Abstract: Method and apparatus for detecting anomalous flights. Embodiments collect sensor data from a plurality of sensor devices onboard an aircraft during a flight. Feature definitions are determined, specifying a sensor device and an algorithm for deriving data values from sensor data collected from the device. Embodiments determine whether anomalous activity occurred during the flight using an anomaly detection model. An anomaly is detected including at least one of (i) a contextual anomaly where a data instance of a plurality of data instances is anomalous relative to a specific context, or (ii) a collective anomaly where two or more data instances are anomalous relative to a remainder of the plurality of data instances, even though each of the two or more data instances is not anomalous in and of itself. A report specifying a measure of the anomalous activity for the flight is generated.