AeroScope observes every aircraft, route, and airport continuously, learning what "normal" looks like across hundreds of behavioral dimensions. When something deviates from the established pattern, the system scores the anomaly in real-time and surfaces it before anyone has to go looking.
Traditional rule-based alerting relies on hard thresholds: if altitude drops below X, fire an alert. The problem is obvious. Thresholds that work for a heavy widebody transiting the North Atlantic are meaningless for a Cessna doing pattern work at a regional strip. A single set of rules cannot cover the diversity of real-world aviation behavior without drowning operators in false positives or, worse, missing genuine anomalies because the threshold was set too conservatively.
Behavioral baselines take a fundamentally different approach. Instead of defining "normal" in advance, the system observes and learns it. For every entity AeroScope tracks — individual aircraft, specific routes, airport operational patterns, time-of-day activity distributions — the platform builds a statistical model of that entity's typical behavior over time. The model captures not just averages but the shape of the distribution: variance, periodicity, correlation between dimensions, and the rate of change.
Once a reliable baseline exists, every new observation is scored against it. A commercial heavy cruising 2,000 feet below its route-normal altitude band gets flagged. A cargo operator departing three hours outside its historical schedule window gets flagged. A general aviation aircraft that normally stays within a 200nm radius suddenly transiting international airspace gets flagged. None of these require a human to write a rule. The baseline is the rule, and it is specific to the entity being observed.
This matters because the most operationally significant anomalies are often subtle. An aircraft that is technically within all published altitude and speed limits but behaving nothing like its own historical pattern is precisely the kind of signal that fixed rules will miss and that behavioral baselines will catch. The approach is borrowed from network intrusion detection and financial fraud analysis, adapted for the specific kinematics and operational patterns of aviation.
The baseline engine runs a four-phase pipeline that operates continuously as new data arrives. Each phase feeds the next, and the entire cycle runs in near-real-time against every tracked entity.
Raw ADS-B position reports arrive at roughly one-second intervals per aircraft. The pipeline ingests latitude, longitude, barometric altitude, geometric altitude, ground speed, track angle, vertical rate, squawk code, and callsign. Each report is timestamped, deduplicated across receiver sources, and validated for basic physical plausibility before entering the pattern extraction stage.
Validated position reports are segmented into flights using takeoff/landing detection heuristics. Each flight is decomposed into phases — taxi, takeoff, initial climb, en-route climb, cruise, descent, approach, landing — using altitude and speed profiles. Time-of-day histograms, route geometries, altitude profiles per route segment, and speed envelopes per aircraft type are extracted and stored as feature vectors.
Feature vectors accumulate over the observation window (rolling 7-day short-term and 90-day long-term). The system fits a statistical distribution per feature per entity: mean, standard deviation, percentile bands, and seasonality coefficients. For route geometry, a corridor envelope is computed using the median path plus a lateral tolerance derived from observed variance. The model self-updates with every new flight, using exponential decay weighting so recent behavior carries more influence.
Incoming real-time observations are compared against the entity's baseline model. Each behavioral dimension (altitude, speed, lateral offset, timing, squawk) produces a per-dimension z-score. These are combined using a weighted ensemble into a single composite deviation score between 0 and 100. Contextual factors — weather, NOTAMs, adjacent traffic patterns — adjust the score downward when a plausible external cause exists. Scores above configurable thresholds generate AMBER or RED alerts.
Baselines start coarse and tighten as observations accumulate. The confidence interval narrows rapidly during the first two weeks, then continues to refine more gradually as seasonal and operational patterns fill in. The chart below illustrates how baseline accuracy improves with observation duration.
The system builds and maintains separate baseline models for six core behavioral dimensions. Each dimension captures a different facet of how aircraft, routes, and operators behave under normal conditions.
Expected lateral flight paths between origin-destination pairs. The system computes a corridor envelope from historical tracks, capturing the median path geometry and the normal dispersion band. Deviations beyond the corridor boundary — adjusted for known waypoint alternatives and published SIDs/STARs — score against the baseline. This catches off-route behavior, unusual diversions, and flights that claim one destination but track toward another.
Normal climb, cruise, and descent altitude bands per route segment. The profile is keyed to distance-from-origin rather than time, which normalizes for speed variation. A B737 on a 900nm domestic hop has a different altitude profile than an A380 on a 7,000nm transatlantic leg, and the system captures this per-route, per-type granularity. Sustained flight below or above the baseline band triggers scoring, with severity increasing the longer the deviation persists.
Expected ground speed and Mach ranges at each flight phase and altitude band. The envelope accounts for seasonal wind patterns — westbound transatlantic flights are consistently slower than eastbound due to the jet stream, and the baseline knows this. Speed anomalies may indicate aircraft type misreporting, unauthorized modifications, or compromised flight management systems. The envelope adjusts dynamically for reported wind conditions.
When aircraft typically operate and when they do not. Commercial carriers follow published schedules with predictable variance. Cargo operators run overnight windows. Corporate aircraft cluster around business hours with weekend gaps. General aviation shows weather-dependent seasonality. The baseline captures the hourly and day-of-week activity distribution per entity. An aircraft departing at 0300 local when its historical pattern is strictly daytime VFR operations will be flagged.
