow{T}=\left(p_1,p_2,\dots ,p_n\right),$$

(1)

Each trajectory point is defined as

$$p_i=\left\{x,y,z,t,v,\theta \right\},$$

(2)

where $t$ is the timestamp of the trajectory point; $x,y,z$ denote the geographical coordinates of the trajectory point; $v$ is the velocity; and $\theta$ represents the heading. In the context of ADS-B data and this multivariate model, heading (specifically the track angle in horizontal plane) refers to the aircraft’s orientation relative to the North. It is a critical horizontal parameter describing the direction of the aircraft’s velocity vector. It must be explicitly distinguished from vertical-dimensional parameters such as the flight path angle, which characterizes the vertical profile (climb or descent rate) rather than horizontal orientation.

The QAR data comprises thousands of parameters on flight states, engine operating conditions, and cockpit inputs. Supported by QAR data, the definition of flight trajectory can be extended to higher dimensions, such as incorporating spatial attributes like climb and descent rates [52]. Furthermore, Puranik [45] introduced the energy characteristics of trajectories based on ADS-B data. Referencing the key alert parameters outlined in Table 1, the mathematical description of the multivariate trajectory model for flight trajectories is

$$p_i=\left\{x,y,z,t,v,\theta ,\mathsf{\Omega },\delta \right\},$$

(3)

where $\mathsf{\Omega }$ and $\delta$ represent the aircraft’s attitude and energy characteristics, respectively.

The variables in Equation (3) can be extracted from operational flight data. Statistically, a flight is considered anomalous if its trajectory significantly deviates from the distributional characteristics observed across a large sample of trajectories [3]. Olive and Basora [51] defined a bounding box around the trajectory set. Leveraging autoencoder principles, they projected the trajectories within this box into a lower-dimensional latent space. The model was then trained via backpropagation, with the explicit objective of minimizing the reconstruction error, to generate a reconstructed output corresponding to the original input. To ensure dimensional consistency across heterogeneous parameters such as altitude, heading, and speed, the reconstruction error is calculated within a standardized unitary space. The measure of discrepancy between an observed trajectory and its reconstructed counterpart is defined using weighted normalized relative units, typically following an exponential distribution:

$$l_{u,v}=\sqrt{{\sum }_{i=1}^m{w}_i{\left({\displaystyle \frac{u_i-v_i}{B_i}}\right)}^2},$$

(4)

where $l_{u,v}$ is the loss function derived from the input trajectory set, representing the comprehensive reconstruction error in a standardized space; n is the number of valid samples for variable i; $m$ is the total number of trajectory variables included in the multivariate model; $u_i$ and $v_i$ are the observed and reconstructed values for variable i; $B_i$ denotes the prescribed baseline or reference value for variable i; and $w_i$ is the weighting factor assigned to the variable i, reflecting its relative significance and risk level regarding flight safety. For instance, altitude deviations during approach phases are assigned higher weights due to their direct impact on safety margins. A higher reconstruction error indicates a greater degree of anomaly. Therefore, the reconstruction error serves as the primary criterion for identifying abnormal flight trajectories.

On this basis, the magnitude of trajectory reconstruction error enables differentiation between inefficient and abnormal trajectories, providing a quantitative measure of flight behavior. A relatively minor reconstruction error often corresponds to an inefficient trajectory that departs from the benchmark trajectory and increases operational cost yet still lies within acceptable safety margins. In contrast, a large reconstruction error, especially one exceeding a critical threshold, characterizes an abnormal trajectory associated with meaningful safety risks. As illustrated in Figure 1 [51], in the sample set, using the top 20% of reconstruction error as the threshold, the set identifies the red abnormal trajectories, corresponding to a reconstruction error range of 0.2–0.4.

The conventional approach for assessing flight behavior involves monitoring key safety parameters for exceedances, which are professionally defined as a “Flight Event”. For instance, according to the FOQA Guidelines [35], specific monitoring items and standards are established for different flight phases. Taking the “Large Liftoff Speed” event as an example, the monitoring point is set at the moment of main gear liftoff; if the airspeed deviation exceeds $\left(V_2+25\right)$ kn, it is categorized as a “mild deviation,” and if it exceeds $\left(V_2+30\right)$ kn, it is classified as a “severe deviation”. Descriptions of limits in such manuals are deterministic. Consequently, Burdun [54] proposed an intervalization approach for safety parameters, using different colors to delineate deviation levels. Nevertheless, this method fails to reflect the directionality of parameter exceedance and cannot provide pilots with explicit control suggestions.

To address the fuzzy set problem arising from deterministic boundaries, Li et al. [55] proposed a method of partitioning risk levels through color-coded annotations, providing a scientific theoretical basis for resolving the fuzziness in pilots’ perception of physical boundaries. On this basis, this study adopts four colors, namely black, red, yellow, and green, to intuitively represent the deviation levels of flight parameters. The specific level definitions are as follows:

• Level 1 (Green—Safe): Parameters lie within the nominal allowable range.
• Level 2 (Yellow—Attention): An “Attention” state, corresponding to significant deviations that do not yet constitute a violation.
• Level 3 (Red—Dangerous): A “Dangerous” state, typically corresponding to deviations that violate flight regulations.
• Level 4 (Black—Disaster): Parameters exceed the limit values, representing a “Disaster” state with potential crash or accident risks.

Table 2. Boundary values and color-coded intervals for safety-related flight parameters (Case: Level flight at 3000 m, 150 m/s).

