# Hybrid Machine Learning-Statistical Method for Anomaly Detection in Flight Data
## 2 Literature Review  
In the past decade, several advanced machine learning-based analytical methods have been proposed to find anomalies and new hidden patterns within large sets of flight data. Broadly, all of these methods can be categorized into three categories: supervised, unsupervised and semi-supervised. Supervised techniques make use of the correct solution known in advance for a learning set of data, and this solution is used to train the models. On the other hand, unsupervised techniques do not know any solution for the given dataset, and therefore learning algorithms try to find the hidden structure of the given dataset. Semi-supervised techniques generally use a small amount of data with correct answers and a large amount of data without any solution. The labeling of data in anomaly detection problems is time-consuming and involves very high costs. It requires human expertise, and thus it may not be free from human bias. Furthermore, labeled datasets with anomalies tend to be highly skewed, e.g., 95% normal and 5% anomalous. This may have issues such as challenges in training a classifier in a supervised way. In civil aviation, finding or generating examples based on specific anomalies is highly dependent on human expertise. It is not possible to acquire all the examples of anomalous flights (outliers), and therefore it is important to select the correct examples of labels in order to perform accurate classification with the least number of labels. This is known as the problem of label acquisition [5]. Furthermore, unsupervised learning helps to model the underlying or hidden structure or distribution in the data to learn more about the data. The following paragraphs discuss major anomaly detection methods that have been proposed for flight data analysis in the past decade. Based on the work of [PERSON] [6], which combined discrete and continuous data, Multiple Kernel Anomaly Detection (MKAD) developed by [PERSON] et al. [7] is based on kernel functions and a one-class support vector machine. It is still one of the state-of-the-art methods to detect anomalies in flight data containing both continuous as well as discrete data; both works were one class problem. The ClusterAD-Flight [8] and ClusterAD-DataSample [9] were two cluster-based anomaly detection algorithms developed to address the issue of multiple classes of flight data. Apart from the binary classification of the flights, these two algorithms identified the norms of flight data and detected any outliers. There were no exceedance-based criteria used in these algorithms. The ClusterAD-Flight, proposed by [PERSON] et al. [8], was based on a clustering method called density-based spatial clustering of applications with noise (DBSCAN). In this method, the multivariate time series of each flight was transformed to a high dimensional vector space, which resulted in performance issues when applied to large datasets. A Gaussian mix model (GMM) can be used to detect multiple patterns in flight data. This model was used in ClusterAD-DataSample [9], where clustering was performed at each time point during a flight. Probability-based models were used to characterize the results. The performance of three methods, ClusterAD (CAD), MKAD and exceedance-based detection, was discussed in the work of [PERSON] et al. [8]. Surpassing the exceedance-based detection method, both CAD and MKAD were much more capable of identifying operationally significant anomalies. For continuous flight parameters such as airspeed and for earlier known safety issues, CAD performed better as compared to MKAD. MKAD, on the other hand, was more sensitive towards discrete parameters such as landing gear on or off. More heterogeneous datasets were suitable for MKAD, and both MKAD and CAD detected anomalies across a group of flights. Semi-Markov switching vector autoregressive (SMS-VAR) model used by [PERSON] et al. [10] detected anomalous flights by measuring the difference between the predicted value and the actual data value. [PERSON] et al.