Normal transponder code assignment patterns per aircraft, route, and ATC sector. Most squawk codes are dynamically assigned, but the distribution of assigned codes within a sector follows a repeatable pattern. Anomalous squawk behavior — rapid code changes, use of reserved blocks, codes inconsistent with the flight's position and phase — scores against the transponder behavior baseline. This dimension is particularly relevant for detecting spoofed or manipulated transponder data.
Typical maneuver patterns and phase transitions. The system models the expected sequence of events for a given flight profile: departure, climb, cruise, descent, approach. Deviations from this sequence — unexpected holding patterns, go-arounds on clear-weather days, repeated altitude oscillations during cruise, or abrupt course reversals — score against the behavioral sequence model. This catches erratic behavior that stays within individual parameter limits but is anomalous in aggregate.
The grid below represents a typical weekly activity baseline for a monitored entity. Each cell is one hour of one day, colored by observed activity density. Cells with red borders mark statistical outliers — hours where observed activity deviates significantly from the historical norm. Operators use this view to spot schedule anomalies at a glance.
The visualization below shows a route's normal altitude band (shaded region) alongside individual flight observations (dots). Most observations cluster within the expected range. Outliers — shown in red — represent flights that deviated significantly from the baseline altitude profile for this route segment. Each outlier triggers deviation scoring and, if the composite score exceeds threshold, an operator alert.
The bar chart below shows the time-of-day activity distribution the system has learned for an example entity. Taller bars indicate hours with higher historical flight activity. The system builds and maintains this distribution per aircraft, operator, route, and airport, updating it with every new observation.
Each monitored route and aircraft maintains a profile like the one below. The profile summarizes the learned baseline parameters and displays any active deviation alerts against the current observation.
Aircraft N4472F currently at FL320 — 2,400 ft below normal cruise altitude band for this route segment (expected FL350-FL390). Duration: 14 minutes and increasing. No active convective SIGMET or NOTAM in sector. Adjacent traffic operating at normal altitudes.
The behavioral baseline system classifies detected anomalies into six categories, each corresponding to one of the baselined dimensions. Anomalies can be isolated (single dimension) or compound (multiple dimensions deviating simultaneously), with compound anomalies receiving higher composite scores.
Aircraft operating outside the established lateral corridor for its route. May indicate unauthorized rerouting, GPS spoofing, navigational error, or deliberate evasion of monitored airspace. Severity scales with lateral offset distance and persistence.
Sustained flight outside the expected altitude band for the current route segment and phase. Catches aircraft cruising abnormally low (potential terrain masking), abnormally high (performance concerns), or oscillating between altitudes in a non-standard pattern.
Ground speed or derived Mach number outside the expected envelope for the aircraft type, route, and flight phase. Unusually fast or slow cruise speeds can indicate aircraft type misidentification, modified performance, or spoofed ADS-B data. Wind-adjusted scoring prevents false positives from jet stream variation.
Aircraft operating outside its historical time-of-day or day-of-week activity window. A corporate jet that has never flown between midnight and 5am suddenly departing at 0200 local generates a schedule anomaly. This dimension is particularly useful for detecting stolen or unauthorized use of aircraft.
Non-standard maneuver sequences or phase transitions. Includes unexpected holding patterns, repeated touch-and-go operations on a flight filed as point-to-point, abrupt course reversals, or extended low-altitude loitering. The system models the expected behavioral state machine and flags transitions that violate it.
Aircraft behaving inconsistently with its declared type, registration, or operator profile. A turboprop transmitting speeds characteristic of a jet, or a registered training aircraft operating transoceanic routes, triggers identity scoring. This dimension cross-references the behavioral observation against the aircraft registry baseline to catch impersonation and data manipulation.
The operational difference between rule-based alerting and behavioral baseline analysis is stark. Below is a side-by-side comparison of the same monitoring environment.
Behavioral baselines underpin several high-value operational capabilities across civil aviation security, law enforcement, and airport management.
Identify aircraft that deviate from expected patterns in real-time, enabling controllers and security operators to prioritize attention on flights that are actually behaving unusually rather than sifting through hundreds of routine threshold violations. Reduces alert volume by an order of magnitude while improving detection of genuine operational anomalies.
Aircraft used for illicit cargo runs often exhibit distinctive behavioral signatures: low-altitude flight near borders, landings at uncontrolled strips, nighttime operations inconsistent with the aircraft's registered purpose, and routes that avoid ATC coverage zones. The baseline system flags these patterns without requiring advance intelligence on specific aircraft or operators.
ADS-B data can be spoofed. An aircraft transmitting a false ICAO address or callsign will still exhibit behavioral characteristics — speed, altitude profile, maneuver dynamics — that are inconsistent with the entity it claims to be. Behavioral baselines detect this discrepancy by comparing observed kinematics against the historical baseline for the claimed identity.
Airport operators use behavioral baselines to monitor runway utilization patterns, taxi times, departure queue behavior, and arrival flow rates. Deviations from the operational baseline — a sudden increase in taxi-out times, abnormal departure spacing, or unusual runway configuration changes — surface early indicators of developing congestion, equipment issues, or procedural breakdowns.
See how AeroScope's behavioral baseline engine works against live traffic.
LAUNCH AEROSCOPE