Parameters	Limit Values
	$$\mathit{a}$$		$$\mathit{b}$$		$$\mathit{c}$$		$$\mathit{d}$$		$$\mathit{e}$$		$$\mathit{f}$$
$$\mathrm{V}/(\mathrm{m} · {\mathrm{s}}^{-1})$$	90		100		115		250		280		230

The letters $a$, $b$, $c$, $d$, $e$, $f$ represent the critical boundary values that partition the flight parameter space into distinct risk intervals. The color blocks represent four deviation levels: Green (Level 1 - safe, $c<x<d$; Yellow (Level 2 – Attention, $b<x<c$ or $d<x<e$); Red (Level 3 – Dangerous. $a<x<b$ or $e<x<f$); Black (Level 4 – Disaster, $x<a$ or $x>f$).

provides a specific example of parameter interval division under the condition of level flight at an altitude of 3000 m and a speed of 150 m/s. Within this system, Level 4 (Black—Disaster) occurs when $x<a$ or $x>f$, indicating that the parameter has exceeded its safety limit and a potential accident has transpired. Level 3 (Red—Dangerous/Violation) is defined by the intervals $a<x<b$ or $e<x<f$, representing a state where the parameter is considered “dangerous”. Level 2 (Yellow—Attention/Response Warranted) corresponds to an “attention” state when the parameter falls within $b<x<c$ or $d<x<e$. Finally, Level 1 (Green—Safe) represents the range $c<x<d$, where the parameter remains within a designated safe operational envelope.

The comprehensive safety of the entire flight is determined by the superposition of the highest deviation levels of all key parameters at each moment. The comprehensive deviation value R for the entire predicted period can be quantified using the following weighted probability formula:

$$R=P_b{V}_b+P_r{V}_r+P_y{V}_y+P_g{V}_g,$$

(5)

where $P_b$, $P_r$, $P_y$, $P_g$ represent the percentages of the total duration spent in the black, red, yellow, and green levels, respectively; and $V_b$, $V_r$, $V_y$, $V_g$ are the predefined severity scores for each level. This quantitative model effectively enables a comprehensive assessment of flight behavior safety, identifying potential hazards before they escalate into accidents, furthermore recognizing that several minor events can combine to prove fatal.

Accordingly, an abnormal trajectory is defined as a statistically significant deviation from the underlying distribution of nominal trajectories that surpasses the established safety thresholds. Anomaly detection involves employing reconstruction error and related metrics to quantify the deviation of an actual flight trajectory from its trajectory benchmark, thereby enabling the identification and categorization of inefficient and safety-related abnormal behaviors. To achieve this systematically, this study further explores flight trajectory anomaly detection.

2.3. Relationship Between Flight Abnormal Behavior and Trajectory Anomaly

Flight abnormal behavior and trajectory anomaly are distinct yet related concepts. According to safety regulations, flight abnormal behavior is defined within the framework of civil aviation industry regulations. It refers to states where an aircraft violates established safety standards or deviates from the pilot’s expectations due to mishandling or environmental factors. Conversely, trajectory anomaly is a concept established from a statistical and research perspective. It characterizes observations that are mathematically inconsistent with the majority of the data or the nominal distribution.

The relationship between the two is that statistical trajectory anomalies represent a broader category that encompasses regulatory abnormal behaviors. Furthermore, trajectory anomalies often act as precursors to abnormal behaviors. For instance, subtle deviations in flight path or energy states can be detected statistically well before they reach the hard thresholds defined by industry regulations. Therefore, trajectory anomaly detection is of great significance for identifying flight abnormal behaviors and offering actionable insights for proactive safety management.

3. A Comprehensive Framework for Research on Trajectory Anomaly Detection

According to the previous definition, flight trajectory anomaly detection involves three steps: trajectory data processing, trajectory clustering, and anomaly detection. By extracting and preprocessing key parameters from data sources such as ADS-B and QAR, trajectory clustering is conducted to identify abnormal trajectories, thereby achieving anomaly detection of aircraft trajectory, and improving flight safety. With the recent progress of a data-driven paradigm, this field of research still confronts the following problems and challenges:

• Trajectory data processing: Firstly, the capability to effectively process massive and complex datasets constitutes a significant bottleneck in anomaly detection [56,57,58,59,60]. Especially in high-dimensional data, anomalies are not explicit and possess a high degree of subtlety [48,61,62]. Secondly, as anomalous events are typically rare, there is a scarcity of training and validation samples, which are also unevenly distributed, further compounding the difficulty [63,64,65,66,67]. Consequently, anomaly detection research should contend with issues of data sparsity, stringent accuracy requirements, and restricted computational resources.
• The quality of trajectory clustering: Whether all anomalies can be detected through a relevant methodology is a key measure of the quality of clustering. Central to trajectory clustering is the selection of an appropriate distance function [68,69,70]. Furthermore, strengthening both the accuracy and computational efficiency of trajectory clustering algorithms has been a sustained focus of surveys [44,71,72,73,74,75,76,77,78,79,80,81,82,83,84].
• Anomaly identification: The discrimination of anomalies primarily relies on thresholds established through statistical outlier detection and regulatory standards. It is hard to set a threshold range that accounts for all possible abnormal behaviors. As previously mentioned, trajectory anomalies refer to outliers that cause abnormal maneuvering of a flight [51]. The challenge lies in the fact that outliers based on statistical anomalies may not necessarily align with the anomalies of concern according to regulations. The demarcation between normal instances and anomalous ones is usually imprecise and evolves in some application domains.
• The robustness and interpretability of anomaly detection: Owing to the heterogeneity of anomaly definitions across application domains, current research predominantly relies on small-scale implementations using open-source libraries of algorithms. There is a lack of training methods, experience, and theoretical frameworks for large-scale models [85,86,87,88,89]. In addition, the “black box” inherent in such models hinders the assurance of generalization and interpretability of the algorithms and results, which in turn constrains their broader adoption [90].

