Anomaly Detection for Trajectory Data: Isolation Forest vs. Autoencoders vs. LSTM, Applied to Flight Tracks

A practical comparison of three modelling philosophies for catching the flight that doesn't belong.

1. Hook

A single wide-body aircraft generates roughly 3,000 position updates over a typical transatlantic flight — and a busy regional airspace generates that volume every few minutes, across hundreds of aircraft simultaneously. No human analyst can watch all of it. The question that actually matters for airspace security isn't "can we collect the data," it's "which mathematical definition of unusual will actually catch the flight that doesn't belong" — and that answer changes depending on which of three fundamentally different modeling approaches you choose.

2. Core Explanation

2.1 What "Anomaly Detection" Means for a Flight Track

Before comparing algorithms, it's worth being precise about what we're actually trying to detect, because "anomaly" is doing a lot of work in that sentence. A flight track is a time-ordered sequence of state vectors — typically latitude, longitude, altitude, ground speed, heading, and vertical rate, sampled every second or few seconds from ADS-B (Automatic Dependent Surveillance–Broadcast) or radar data. An anomaly, in this context, is any point or sub-sequence in that trajectory that departs meaningfully from the patterns a model has learned to expect — whether that's a sudden unexplained turn, an altitude excursion, a route that deviates from every historical flight along a similar corridor, or a track that behaves nothing like any aircraft the model has seen before.

Critically, there are two different anomaly shapes worth distinguishing, because they call for different tools:

• Point anomalies — a single moment where the aircraft's state is implausible or unusual (an instantaneous speed spike, an altitude that doesn't match the aircraft type, a location far outside normal corridors).
• Sequence (contextual) anomalies — no single point looks wrong in isolation, but the shape of the trajectory over time is unusual: a loitering pattern, an unexplained holding pattern, a flight path that gradually drifts off a known route.

Isolation Forest is naturally suited to the first category. Autoencoders sit in between. LSTM-based models are built specifically for the second. Understanding this distinction up front explains most of the design tradeoffs discussed below.

2.2 Isolation Forest: Anomalies Are Easy to Isolate

Isolation Forest takes a refreshingly different approach from most anomaly detection methods: instead of modeling what "normal" looks like and measuring distance from it, it exploits a simple structural insight — anomalous points are easier to separate from the rest of the data than normal points are.

The mechanism works by building many random binary trees. At each node, the algorithm picks a random feature (say, altitude) and a random split value, dividing the dataset in two. It repeats this recursively. The key insight: a normal data point, sitting in a dense cluster of similar points, takes many random splits to isolate into its own leaf — you have to slice through a lot of similar neighbors first. An anomalous point, sitting far from any cluster, tends to get isolated in just a few splits, almost by accident, because there's so little surrounding it to separate it from. Averaging the path length to isolation across many trees (the "forest") gives an anomaly score: short average path length means "isolated quickly, therefore anomalous"; long average path length means "deeply embedded in normal data."

For flight tracks, Isolation Forest is typically applied to a feature vector per point or per short window — for example, (altitude, speed, vertical rate, turn rate) at each timestamp, or summary statistics over a short sliding window. It has no inherent sense of sequence or time order; it treats each row as an independent snapshot. This is both its greatest strength and its central limitation: it's fast, requires no labeled anomalies, scales well to large datasets, and needs almost no hyperparameter tuning to get a usable first result — but it cannot, on its own, tell that a smooth, individually-plausible sequence of points collectively traces out an implausible maneuver over time.

2.3 Autoencoders: Anomalies Are Hard to Reconstruct

An autoencoder is a neural network trained to do something that sounds pointless at first: reproduce its own input. The network is structured as two halves — an encoder that compresses the input into a smaller, lower-dimensional representation (the "bottleneck" or "latent space"), and a decoder that tries to reconstruct the original input from that compressed representation. Because the bottleneck is smaller than the input, the network is forced to learn which patterns matter most in order to compress and reconstruct efficiently — it cannot simply memorize a lookup table.

The anomaly-detection logic follows directly from this design: if the autoencoder is trained only on normal flight behavior, it becomes very good at compressing and reconstructing normal patterns, but poor at reconstructing patterns it has never seen. When a genuinely unusual trajectory segment is fed through, the reconstruction comes out visibly wrong — and the size of that error, called reconstruction error, becomes the anomaly score. A large gap between input and reconstruction signals "this doesn't look like anything I learned to compress well."

Autoencoders sit between Isolation Forest and LSTM-based models in an important sense: a standard (feedforward) autoencoder, like Isolation Forest, typically operates on a fixed-size feature vector or a fixed window of points and has no built-in memory of longer-term sequence structure. But because it's a learned, nonlinear model rather than a random-split heuristic, it can capture more complex, curved relationships between features than Isolation Forest's axis-aligned splits can — for instance, the joint relationship between altitude, speed, and bank angle during a normal turn, which is a smooth manifold rather than a simple box-shaped cluster.

