Method and apparatus for detecting anomalous flights. Embodiments collect sensor data from a plurality of sensor devices onboard an aircraft during a flight. A plurality of feature definitions are determined, where a first one of the feature definitions specifies one or more of the plurality of sensor devices and an algorithm for deriving data values from sensor data collected from the one or more sensor devices. Embodiments determine whether anomalous activity occurred during the flight using an anomaly detection model, where the anomaly detection model describes a pattern of normal feature values for at least the feature definition, and comprising comparing feature values calculated from the collected sensor data with the pattern of normal feature values for the first feature definition. A report specifying a measure of the anomalous activity for the flight is generated.