Taking into account the aforementioned challenges and the specific characteristics of flight trajectory anomaly research, a comprehensive framework for research on trajectory anomaly detection is built, as shown in Figure 2.

The core of the proposed integrated framework lies in the one-to-one mapping between “behavioral anomalies” defined by safety regulations and “trajectory outliers” calculated by data models. This framework consists of four key modules: regulation-based behavior classification, multivariate trajectory modeling, targeted algorithm matching, and application scenario mapping.

3.1. Classification of Flight Abnormal Behaviors

Through an analysis of safety-oriented abnormal flight behaviors, the types of exceedance parameters in Flight Operational Quality Assurance (FOQA) are reviewed. The elements of flight abnormal behaviors are summarized, namely speed anomalies, altitude anomalies, and head variation. These elements can be combined into various abnormal behaviors.

To systematically visualize the research landscape, following the bibliometric analysis methodology demonstrated in aviation studies [91], a comprehensive analysis was conducted specifically on the literature related to abnormal trajectory. This approach facilitates a quantitative mapping of the core themes, major contributors, and evolving trends within the domain. By extracting data from the Web of Science database, a quantitative analysis of keywords in the relevant literature was emphasized, as shown in Figure 3. The first major category highlighted in blue focuses on foundational modeling and conflict detection, providing the theoretical framework for trajectory prediction. The second major category marked in yellow represents safety management and uncertainty, emphasizing how machine learning enhances flight safety standards. The third category marked in green encompasses research on trajectory-related algorithms, including trajectory optimization and design, conflict resolution and trajectory prediction, and efforts to enhance the certainty and robustness of models. The fourth category marked in purple centers on trajectory tracking and predictive modelling. The fifth category highlighted in red comprises studies on anomaly detection techniques grounded in abnormal behaviors, including deep learning, time-series-based methods, and discrete data detection.

The relationship among these clusters collectively encompasses anomalous flight behaviors, termed Cluster 5, trajectory-related algorithms; models, termed Cluster 1, Cluster 3 and Cluster 4; and practical application value, termed Cluster 2. Specifically, the algorithms and models provide the technical means for tracking, anomaly detection, and trajectory prediction, while the analysis of anomalous behaviors serves the goal of improving flight safety and operational management. Therefore, these categories form a comprehensive framework for trajectory anomaly detection.

3.2. Establishment of the Multivariate Flight Trajectory Model

The aircraft trajectory model is constructed to identify anomalies in trajectory points based on multidimensional data. Key trajectory parameters such as latitude, longitude, altitude, heading, and airspeed are extracted from data sources like SSR and ADS-B to build the trajectory model. Complementarily parameters representing aircraft attitude, such as pitch and roll angle, are extracted from QAR to establish a more comprehensive trajectory model. In essence, trajectory characteristics values are used to indicate the flight behaviors.

Anomalies of trajectory points basically include position-update anomalies and aircraft-initiated anomalous information. Position-update anomalies refer to situations where the trajectory information of a flying aircraft has not been updated for a long time. Aircraft actively transmit anomaly information like A7500, A7600, and A7700 under conditions such as illegal interference, radio communication failure, emergencies, and distress. These issues are closely related to research on trajectory tracking [92,93] and emergency handling [39], and have little relation to aircraft abnormal behaviors. It is not discussed further in this paper.

3.3. Anomaly Identification Techniques

Building on the multivariate trajectory model, trajectory tracking serves as the foundational mechanism for generating the benchmark trajectory. Its primary role is to establish a high-fidelity reference baseline that represents the aircraft’s intended or nominal flight path, providing a quantitative starting point for subsequent anomaly identification. Combined with the results of the bibliometric analysis, the research on the identification techniques of aircraft abnormal behaviors is decomposed into four categories: speed anomalies, altitude anomalies, heading variation, and trajectory point anomalies. These anomalies are then identified using a suite of algorithms and models such as trajectory clustering, autoencoders, and neural networks. Generative models and risk prediction methods are also employed to enable trajectory anomaly early warnings.

The aim of these identification techniques is to enable the detection of specific anomalous flight phenomena. These include sudden speed changes, low altitude, sudden altitude changes, go-arounds, holding patterns, position-update anomalies, and aircraft-initiated reports. Grounded in the safety management demands associated with abnormal flight behaviors, and considering the anomaly detection techniques and the trajectory model, this paper discusses the correlation between identification of aircraft abnormal behaviors and trajectory anomaly detection.

4. Recent Progress for Flight Abnormal Behavior Detection Based on Trajectory

The implementation of anomaly detection can identify behaviors that do not conform to expectations or normative patterns. Algorithmically, conventional anomaly detection techniques are typically categorized as distance-based, ensemble-based, statistical-based, reconstruction-based, and domain-based methods [94]. The distance-based category primarily encompasses nearest neighbor-based and clustering-based approaches, which rely on clustering among data and are suitable for anomaly detection in low-dimensional data. Aggarwal [95] provided an extensive review of ensemble-based outlier detection algorithms, including Local Outlier Factor [96] and Isolation Forest [97,98], noting they still have detection biases. Statistical-based detection was proposed by Chandola et al. [18], which primarily leverages the probability distribution of data to delineate the boundary between normal and abnormal data. A representative statistical anomaly detection model is the Gaussian Mixture Model (GMM), which uses the distance from data to the estimated mean as an anomaly score. The data with scores exceeding a given threshold are labeled as anomalies [61]. The reconstruction-based category mainly involves projecting high-dimensional data into a lower-dimensional space for trajectory reconstruction, such as autoencoders. However, this method is prone to information loss [99]. The domain-based category defines boundaries or domains through training data to determine normal value thresholds, such as with Support Vector Machines [100]. It performs anomaly detection by determining parameter vectors that distinguish between normal and anomalous data, though this approach is highly sensitive to data quality.