2.4 LSTM Networks: Anomalies Are Hard to Predict

LSTM stands for Long Short-Term Memory, a type of recurrent neural network architecture specifically designed to model sequences — data where order and history matter, which is exactly what a flight track is. Unlike Isolation Forest or a plain autoencoder, an LSTM processes a trajectory step by step, maintaining an internal "memory" state that carries forward relevant information from earlier in the sequence (was the aircraft climbing a few steps ago? has it been holding a steady heading?) and updates that memory as new points arrive.

There are two common ways LSTMs get applied to trajectory anomaly detection:

• LSTM as a predictor: the model is trained to predict the next state of the aircraft given its recent history. During deployment, the anomaly score is the gap between what the model predicted and what actually happened — a large, persistent prediction error means the aircraft is behaving in a way that recent history didn't anticipate.
• LSTM-Autoencoder (a hybrid): the encoder/decoder structure of a standard autoencoder is combined with LSTM layers, so instead of reconstructing a single point or fixed window, the model reconstructs an entire sequence of points, and reconstruction error is computed across the whole trajectory segment.

This sequence-awareness is precisely what lets LSTM-based approaches catch the anomalies that Isolation Forest and plain autoencoders structurally cannot: a slow, deliberate deviation where every individual point looks perfectly plausible, but the accumulated pattern over dozens of seconds — an unusual loiter, a gradual unauthorized descent, a subtly repeated holding pattern — is what actually gives it away. The cost of this capability is real: LSTM models need substantially more training data, more compute, more careful tuning of sequence length, and are markedly harder to interpret than a tree-based isolation score.

3. Side-by-Side Comparison

In practice, most production-grade trajectory anomaly detection pipelines don't pick just one of these — they run Isolation Forest as a cheap, fast first-pass filter across the entire dataset, then apply an LSTM-based model selectively to segments or aircraft that warrant deeper temporal scrutiny, using the autoencoder family as a middle-tier option when a full sequence model is more compute than the use case justifies.

4. Worked Example / Analogy

Imagine three different security guards watching the same hallway of foot traffic, each with a different way of deciding who looks suspicious.

The first guard (Isolation Forest) doesn't know anyone's name or history — they just notice that most people walk at a similar pace, in similar clothes, along a similar path, and anyone who's easy to describe in one weird sentence ("the only person wearing a snowsuit," "the only person walking backward") gets flagged almost instantly, because it takes so few distinguishing details to separate them from the crowd. This guard is fast and needs no training on what "normal" looks like beyond the crowd itself, but they only notice people who look wrong right now — not people whose entire walk down the hallway was strange.

The second guard (Autoencoder) has studied thousands of hours of normal hallway footage and has learned to summarize any given moment in a few key details, then reconstruct the full scene from that summary. When someone acts in a way that doesn't compress and reconstruct cleanly — an unusual combination of speed, posture, and direction the guard has never learned to summarize well — the mismatch stands out.

The third guard (LSTM) watches not just a snapshot but the entire walk from entrance to exit, remembering where each person has been and using that memory to predict where they'll go next. This guard is the only one who notices the person who behaved perfectly normally at every single instant but circled back through the same hallway three times in a row — a pattern invisible to anyone judging single moments alone.

5. Application to Defense & Aerospace

For airspace security applications, the choice among these three approaches maps directly onto operational priorities. A high-throughput surveillance pipeline monitoring an entire flight information region in real time often deploys Isolation Forest as the first line of triage — cheap enough to run continuously across every tracked aircraft, flagging obviously implausible point-level readings (altitude/speed combinations inconsistent with aircraft type, physically impossible instantaneous maneuvers) for immediate review, often symptomatic of transponder faults, message corruption, or spoofing.

Autoencoders become valuable when the anomaly of interest depends on the joint relationship between several kinematic features rather than any one feature alone — for instance, learning the normal manifold of altitude/speed/bank-angle combinations for a specific approach corridor, and flagging departures from that learned manifold even when no single feature looks extreme.

LSTM-based models earn their higher cost in scenarios where the anomaly is the sequence — detecting unauthorized loitering near sensitive installations, gradual unauthorized descent profiles, or repeated reconnaissance-like patterns that no single point in the track would reveal. In practice, a mature Center of Excellence pipeline typically layers all three: fast statistical triage, mid-tier learned reconstruction, and selective deep sequence modeling reserved for tracks or corridors where temporal context is operationally decisive — reflecting the same tiered logic used in most real-world intrusion-detection architectures outside the aerospace domain as well.