To each mini-seed seismic recording contained in a specified training period, we fit an iTree to the time windows extracted from the corresponding waveform segment so that the size of the IF ensemble corresponds to the number of mini-seed recordings. This was done so that the ensemble is representative of the entire training period under consideration. A specific iTree is trained on a random subsample of size ψ=256 taken from the time windows extracted over the corresponding miniseed recording to a maximum depth of log⁡2(ψ)=8, so that the overall procedure has linear computational and memory complexity. This sub-sampling size was motivated empirically by , and the choice of the maximum depth is the Scikit-learn default. We remark that a mini-seed recording typically corresponds to a calendar day and contains approximately 1728 time windows when taken with 50 s overlap. In the rare case that a recording do not contain 256 time windows, we upsample randomly with replacement so that the iTrees are always trained to subsamples of the same size.

The above choices can be appreciated via an analogy between the number of steps from root to terminal node for time window x in an iTree, and the path length of an unsuccessful search in a binary search tree (BST). For iTree r in an IF we denote the former by hr(x) and refer to it as the path length for brevity. Assuming a random BST, the average path length of an unsuccessful search can be computed theoretically as c(ψ)=2H(ψ-1)-2(ψ-1)ψ with H(j)≈log⁡(j)+γ the harmonic number and γ Euler's constant . Because iTrees and binary search trees (BST) have an identical typology, c(ψ) serves as a reasonable reference value for the path length, although it is not necessarily true that E[hr(x)]=c(ψ) for new time windows x not used to fit the iTree. Returning to Scikit-learn's default behavior, we observe that c(ψ)=O(log⁡2(ψ)) so that by default the maximum depth grows in the order of the average path length of an unsuccessful search in a random BST.

During evaluation, the iTrees are kept frozen and an IF anomaly score is computed for all time windows x extracted from the waveform segment covering the evaluation period. The more anomalous the time window x, the lower we expect the average of the path lengths h(x)=1R∑r=1Rhr(x) over the iTrees to be. The IF anomaly score for time window x is computed in Scikit-learn as 1s(x)=2-h̃(x)c(ψ) where h̃(x)=h(x)+1R∑r=1Rc(nr(x)) with nr(x) the number of time windows in the subsample used to construct iTree r in the corresponding leaf node of x. The additional term is a correction factor to account for the fact that the iTrees are not trained to their maximum granularity. We remark that 0<s(x)<1 with a higher score indicating a more anomalous time window, and when s(x)=0.5 the corrected expected path length of x is equal to the BST reference value. Given that the iTrees are kept frozen, the evaluation has linear complexity in terms of the number of time windows.

Our objective is to find waveform segments in the seismic data containing counts that exhibit anomalous behavior. To this end we propose to use a trigger that operates on the IF anomaly scores of time windows, which we call the IF trigger. This trigger is activated when the IF anomaly score of a sliding window exceeds a specified onset threshold. We continue sliding windows until the IF anomaly score drops below a specified offset threshold, and we mark the waveform segment starting from the start time of the onset window until the start time of the offset window as anomalous. We refer to waveform segments flagged by the IF trigger as IF segments.

The onset and offset thresholds can be either preset or calibrated to annotations if available. In the case where calibration is not possible one needs to resort to rule-of-thumb values. While such recommendations are inherently heuristic in nature, we argue that such specifications should meet the following requirements:

An IF anomaly score of 0.5 means that the corrected average path length of the corresponding time window over the ensemble is equal to the BST reference value. Since approximately 11.42 % of all time windows considered in the case studies had an IF anomaly score of at least 0.5, this value should serve as a lower bound for both thresholds.

Located in southern Switzerland's Canton Valais, the Illgraben is one of Europe's most active debris flow torrents. Its catchment drains an area of ca. 10 km2 and produces sediments at higher elevation, which are mobilized during heavy precipitation to form debris flows and sediment-laden torrential floods. Each year, several such flows with volumes of a few tens of thousands m3 reach the Rhône River . Illgraben's debris flows move at several meters per second and feature the typical boulder-rich fronts, which are efficient seismic sources that can be detected on local seismic networks . At Illgraben, the Swiss Federal Institute for Forest, Snow and Landscape Research WSL maintains a semi-permanent seismic network that monitors debris flows and consists primarily of 1 Hz seismometers (Fig. ). In addition, WSL's debris flow observatory at Illgraben contains geophone plates, automatic cameras and depth gauges to measure flow arrival times and flow depths at various points along the torrents, especially at concrete structures stabilizing the channel “Check Dams”;. We consider data from the Illgraben seismic network for the period covering 10 April 2018 to 28 August 2022. Summary statistics are given in Table  of Appendix .