The machine learning approach is a vital contributor to the recent advancements in anomaly detection research, mainly involving neural networks [101,102], advanced autoencoders [103,104], generative models [105,106,107], and temporal logic learning models [108,109]. For a more extensive review, based on traditional methods and recent advancements,

Table 3. Characteristics and limitations of anomaly detection methods.

Research Progress	Methods	Algorithms	Characteristics	Limitations
Traditional methods	Distance-based	Nearest neighbor-based; clustering.	Rely on the distance between data, with low data dimensionality.	Not applicable to more complex data such as time series.
	Ensemble-based	Isolation Forest.	Classify streaming data based on certain principles.	A certain bias in classification.
	Statistical	Gaussian Mixture Model.	Probabilistic model.	Easy to miss outliers.
	Reconstruction-based	Autoencoders; principal component analysis.	Project high-dimensional data into a lower-dimensional space for trajectory reconstruction.	Prone to information loss.
	Domain-based	Support Vector Machine.	Define boundaries or domains based on training data.	Requires high data quality.
Recent advances	Deep learning	Generative models.	Increase the sample size with a generator and a discriminator.	Accuracy limitation.

illustrates the main algorithms, characteristics, and limitations of traditional anomaly detection methods and recent advances.

Through collecting relevant literature on anomaly detection techniques from Web of Science and China National Knowledge Infrastructure, mathematical modeling, multidimensional data association and advanced machine learning architectures are the primary drivers of technical evolution in this field. For instance, foundational frameworks such as the mathematical models for aircraft trajectory design [110] establish the theoretical constraints and structural prerequisites for defining nominal flight paths. From the perspective of data association, Yan et al. [111] used transition probability sequences to represent the dynamic changes of data over time, simplifying the correlation between various parameters. It can implement feature ex-traction from multi-state data streams. Furthermore, recent advancements highlight the widespread application of sophisticated machine learning models in anomaly detection, including Generative Adversarial Networks (GANs) [107,112], autoencoders [48,62], Bayesian Neural Networks [60,113,114], and so on. These landmark studies shift the focus from simple statistical outlier identification to the deep semantic understanding of complex flight behaviors.

As the preceding analysis confirms, most contemporary detection studies indeed employ machine learning to identify anomalies. Research on trajectory anomaly detection will focus on more specialized machine learning technology.

4.1. Speed Anomaly Detection

As defined in UPRT [2], a complex state refers to unexpected situations where the aircraft’s flight attitude or speed deviates from the normal trajectory. Accordingly, speed anomalies can be defined as a condition where the short-period changes of speed are inconsistent with the flight conditions.

Table 4. Research on aircraft trajectory detection with abnormal speed.

Year	Affiliation	Problems of Current Methods	Improved Approaches	Application
2010	NASA Ames Research Center [44]	High-dimensional data streams containing much discrete and continuous data.	MKAD; one-class Support Vector Machine.	Identify speed anomalies in high-dimensional data.
2015	City University of Hong Kong et al. [48]	Sudden abnormal operation detection.	ClusterAD-Flight.	Anomaly detection without predefined anomaly criteria.
2016	City University of Hong Kong et al. [61]	Miss unknown important risks.	ClusterAD-DataSample.	Improve accuracy detection; automatically identify flight operation modes.
2019	Université de Toulouse [115]	Difficulty in identifying risks in real time.	Random Forest Regression.	Online prediction of aircraft landing speed metrics.
2020	NASA Ames Research Center [62]	High workload for creating data labels.	Convolutional variational AE.	Better detection and false alarm rates.
	Université de Toulouse [51]	Low generalizability of trajectory detection models.	AE.	Quantify the level of anomalies.
2021	City University of Hong Kong et al. [83]	Dynamic growth of flight data with large computational scale.	Incremental clustering based on GMM.	Reduce computation time and memory usage for dynamic datasets.
2022	NASA Ames Research Center [90]	Interpretability and accuracy of anomaly detection models.	Semi-supervised deep learning model.	Improve the robustness of anomaly detection algorithms.
2024	Vanderbilt University [89]	Large reconstruction errors for abnormal flights.	Bayesian autoencoder.	Identify speed anomalies in landing trajectories.

lists the relevant research on speed anomalies in the past decade.

Regarding speed anomaly detection, Das et al. [44] developed Multiple Kernel Based Anomaly Detection (MKAD) in 2010, which assumes a data pattern for normal operations and applies a one-class Support Vector Machine (SVM) for detecting speed anomalies. However, in practice, this method struggles to cope with diverse flight conditions. The team led by Li et al. [48] investigated a technique called ClusterAD-Flight based on cluster analysis to identify common patterns in datasets. It assumes most flights show common patterns, and deviations from them are anomalies. Experimental results demonstrate that ClusterAD-Flight outperforms MKAD in detecting situations where the speed of aircraft approach is excessively high. Since significant speed changes within a short period constitute instantaneous anomalies during flight, Li’s team [61] also developed an online method that applies data mining to data analysis, named ClusterAD-DataSample based on the Gaussian Mixture Model. This method automatically identifies multiple typical flight operations and accurately detects anomalies during flight, avoiding the omission of unknown abnormal behaviors. It is effective in detecting unstable approaches caused by speed anomalies. Fundamentally, both ClusterAD-Flight and ClusterAD-DataSample share the principle of modelling nominal flight data and detecting deviations as anomalies, therefore enabling the identification of abnormal flight patterns without reliance on pre-defined exceedance thresholds.

