Satellite Anomaly Detection in Time Series Data: How It Works

What Is an Anomaly in Satellite Time Series?

An anomaly in a satellite time series is a measurement that differs significantly from what would be expected based on historical behavior. The word "anomaly" does not automatically mean something bad — it means "unexpected." That unexpected change might be a deforestation event, a flood, a successful reforestation program, or simply a sensor artifact.

The goal of automated anomaly detection is to flag these unusual points so that human analysts can focus their attention where something interesting or important may have happened — rather than manually scanning thousands of data points.

Why Anomaly Detection Needs Baselines

To detect what is unusual, you first need to define what is usual. The baseline is typically:

1. Historical observations from the same location — The most direct reference. If NDVI is usually 0.6–0.8 in July and drops to 0.2 in July, that is anomalous.

2. Seasonal models — Fit a mathematical curve to the annual cycle, then flag points that deviate beyond a threshold from the model.

3. Moving window statistics — Compare each observation to the recent preceding observations, flagging sudden changes.

The choice of baseline method matters:

• Long historical baseline (3+ years): Better at characterizing normal seasonal variation but slower to adapt to genuine long-term change
• Short baseline: Adapts to trends quickly but may miss gradual changes

Types of Anomalies in Vegetation Time Series

Abrupt Drop (Single Observation)

A single severely depressed value followed by recovery to normal levels. This is often caused by:

• Cloud contamination that was not fully masked (most common false alarm)
• Brief crop harvest if the polygon overlaps multiple fields
• Wildfire passing through followed by initial regrowth

How to evaluate: Check whether the preceding and following dates both show normal values. If yes, this is likely cloud contamination unless confirmed by visual inspection of the imagery.

Abrupt Permanent Drop

The index drops sharply and does not recover to previous levels. This is a strong signal of:

• Deforestation — The cleared area permanently loses its vegetation signal
• Urban construction — Impervious surface replaces vegetation
• Mine expansion — Progressive land clearing

Key feature: The index stays depressed for multiple subsequent observations, not just one.

Gradual Multi-Year Decline

The seasonal peak values decrease year over year. This subtle pattern indicates:

• Chronic water stress — Gradually declining groundwater table
• Slow deforestation — Edge effects progressively reducing forest interior condition
• Desertification — Gradual vegetation loss in dryland areas

This type of anomaly is almost impossible to detect in single-image analysis but becomes obvious in a properly scaled long-term time series.

Suppressed Seasonal Peak

The annual maximum is lower than typical but does not show a catastrophic drop. This suggests:

• Drought year — Reduced rainfall suppressed peak biomass
• Reduced crop planting — Fewer fields planted in this area
• Selective forest thinning — Partial canopy removal

Phenological Shift

The timing of the seasonal cycle shifts earlier or later. An NDVI peak arriving 3 weeks earlier than the historical average might indicate:

• Earlier spring temperatures (climate trend)
• Different crop variety with shorter growing season
• Change in irrigation schedule

SAR-Specific Anomalies

SAR backscatter anomalies have different characteristics from optical indices because radar responds differently to land surfaces.

Flood Signature

A sudden, sharp drop in VV intensity by 5+ dB, typically accompanied by unchanged or increased CR. The drop occurs because calm water specularly reflects the radar pulse away from the sensor. This signature is often visible within one Sentinel-1 overpass (6-day cycle) of a major flood event.

Forest Clearing

A permanent drop in VH and RVI that does not recover. Unlike flooding, which reverses when waters recede, cleared forest shows sustained low VH because the volume scatterers (tree canopy) are permanently removed.

Construction

A step increase in VV intensity from urban double-bounce scattering. New buildings reflect strongly in VV even before full completion.

False Anomalies: The Main Sources of Confusion

Cloud and Shadow Contamination

Even with automated cloud masking, some cloud-affected pixels slip through. These appear as single-observation dips in NDVI or other optical indices. They are usually:

• Isolated to a single date (no neighboring dates affected)
• Associated with visible cloud in the true-color imagery
• Not consistent across multiple spectral indices

Rule of thumb: If only one index (e.g., NDVI) shows a dip but EVI and NDMI are unaffected, check the imagery for cloud coverage.

Sensor Calibration Differences

Sentinel-2A and 2B have slightly different spectral responses. Early in the mission when only one satellite was operational, switching to two-satellite coverage could introduce small systematic offsets in some indices. These appear as a step change in the time series that coincides with the mission timeline, not with any visible change on the ground.

Phenological Timing Variation

In regions with variable weather, the timing of seasonal events shifts year to year. An early spring green-up may look like an anomaly compared to the average climatological baseline, even though nothing is "wrong" — it just happened earlier.

SAR Ambiguities

SAR anomalies can be caused by:

• Wind effects on crop canopies (temporary backscatter change)
• Soil moisture changes after heavy rain (increased VV even without surface change)
• SAR acquisition geometry variation over the time series

Practical Anomaly Investigation Workflow

When an anomaly is flagged in your monitoring graph:

Step 1: Check the date and context. Is it a known event date (storm, fire report, planned logging)? If yes, the anomaly is likely real and already explained.

Step 2: Look at neighboring dates. Single-date anomalies are more likely artifacts. Multi-date anomalies that persist are more likely real events.

Step 3: Inspect the imagery. Click on the anomalous data point to open the satellite scene. Look for visible change in true-color imagery, smoke, cloud coverage, or other clues.

Step 4: Cross-check with another index. If NDVI drops but SAR VH is stable, cloud contamination is more likely. If both optical and SAR show concurrent anomalies, the event is almost certainly real.

Step 5: Compare with surrounding areas. Does the anomaly affect only your polygon, or is it region-wide? Region-wide anomalies suggest a large event (drought, regional fire season) or a systematic data artifact.

Using Anomaly Detection as an Alert System

The most powerful application of automated anomaly detection is as a near real-time alert system. With a 5–6 day satellite revisit cycle, you can detect significant changes within one to two weeks of their occurrence.

For environmental monitoring applications, this means:

• Detecting unauthorized deforestation within days of clearing
• Identifying crop failure in time to respond with agricultural support
• Tracking post-disaster recovery progress week by week
• Monitoring port activity for sudden changes in ship density

Summary

Satellite anomaly detection works by comparing current observations against a statistical baseline derived from historical time series data. Points that deviate significantly — whether a sudden drop, a persistent decline, or an unusual seasonal pattern — are flagged for investigation. The critical step is distinguishing real anomalies (deforestation, flooding, drought) from artifacts (cloud contamination, sensor effects). Always validate flagged anomalies by inspecting the underlying imagery and cross-checking with other indices before drawing conclusions.