A debris flow signature can be defined to occur when the seismic waveforms of multiple stations are affected in the expected pattern as a debris flow moves down the torrent. This is illustrated in Fig. , where we show waveform segments and the corresponding IF anomaly scores on 6 July 2021 when a debris flow was active in the torrent. We see that the debris flow first effects the upper stations ILL14-ILL18 and subsequently ILL12, ILL13 and ILL11 in order.

An existing catalog of debris flow segments, each coupled with a specific station, was independently curated by cross-referencing detections made by WSL's Illgraben debris flow observatory with the seismic waveforms of the stations in the network, keeping the above definition in mind. Since a debris flow signature does not always manifest as clearly as in Fig. , each debris flow segment in the catalog is associated with a confidence level, which is defined as follows:

High confidence. The segment is observed during a debris-flow signature and contains a clear signal.

The existing catalog will be referred to as the WSL catalog with corresponding summary statistics given in Table  of Appendix . In the remainder of this section we refer to lower- and medium confidence segments in a catalog as lower-confidence segments. A trigger segment overlapping with a lower-confidence segment in a catalog, but with no high-confidence segment, is called a lower-confidence trigger segment.

To each station in the Illgraben seismic network we apply the STA-LTA, IF and IF-DTW workflows of Sect.  using data from 2018–2020 for training. The calibration of the triggering algorithm for a station is done by using all corresponding segments in the WSL catalog as an initial catalog. The trigger segments are then extracted, scored and kept frozen. For the IF trigger, we select on- and offset thresholds from {0.55,0.6,0.65,0.7} and {0.50,0.55,0.6,0.65} through a grid search of the IoU metric, under the constraint that the onset threshold cannot be lower than the offset threshold. For the classical STA-LTA trigger, we found it difficult to choose a single grid that worked well on all stations and thus opted for a local search method instead. First, we conducted an extensive grid search on ILL11 and found that using a long-term window of 5000 s, a short-term window set to 10 % of the long-term window, and onset and offset thresholds of 6.0 and 0.125, respectively, yielded a high IoU score. This configuration of hyper-parameters was used as a starting point for all stations. We then performed local neighborhood searches, with an exponential step size of 2, until no improvement in the IoU metric can be found. The selected hyper parameters for both triggers are reported in Table .

For calibration of the thresholds we used the catalog produced in the preprint version of this paper . This catalog was produced following three major updates of the WSL catalog using the workflow of Fig. , but where a simpler form of DTW was used to score the segments. We provide more detail in Appendix , but note that after the second update in the formulation of this catalog the lower-confidence class was expanded to include other types of mass movements such as rockfalls, landslides and slope failures. For a chosen station we prune away lower-confidence catalog and trigger segments according to the preprint catalog before computing the IoU metric. In this way the lower-confidence segments are explicitly encouraged to be included in the trigger segments, and to become detections if they happen to be recovered alongside high-confidence segments. The selected score thresholds and minimum detection lengths for all the workflows are reported in Table .

Following the calibration procedure the detections made were used to update the preprint catalog and form a final evaluation catalog. In the formulation of this catalog, to keep the number of detections to investigate manageable, we excluded detections from stations ILL14, ILL15, ILL16 and ILL17 from the IF and STA-LTA workflows. These stations are located above Illgraben's upper catchment near substantial noise sources associated with a water reservoir, a skiing resort, cow grazing and human activity around various buildings. For IF-DTW, all detections were used to update the catalog. As in the calibration of the thresholds, for a given station, we prune away lower-confidence catalog segments and detections, this time according to the evaluation catalog. The corresponding pruned detections and catalog segments over a given time period are compared and used to calculate IoU, recall and precision metrics. We provide detailed tables of these values over the training and test periods in Tables  and , respectively, where the test period was taken to be 2021–2022. The respective number of low, medium and high confidence segments increased from 14, 23, 209 in the WSL catalog to 197, 44, 257 in the final updated catalog.

