An apparatus for detecting fault states of an aircraft is provided. The apparatus receives training data including operational parameters of the aircraft operating over a plurality of training flight legs and applies a first clustering algorithm separately to the training data to produce first clustered data. The apparatus applies a second clustering algorithm to the first clustered data to produce second clustered data that indicates a plurality of states describing behavior of the aircraft operating over the training legs and applies a third clustering algorithm to identify one or more fault states of the aircraft from the plurality of states based on the training data and the second clustered data. The apparatus receives messages carrying data from the aircraft over a digital datalink, detects a fault state of the one or more fault states from the data, and generates an alert of the fault state.