Unsupervised Anomaly Detection in Satellite Time Series: When AI Learns 'Normal'

Supervised deep learning gets the headlines, but most operational monitoring runs on a quieter idea: you rarely have labelled examples of the thing you are trying to catch. Nobody hands you a training set of "the week this specific reservoir started dropping." What you have instead is history — years of imagery over the same place — and a question: is today unusual?

That is the job of unsupervised anomaly detection. This post explains how it turns a stack of satellite images into a signal you can watch, which methods separate a real anomaly from ordinary seasonal change, and how to run it over an area without code.

What is unsupervised anomaly detection in a satellite time series?

It is finding observations that do not fit a place's own established pattern, learned from the data itself rather than from labelled examples. You reduce each image over an area of interest to a number — average vegetation index, water extent, radar backscatter, night-light brightness — and stack those numbers into a time series. The model learns the range and rhythm that series normally holds, then flags any point that sits outside it. Because it never needs a human to mark "anomaly" versus "normal," it scales to places and events you never anticipated.

The trade is honesty about what an anomaly is: a statistical outlier, not an explanation. The method tells you when and where something departed from baseline; deciding what happened is still interpretation. That division of labour — machine flags, analyst explains — is the same one that runs through AI satellite imagery analysis generally.

Why unsupervised rather than supervised learning?

Because labels are the bottleneck. Supervised models — the CNNs and segmentation networks that classify land cover or detect objects — need thousands of annotated examples per class, and they only recognise categories they were trained on. An anomaly, by definition, is the thing you did not train for: a novel disturbance, an off-season drawdown, an unexpected clearing. Supervised classification answers "which known class is this pixel?"; anomaly detection answers "is this behaviour unlike its own past?" The second question needs no label at all, which is why it generalises to events no training set foresaw.

Data-quality reality reinforces the choice. As the machine-learning classification guide notes, model accuracy is dominated by training-data quality — and for rare events, high-quality labels barely exist. Learning each area's own baseline sidesteps that entirely.

How do you turn imagery into a signal you can watch?

You collapse each scene into one or more indices over the same footprint, then track them through time. Optical imagery gives spectral indices: NDVI for vegetation vigour (USGS NDVI), NDWI or a water mask for surface water, NBR for burn severity — see understanding NDVI for how the vegetation index behaves. Radar gives backscatter and coherence, which respond to structure and moisture and, crucially, work through cloud and darkness, as covered in why SAR sees through clouds.

Two practical rules shape the signal. First, aggregate over an area, not a lone pixel: a per-pixel series is noisy, while the mean or a percentile over a drawn polygon is stable enough to trust. Second, respect revisit — Sentinel-2 optical returns every five days and Sentinel-1 SAR on a similar cadence, so the series is irregular and gappy once you drop cloud-blocked optical scenes. A robust detector has to tolerate gaps rather than assume a clean daily record.

What methods actually flag an anomaly?

They range from a one-line rule to learned detectors, and each earns its place.

• The ±2σ rule (z-score). Compute the mean and standard deviation of the baseline, then flag any observation more than two standard deviations away. Under a normal distribution roughly 95% of values fall inside ±2σ and about 99.7% inside ±3σ (the empirical rule), so a ±2σ threshold marks the outer ~5% as unusual. It is transparent, cheap, and — with a sensible baseline — surprisingly hard to beat.
• Seasonal decomposition. Vegetation and water follow an annual cycle, so a raw threshold fires every spring and autumn. Decomposing the series into trend, seasonal, and residual components — the classic STL approach (Seasonal-Trend decomposition using Loess) — lets you test the residual for anomalies, so a genuine change stands out against the expected seasonal swing instead of being drowned by it.
• Isolation Forest. A tree-based detector that isolates points by random splits; outliers get isolated in fewer splits, so they score as anomalous (Liu, Ting & Zhou, 2008). It handles multiple indices at once — say NDVI and backscatter together — without assuming any distribution.
• Local Outlier Factor. Scores a point by how much sparser its neighbourhood is than its neighbours' (Breunig et al., 2000), which catches local anomalies a single global threshold misses.

Start with ±2σ on a deseasonalised series; reach for Isolation Forest or LOF when you are watching several indices together or the "normal" band is not a simple bell curve.

What separates a real alert from noise?

Mostly it is controlling for the three things that masquerade as change: season, clouds, and geometry. Seasonality is handled by decomposition, as above. Clouds are the quiet killer of optical series — an undetected cloud or shadow can swing NDVI hard — so you either mask aggressively or lean on SAR, which is unaffected by cloud. Geometry and revisit gaps mean a single off-baseline point can be an artefact; requiring persistence, such as two consecutive anomalous passes, cuts false alarms sharply.

The reward for that discipline is early warning. A reservoir drawing down ahead of schedule, a forest edge advancing, construction starting on a quiet parcel, a normally dark stretch of coast lighting up at night — each shows first as a residual stepping outside the band, often before it is obvious to the eye. Pairing the flag with change detection between the pre- and post-anomaly scenes turns "something is off here" into "here is exactly what moved."

How does Off-Nadir Delta do this without code?

You draw an area, pick an index, and let it watch. Satellite area monitoring builds the time series for the polygon you draw and applies a ±2σ baseline — the same empirical rule above — so an observation that steps outside each area's own two-sigma band is flagged as an anomaly, with no scripting, no GIS install, and no training labels. Because the baseline is per-area and per-index, the system learns what is normal for that place rather than applying one global threshold everywhere.

From a flag, the rest of the loop is one step away: open the area on the map to compare the pre- and post-anomaly scenes, or ask the Delta Agent what the departure might mean and which sensor confirms it. The machine keeps the watch and marks the break in rhythm; you decide what it means. For where this fits a broader intelligence workflow, see what is geospatial OSINT.

Try it

Pick a place whose rhythm you know — a reservoir, a field, a construction site, a stretch of coast — draw it, choose an index, and let a baseline form. The value of unsupervised detection is that you do not have to specify in advance what you are looking for. You teach the system each area's normal, and it tells you when normal breaks.

---

Off-Nadir Delta runs on open, openly licensed satellite data for situational awareness. Anomaly flags are statistical indicators, not conclusions — confirm any alert against the underlying imagery before acting on it. Off-Nadir Delta is an independent project and is not affiliated with any organization or institution.