Table  provides average IoU, recall and precision metrics over the test period for three different station groups. The first station group containing stations ILL11, ILL12, ILL13 and ILL18 represents stations where the performance of all the methods is better relative to the second group, which contains stations ILL14, ILL15, ILL16 and ILL17. The third group corresponds to all the stations. With detection IoU, recall and precision of up to 68 %, 100 % and 98 %, respectively, we see that the IF-DTW outperforms the IF workflow. The IF workflow, in turn, outperforms the STA-LTA workflow in terms of the averages for all metrics and in all groups. While the performance of all methods are worse for the ILL14, ILL15, ILL16 and ILL17 station groups, the degradation is more severe for the STA-LTA and IF workflows.

We found that the STA-LTA trigger tends to prefer exceedingly long window sizes (see Table ) to manage sensitivity towards amplitude, in order to avoid flagging an excessive number of false positive segments (see Fig. ). However, these long window sizes lead to event masking, where a first event will suppress the characteristic function over a neighboring subsequent event inviting false negatives. We illustrate this in Fig.  where two debris flows segments associated with ILL18 on 31 July 2021 are shown. Due to the long window sizes, the characteristic function of the flows are suppressed by preceding increased amplitude in the seismic waveforms. We include more examples in Figs.  and .

The sensitivity of the STA-LTA trigger to amplitude and its proneness to event masking means that it is difficult to find a configuration of hyper parameters where both the number of false positives and false negatives are small. On the other hand, the IF anomaly score has a natural robustness to amplitude due to the threshold splits along the time axis used to construct iTrees (see Fig. ). This is why the IF workflow provides superior metrics in terms of the IoU, recall and precision with an increase of 19.82 %, 45.50 % and 17.71 % on average for all stations over those produced by the STA-LTA workflow. We remark that since the IF anomaly score is computed from the path lengths in iTrees, which are built in a randomized manner, there is nothing explicitly guiding the score to discriminate between different types of events. This is in contrast to IF-DTW, where the score reflects the dissimilarity between the IF segment and debris flow segments according to the segment DTW distance. At stations ILL11–ILL13 and ILL18 the average improvement for the IoU, recall and precision metrics offered by the IF-DTW over the IF workflow is 10.17 %, 11.65 % and 1.15 %, respectively, and this increases to 33.59 %, 23.24 % and 58.46 % for stations ILL14–ILL17. The reason for the difference in the scale of the improvement is because the IF anomaly score happens to rank debris-flow time windows highly at stations ILL11-ILL13 and ILL18 (see Figs.  and ).

Our Greenlandic site locates on the western coast at the Karrat Fjord (Fig. ). In this fjord system a 35–58 millionm3 rock avalanche occurred on 17 June 2017 generating a tsunami wave that destroyed parts of the nearby village Nuugaatsiaq and claimed 4 fatalities . The rock avalanche and precursory slip events left clear seismic signatures on the nearby broadband station NUUG, installed in the village Nuugaatsiaq . To investigate the detectability of the 17 June 2017 rock avalanche and comparable signals, we focus on station NUUG as well as KARAT, a broadband seismometer that was installed in summer 2022 about 6 km west of the rock avalanche epicenter. Finally, we also use the broadband station ILULI, which has been operating since 2009 in the village of Ilulissat, approximately 280 km south of Karrat Fjord.

While our primary focus is the generation of a catalog of events for the KARAT station, we illustrate the unsupervised exploration procedure of Sect.  by applying it to waveforms obtained from NUUG over the period 1 January 2017 to 28 June 2017, using waveforms from ILULI over the period 1 January 2017 to 31 December 2017 as the control station (see Table  for summary statistics). The IF trigger flagged 194 segments in the corresponding waveforms. The highest ranking IF segment according to the IF segment score corresponds to the rock avalanche discussed in the preceding paragraph, with a corresponding value of 0.7373 and control IF segment score of 0.7171 (both accurate to four decimals). Time series of the preprocessed counts and IF anomaly scores contained in the rock avalanche segment are shown in Fig. . The same figure contains a boxplot of the heights at which individual IF segments merge with the remainder inside a dendrogram constructed from the pairwise segment DTW distances between the 194 IF segments under complete linkage. The larger the merge height, the more dissimilar the corresponding IF segment is with respect to the remaining segments. The rock avalanche segment achieved the largest height with a value of 8618.74. We emphasize that its enormous volume made this event a rare example of a mass movement that is strong enough to show up as a highly anomalous seismic signal at both NUUG and the control station ILULI.