As neural network technology advanced, Memarzadeh et al. [62] introduced an unsupervised deep generative model for anomaly detection in high-dimensional time series data, known as the Convolutional Variational Auto-Encoder (CVAE). Through the analysis of unsafe events triggered by airspeed decreases exceeding a certain threshold, it was found that CVAE outperformed traditional clustering methods and deep learning-based methods in terms of accuracy (ACC), detection rate (DR) and false alarm rate (FAR) for anomaly detection. Additionally, Kong and Mahadevan [89] designed a Bayesian Autoencoder neural network model to extract parameters such as latitude, longitude, and speed, as well as roll and pitch angles. By reconstructing flight data, they identified abnormal behaviors in landing trajectory and investigated different loss functions. The study revealed that excessively high vertical speeds can lead to hard landings of aircraft. The maneuvering deflection of an aircraft is reflected in changes in attitude angles, which subsequently changes with trajectory acceleration and speed vectors [116]. It ultimately alters the aircraft trajectory and leads to unsafe events. Consequently, anomalies in speed and altitude warrant heightened attention during approach and landing phases.

Speed anomaly detection mainly addresses sudden speed anomalies, the omission of unknown significant risk, and real-time risk identification. By utilizing methods such as trajectory clustering based on Gaussian Mixture Models, autoencoders, and one-class Support Vector Machines, there is a considerable improvement for the computational power, interpretability, and accuracy of anomaly detection models. These advances enable the quantification of the severity of trajectory speed anomalies, facilitate accurate identification of abnormal flight behaviors driven by speed deviations, and support the provision of operational recommendations related to speed management.

4.2. Altitude Anomaly Detection

Altitude anomalies encompass low altitudes and sudden changes in altitude. Low altitude refers to an aircraft flying at an excessively low altitude. In the safety report of ICAO [1], low altitude and the subsequent risk of controlled flight into terrain (CFIT) are highlighted as significant events for monitoring. Table 5 presents relevant research on altitude anomalies over the past decade.

To tackle low-altitude anomaly detection, Li et al. [52] introduced the concept of energy height, transforming the positional altitude information into energy-equivalent altitude values to measure the abnormal low-altitude conditions. Energy height, $H_{energy}$, refers to the theoretical altitude at which an aircraft’s kinetic energy is fully converted into potential energy without any mechanical energy loss during flight. Through using the Hausdorff distance to build a trajectory similarity matrix and applying spectral clustering to the trajectories of energy height, abnormal low-altitude trajectories can be effectively identified. This method overcomes the limitations of traditional geometric altitude analysis. To enhance interpretability of trajectory features and precursor information of abnormal energy height, Xiang et al. [117] proposed a Catalyst Mass-Based Clustering Analysis (CMCA), which successfully detected the precursors of trajectories with abnormal energy height. The results indicate that weak energy management awareness among pilots may be a major cause of abnormal low-altitude behaviors in aircraft. This method has emerged as a valuable tool for proactive flight safety management.

Table 5. Research on aircraft trajectory detection with abnormal altitude.

Year	Affiliation	Problems of Current Methods	Improved Approaches	Application
2018	Civil Aviation University of China [52]	Accuracy of altitude anomaly detection.	Trajectory similarity matrix; spectral clustering.	Effective identification of trajectories at low altitudes.
2019	Purdue University [118]	Complexity of terminal airspace systems.	Recursive exception algorithm based on TempAD.	Improve interpretability of models.
2021	Georgia Institute of Technology [87]	Difficulty to analyze aircraft spatial and energy anomalies.	Anomaly detection based on energy metrics; HDBSCAN.	Build a framework for anomaly detection; quantifying altitude anomalies.
	Georgia Institute of Technology [99]	Diversity of flight data sources.	Build AE with weather and traffic indicators.	Detect instantaneous energy anomalies effectively.
2022	Institute of Applied Artificial Intelligence of the Guangdong–Hong Kong–Macao Greater Bay Area [119]	Altitude anomalies caused by pilots’ operating.	Hybrid Feature Selection (HFS); Bayesian optimization model.	Reduce computational costs and detection of hard landing events due to altitude changes.
2023	Nanjing University of Aeronautics and Astronautics [117]	The interpretability of anomaly detection model.	A Catalyst Mass-Based Clustering Analysis (CMCA).	Identify trajectory of energy-height anomalies.
2025	Chongqing University & IEEE [120]	The complexity and high dimensionality of flight data.	Time-convolutional network-based autoencoders.	Identify hard landing times with enhanced detection accuracy.

Table 5. Research on aircraft trajectory detection with abnormal altitude.

Year	Affiliation	Problems of Current Methods	Improved Approaches	Application
2018	Civil Aviation University of China [52]	Accuracy of altitude anomaly detection.	Trajectory similarity matrix; spectral clustering.	Effective identification of trajectories at low altitudes.
2019	Purdue University [118]	Complexity of terminal airspace systems.	Recursive exception algorithm based on TempAD.	Improve interpretability of models.
2021	Georgia Institute of Technology [87]	Difficulty to analyze aircraft spatial and energy anomalies.	Anomaly detection based on energy metrics; HDBSCAN.	Build a framework for anomaly detection; quantifying altitude anomalies.
	Georgia Institute of Technology [99]	Diversity of flight data sources.	Build AE with weather and traffic indicators.	Detect instantaneous energy anomalies effectively.
2022	Institute of Applied Artificial Intelligence of the Guangdong–Hong Kong–Macao Greater Bay Area [119]	Altitude anomalies caused by pilots’ operating.	Hybrid Feature Selection (HFS); Bayesian optimization model.	Reduce computational costs and detection of hard landing events due to altitude changes.
2023	Nanjing University of Aeronautics and Astronautics [117]	The interpretability of anomaly detection model.	A Catalyst Mass-Based Clustering Analysis (CMCA).	Identify trajectory of energy-height anomalies.
2025	Chongqing University & IEEE [120]	The complexity and high dimensionality of flight data.	Time-convolutional network-based autoencoders.	Identify hard landing times with enhanced detection accuracy.