We apply the exploration procedure of Sect.  to waveforms obtained from the KARAT station for the period 30 May 2022 to 20 October 2023 using waveforms from ILULI over the period 1 January 2022 to 31 December 2023 as the control station (see Table  for summary statistics). The IF trigger flagged a total of 605 segments in the KARAT waveforms of which we could relate 96 to mass movements, most of which are likely iceberg calving events. To determine if an IF segment is related to a mass movement the seismic waveforms and corresponding spectograms around the segment flagged by the IF trigger are investigated by a domain scientist and a mass-movement label is recommended based on well-known characteristics of calving seismograms (see Figs. – and ). Once such a label is recommended, additional verification is performed using satellite images if available. A clearly missing piece of a glacier terminus confirms a calving event (Fig. ). In some cases, the capsizing of a large tabular iceberg may produce a similar seismic signature (Fig. ). An equivalent procedure is used to confirm whether an IF segment is related to a teleseismic or regional earthquake, with additional verification from the United States Geological Survey and the Geological Survey of Denmark and Greenland earthquake catalogs. Fig.  shows for each k∈1,2,…,605 the proportion of the k leading IF segments that are related to mass movements. The graph spikes fairly quickly with a maximum value of 45.83 % at k=48 showing that the IF segment score tends to rank mass movements highly.

The unsupervised workflow split the 605 IF segments into 13 clusters as summarized in Table ; the corresponding Ward linkage dendrogram and clustering of the IF segments are shown in Fig. . Cluster 13 is exclusively populated by highly ranked IF segments flagged before 15 August 2022 when the instrument was streaming sporadically and with high amplitudes (see Fig. ). Since these likely correspond to issues on the instrumentation side, these segments are labeled as instrument-related noise. The noise class was expanded to include IF segments corresponding to anthropogenic events such as installation and service work near the station, helicopters arriving and departing from the station alongside electronic glitches/spikes. The majority of the IF segments in cluster 11 correspond to these events, with one IF segment possibly related to a mass movement, but with a degree of uncertainty. Around 29.91 % of the IF segments in cluster 1 were extracted from 25 and 26 September 2022, 2 d with 198 and 192 gaps in the corresponding recordings, so that spectrograms could not be computed. These segments contained unusually enhanced low-frequency (< 0.5 Hz) content. This was confirmed by observing that none of the IF segments inside the cluster survived a high-pass screening procedure whereby the raw waveforms over the IF segments are extracted, preprocessed by increasing the corner frequency of the zero-phase high-pass filter to 0.5 Hz and reapplying the IF trigger with no retraining. In the case of cluster 4, 95.16 % of the IF segments were extracted from 25 September 2022 and application of the high-pass screening process reduced the cluster to a single IF segment corresponding to noise. Similarly, we found that clusters 2, 3, 5, 7, 10 contain IF segments flagged due to increased low-frequency content, particularly during the months of September–January (see Fig. ). Wind noise, ocean swell, snow cover and other meteorological conditions may explain this observation. Based on these findings, we explore a cluster only if at least one of the IF segments remaining after the high-pass screening can be related to a mass movement, otherwise the cluster is not explored further.

The results of the high-pass screening procedure left clusters 6, 8, 9, 10 and 12 to be inspected. Clusters 9 and 12 consisted of IF segments, which all resembled mass movements signatures. We give representative waveform-spectrogram plots of these clusters in Figs. , and . Mass-movement related IF segments make up 86.36 % of cluster 8 which also contains a few noise related events; a representative example is given in Fig. . Cluster 10 consists of a number of exceedingly long IF segments with an average duration of 10.77 h. The the high-pass screening procedure left 14 IF segments, 10 of which are related to mass movements (some of the original IF segments are split into multiples by the high-pass screening). Included in the remaining IF segments is the Dixon fjord rock avalanche and tsunami which is illustrated in Fig. . One of the remaining segments is related to a regional earthquake, another to a teleseismic earthquake and the remaining 2 to noise. The majority of the IF segments in cluster 6 correspond to earthquakes (86.54 %) alongside a few mass-movement- and noise related segments. One of these mass-movement events corresponds to a major calving event that occurred on 27 July 2023 and reached the ILULI station.