Sudden altitude changes refer to an unexpected alteration in an aircraft’s altitude within a short period. In aviation accidents like the Air France Flight 447 accident, there were abnormal changes in altitude shortly before significant operational events occurred.

Abnormal trajectories with sudden changes in altitude often have a strong correlation with abnormal speeds. Puranik [45] defined energy indicators calculated from trajectory data records, emphasizing their dependence on flight speed and altitude. On this basis, Corrado et al. [99] integrated operational environment and trajectory data to apply an autoencoder for detecting instantaneous energy anomalies in general aviation fleets. This method can effectively identify trajectories with historical altitude anomalies and provide operational suggestions for pilots and air traffic controllers, thereby reducing the risk of abnormal altitudes. Subsequently, the team [87] considered Specific Potential Energy (SPE) and Specific Kinetic Energy (SKE) as two main energy indicators, representing the Specific Total Energy Rate (STER). Among them, SPE can be understood as flight altitude, and SKE and STER are calculated as follows:

$$SKE={\displaystyle \frac{v^2}{2g}},$$

(6)

$$STE=SPE+SKE,$$

(7)

$$STER={\displaystyle \frac{{STE}_{i+1}-{STE}_i}{\Delta t}},$$

(8)

where $v$ denotes speed, $g$ is the gravitational constant, and $\Delta t$ is the time difference between two consecutive recordings of specific total energy. Spatial and energy anomaly detection is performed using the Density-Based Spatial Clustering of Applications with Noise (DBSCAN) method with weighted Euclidean distance. Relative to prior energy-height studies, this approach provides a general anomaly detection process that incorporates both spatial and energy indicators for aircraft and quantifies the degree of abnormality in altitude-changing trajectories. Additionally, Deshmukh and Hwang [118] proposed a Temporal Logic-based Recursive Anomaly Detection algorithm (TempAD) for detecting anomalies in altitude, speed, and energy indicators. This algorithm can generate a data-driven model for trajectory anomaly detection in terminal airspace, improving upon the “black box” issue of machine learning methods and offering strong interpretability.

Beyond energy-based anomaly detection, Yang et al. [119] proposed a Hybrid Feature Selection (HFS) method leveraging QAR data to select altitude-related features through both supervised and unsupervised approaches, focusing on the landing phase of flights. Employing the Shapley Additive exPlanations (SHAP) model, the marginal effects of the altitude-related key parameters on the hard landing events are visualized and analyzed. Recognizing that unsafe events like hard landings manifest through abnormal patterns in multidimensional sensor streams, characterized by intricate temporal dependencies, Yan et al. [120] devised a dual-view contrastive framework using temporal convolutional networks (TCNs), significantly enhancing detection accuracy for altitude anomalies.

Altitude anomaly detection methods based on energy indicators are widely used in the study of low altitude and sudden altitude changes, such as energy height and specific total energy rates. These techniques can solve anomalies where both speed and altitude vary and quantify the degree of abnormality. Most research employs distance-based trajectory clustering and Bayesian networks to improve the computational capabilities of anomaly detection and identify high-risk unsafe events caused by altitude changes.

4.3. Heading Anomaly Detection

Heading anomalies typically manifest as unintended turns in go-arounds and holding patterns. It is defined as an unintended and continuous change in the aircraft’s horizontal azimuth or a significant deviation from the preset flight track. Effective monitoring of such anomalies requires enhanced trajectory tracking accuracy, which refers to the degree of precision in maintaining the actual flight path relative to the preset trajectory [121]. A go-around refers to the abnormal behavior where a flight begins to climb continuously during the landing descent. Unlike low-altitude anomalies, go-arounds are intentional pilot-induced maneuvers in which the flight transitions form an intended landing approach into sustained climb, accompanied by significant changes in aircraft altitude.

Table 6. Research on aircraft trajectory detection with heading variation.

Year	Affiliation	Problems of Current Methods	Improved Approaches	Application
2017	Watson Research Center [46]	Capabilities of detection for large datasets.	Hidden Markov Models based on spectral algorithms; spectral algorithms.	Effectively detect abnormal go-arounds.
2020	Civil Aviation University of China [82]	Spatiotemporal ordering of trajectories and motion characteristics.	Hausdorff distance; hierarchical clustering based on time series.	Improve the accuracy of detection models; identify abnormal holding patterns.
2021	Nanjing University of Aeronautics and Astronautics [122]	The high-dimensional and heterogeneous nature of trajectory data.	Long- and short-term memory networks; Gaussian mixture models.	Higher-risk flights of go-arounds can be detected.
2022	Xiamen University et al. [88]	Unsafe flight identification in the approach and landing phase.	Tunnel Gaussian Process.	Improve the interpretability of anomaly detection models.
	Universidad Rey Juan Carlos [123]	High accuracy requirements for flight path tracking.	Iterative learning control methods.	Improve flight trajectory tracking accuracy; avoid abnormal go-arounds.

presents relevant research on heading anomalies in the past decade.

Melnyk and Banerjee [46] performed clustering analysis on more than 180,000 takeoffs and landings from 35 aircrafts. While ensuring computational speed and accuracy, they constructed a Hidden Markov Model based on the spectral algorithm and training data to estimate given observed flight parameters. They found that most abnormal flights in terminal airspace exhibited go-around behavior, where the descent process transitioned into a climb. Effective detection of go-arounds requires enhanced trajectory tracking accuracy, which provides precise flight-state information and enables the monitoring of abnormal heading deviations. This requirement is driven by the fact that a go-around represents an abrupt and critical transition from a landing descent into a sustained climb, often occurring within the narrow and sensitive operational profile of the terminal area [124].

The fundamental role of trajectory tracking in this context is to establish a high-fidelity reference baseline that represents the flight’s nominal or intended path. By incorporating enhanced tracking techniques, the system can actively compensate for spatiotemporal deviations caused by environmental disturbances or sensor noise [125].

Trajectory tracking accuracy refers to the degree of precision in maintaining the actual flight path relative to the preset or intended trajectory. Only with a high-fidelity tracking baseline can the detection model effectively distinguish authentic, intentional state transitions from signal noise, thereby preventing false alarms or missed detections of abnormal maneuvers. Buelta et al. [123] proposed an iterative learning control method, which utilizes historical data to predict disturbance factors. Through generating new reference trajectories, spatiotemporal deviations are compensated actively, thereby improving trajectory tracking accuracy. By identifying continuous climb or descent operations during aircraft landing and descent, abnormal go-around behaviors can be avoided as much as possible.

The criterion for stable approach involves flight trajectory, airspeed, and flight path angle [121]. Notably, the heading angle $\theta$ serves as the core metric for measuring horizontal azimuth fluctuations, whereas the flight path angle is primarily used to evaluate the energy state stability in the vertical dimension during the approach phase. Hence, compliance with stabilized approach criteria can be used as a benchmark to determine whether a go-around is warranted. Goh et al. [88] attempted to use a data-driven and interpretable Tunnel Gaussian Process (TGP) to enhance the requirements of the regulatory-based stable approach. Through representing approach and landing parameters of four-dimensional trajectories in a probabilistic manner, an understandable probabilistic description of abnormal go-arounds can be described. Based on the landing parameters recorded by the Advanced Surface Movement Guidance and Control System (A-SMGCS), the go-around behaviors can be analyzed for compliance with the criteria of stable approach.

The abnormal behavior of holding patterns refers to situations where an aircraft’s heading changes significantly and continuously over a period. The focus of this paper is on unexpected changes in aircraft heading that result in abnormal holding patterns.

Ding et al. [82] extracted longitude, latitude, speed, and heading information from ADS-B data, utilizing the Hausdorff distance to calculate multi-feature similarity of trajectory data. Combined with a hierarchical clustering method, abnormal behaviors can be detected. Experiments demonstrated that the multidimensional feature clustering-based anomaly detection method for time series can identify abnormal trajectories with continuous variation in heading. In response to the high dimensionality, heterogeneity, and time-variance of aircraft trajectory data, Chen et al. [122] designed an algorithm based on a Deep Mixture Density Network (DMDN). Each trajectory is defined as a vector in the form of a multivariate time series consisting of position, airspeed, heading, and flight information. The trajectory features can be encoded by a Long Short-Term Memory network. And a Gaussian Mixture Model is used to parameterize the statistical characteristics of flight trajectories. Experimental results in the terminal airspace of Guangzhou Baiyun International Airport showed that this method can effectively detect abnormal trajectories with significant changes in heading.

For heading anomaly detection, the emphasis is on problems of go-arounds and holding patterns. As one of the criteria for stable approach, the flight path angle serves as a key parameter for heading anomaly detection. Most studies utilize machine learning methods such as Hidden Markov Models and Gaussian Mixture Models to identify abnormal heading changes and improve aircraft trajectory tracking accuracy.

4.4. Applications

As the review of the current research shows, anomaly detection approaches grounded in statistical theory are generally consistent with the anomaly standards specified in aviation regulations. Figure 4 undertakes a behavior analysis of flight, summarizing the application of aircraft trajectory anomaly detection techniques. At present, the application of research concerning flight abnormal behavior and trajectory detection is as follows:

4.4.1. Anomaly Alerting

The warnings of abnormal trajectories are still in the initial stage. Sun et al. [126] proposed a QAR data analysis method based on statistical process control, utilizing $\pm 3\sigma$ principles of determining the control limits to advance the threshold for anomaly alerts. It can reduce false and missed alerts. Developing the warning logic, conditions, and indicators for abnormal trajectories remains a challenging and crucial focus in applied research.

4.4.2. Online Anomaly Detection in Real Time

Online monitoring of abnormal trajectories in real time is crucial for proactive safety management. Cai et al. [127] proposed a real-time hard landing warning approach based on airborne QAR data. In response of post-event analysis for identifying hard landings, they optimized a prediction model using a sequence-to-sequence Long Short-Term Memory (LSTM) network. The warning can be advanced by 8 s with a prediction accuracy of 98%. Nonetheless, with prolonged training iterations, the model is prone to overfitting and unstable gradient updates, limiting robustness. Building on the LSTM architecture, Huang et al. [128] incorporated multidimensional flight dynamics variables, significantly improving the speed and accuracy of anomaly detection. Innovatively, Kim et al. [129] applied recurrent neural networks to anticipate abnormal flight scenarios, boosting computational efficiency to 99.2%. This advancement provided pilots with critical response time and enabled the potential activation of automatic recovery systems. In practical application scenarios, advancing online real-time trajectory anomaly detection technologies is essential for realizing intelligent, automated, and adaptive flight trajectory monitoring systems.

4.4.3. Quantitative Evaluation of Abnormal Flight Behaviors

The quantitative assessment plays a central role in improving flight safety, strengthening pilot training, and refining aircraft maintenance strategies. Addressing the shortcoming that prevailing approaches emphasize point-wise anomaly detection and fail to capture the overall severity of abnormal flight behaviors, Ren et al. [130] and Su et al. [131] advanced beyond the conventional binary paradigm of “normal vs. abnormal”, introducing more granular and robust quantitative evaluation methodologies. Ren et al. [130] used dynamic time warping between actual and benchmark behaviors to map results into levels like excellent, good, or poor, thereby quantifying abnormal flight behavior. Su et al. [131] improved on this by including prediction–observation deviations and uncertainty measures, creating a composite score classifying abnormal behaviors into levels like mild, moderate, and severe, consequently ensuring both interpretability and predictive capability constitute a vital application outcome of research on the quantitative evaluation of flight anomalies.

5. Future Research Directions

Modern information technology has precipitated significant transformations and presented substantial development opportunities for research on flight traffic behavior. The Global Air Navigation System Performance Manual issued by ICAO [29] explicitly stipulates the Key Performance Indicators (KPIs) for Air Traffic Management (ATM). These encompass safety, efficiency, capacity, environmental impact, cost-effectiveness, flexibility, predictability, equity, global interoperability, and participation. Existing studies predominantly emphasize safety and efficiency, particularly in analyzing unsafe and inefficient flight behaviors. However, understanding the implications of other performance indicators like predictability, equity and flexibility, and clarifying their roles within air traffic systems represent pressing challenges for future research.

In recent years, the identification and detection of abnormal flight behaviors have largely relied on trajectory-based analyses informed by regulatory monitoring programs like FOQA and UPRT, past safety incidents, and aircraft fault reports [132]. While ADS-B data deliver essential trajectory information, complementary sources such as QAR datasets, Standard Operating Procedures (SOPs), and cockpit voice recordings provide richer insights into flight operational behaviors and are anticipated to play a prominent role in future investigations of abnormal flight behavior. Consequently, exploring the influence of heterogeneous, multi-source flight data on abnormal flight behavior has become an essential research imperative.

At the current stage, advanced Communication, Navigation, and Surveillance (CNS) and data transmission technologies can provide pilots, controllers, and Air Traffic Management (ATM) systems with a vast array of information, encompassing navigation data, weather, cockpit voice data, and airborne operational status. The conceptualization of flight trajectories has expanded beyond three-dimensional spatial and temporal parameters, allowing for representation in higher-dimensional spaces. Concurrently, flight trajectory anomaly detection and abnormal behavior identification should also incorporate flight plans and SOPs through multidimensional trajectory models.

As data-driven technologies advance, research into flight trajectory anomaly detection is evolving towards greater intelligence, real-time capability, and model sophistication. For now, the “black-box” issue and safety implications of anomaly detection algorithms remain insufficiently explored, raising the critical question of whether such models can be deployed in onboard systems for autonomous diagnostics and emergency state pre-warning. Hence, future research must be closely aligned with operational scenarios to rigorously validate their practical applicability. On a promising note, high-throughput satellites and 4G/5G air–ground data links are developing rapidly [133]. These technologies provide the technical backbone for the collection, transmission, and storage of high-dynamic, real-time aviation safety data, paving the way for a brighter prospect in big data-driven research on flight traffic behavior.

Looking ahead, researchers are expected to align with safety management requirements by investigating flight traffic behaviors across diverse performance indicators, analyzing abnormal flight behavior characteristics under multi-source data, and advancing multidimensional trajectory anomaly detection as well as data-driven approaches to abnormal behavior research.

6. Conclusions and Implication for Industry

This paper has reviewed the research on flight behavior analysis and trajectory anomaly detection technologies, and the following conclusions can be drawn:

• Flight traffic behaviors mainly consist of straight-line flight, turns, holding patterns and step-down descents. With respect to efficiency and safety performance metrics, prior research has predominantly emphasized inefficient operations and abnormal flight behaviors. Using trajectory data and supplementary behavioral features quantified through multiple metrics, operational flights are classified relative to a trajectory benchmark; minor deviations indicate inefficiency, whereas sustained or aggravated deviations beyond safety thresholds signify abnormal behaviors.
• The analysis of flight abnormal behavior based on safety control requirements is an essential method for mining abnormal patterns in trajectories. Based on safety regulations and flight experience, flight abnormal behaviors include low altitude, go-arounds, holding patterns, sudden speed changes, sudden altitude changes, abnormal position updates, and aircraft-initiated anomaly information. With ADS-B, QAR and other data sources, this paper introduces the high-dimensional definition of flight trajectory and the connotation of abnormal flight trajectory.
• Research in flight trajectory anomaly detection can be broadly categorized into two primary paradigms. The first centers on analyzing abnormal flight behaviors within the framework of aviation safety regulations, while the second leverages data-driven statistical methodologies. For safety oversight, establishing an explicit linkage between abnormal flight behaviors and trajectory anomalies constitutes the central challenge in anomaly detection research.
• The data-driven technology of flight trajectory anomaly detection is the main contributor to flight safety and is becoming increasingly intelligent. The emphasis is on how well the current anomaly detection technology matches the anomaly standards in regulations from three aspects: speed anomalies, altitude anomalies, and heading variation. To address challenges of massive datasets, abnormal samples, clustering methods and anomaly detection algorithms, machine learning approaches like deep learning and Bayesian neural networks have gradually replaced the traditional methods like statistics. It has become a new orientation in the research of anomaly detection technology.
• At present, the primary applications of flight trajectory anomaly detection technologies encompass anomaly alerting, real-time online monitoring, and quantitative evaluation of abnormal flight behaviors. In response to tightening safety management imperatives, future research priorities should include classification of flight traffic behaviors using performance-based indicators, development of behavioral representations that fuse trajectories with heterogeneous flight data, construction of multidimensional anomaly detection models, and advancement of big-data-driven behavioral models. Collectively, these efforts can yield actionable insights for air traffic safety management.