Finding Tiny Earthquakes by Their Fingerprints

A small earthquake can disappear into a noisy seismogram while leaving a recognizable pattern. If a nearby earthquake has already supplied a good example, we can search for that pattern directly. The question becomes: where does this particular sequence of wiggles occur again?

That is the appeal of seismic matched filtering. It uses an observed earthquake as a template, slides it through continuous recordings, and measures waveform similarity. A three-station experiment shows how this works and where caution is needed.

A seismogram combines the source, the propagation path, the recording site, and the instrument. Nearby earthquakes with similar mechanisms can share enough of those ingredients to produce strikingly similar waveforms. Even their scattered coda can help identify a family.

For each position in the continuous record, normalized cross-correlation compares a template with a data window. After subtracting their means, multiply corresponding samples and sum them, then divide by the product of the two windows’ energy norms. The resulting coefficient lies between −1 and 1. A positive value near one means strong similarity with the same polarity. Normalization removes a simple amplitude scaling, although additive noise still degrades the match.

At a network, each station has its own template and arrival delay. Shift the correlation traces onto the same event-time reference, then average or sum them. A real repeat can reinforce across stations; an isolated disturbance often cannot. Gibbons and Ringdal (2006) demonstrated the value of stacking correlation traces, including signals that were difficult to identify using conventional energy-based detection.

The earlier Earth Inversion cross-correlation tutorial develops the equation and time-shift intuition.

The example uses the public ObsPy recording from the May 10, 2018 Nový Kostel swarm in western Bohemia: vertical-component data at NKC, ROHR, and PLN. Two reference earthquakes, at 14:24:50 and 19:42:08 UTC, provide templates; their catalog magnitudes are ML 2.9 and 2.8. The waveform archive and template choices come from the ObsPy Development Team’s (n.d.) detector tutorial.

The accompanying run applies a 1 Hz high-pass filter, computes signed, sliding-window normalized correlations, and averages three station contributions at consistent relative delays. It searches 12:00:30–23:59:30 UTC, avoiding the record edges. A candidate must exceed 0.5 at every station; peaks are separated by at least ten seconds. Windows within ten seconds of either template origin are excluded from the independent count.

That leaves nine non-self candidates. Eight fall within 1.5 seconds of events in the original WEBNET catalog (Institute of Geophysics, Czech Academy of Sciences, n.d.). These are origin-time associations, not independent event identifications; chance coincidences remain possible in a swarm. The remaining candidate, at about 14:27:51 UTC, is unvalidated. It should not be labeled a new earthquake.

One catalog-associated candidate occurs at approximately 19:41:55 UTC, thirteen seconds before the second template earthquake. Its catalog magnitude is ML 1.5. The mean correlation is 0.680, with individual coefficients of 0.702, 0.591, and 0.747 at NKC, ROHR, and PLN. Its shape remains recognizable despite the smaller recorded amplitudes.

For perspective, the catalog contains 404 events in the interval, including both templates. They span different locations and detectabilities, so this comparison is not a recall estimate. Two templates recognize selected families; this experiment establishes neither completeness nor a gain over another detector.

Matched filtering is particularly useful when earthquakes repeat within an active source region. But every template also defines a preference. Changes in location, mechanism, frequency content, or path can reduce similarity even when a genuine earthquake is present. A missing match provides weak evidence for absent seismicity.

Adding templates expands the families represented, while also increasing computation and opportunities for chance matches. Detection counts depend on both the earthquake population and the detector’s changing view of it. A sudden increase after adding templates should not be interpreted automatically as a physical change in earthquake rate.

The scale of the opportunity is substantial. Ross et al. (2019) used template matching to build a Southern California catalog containing 1.81 million earthquakes, roughly ten times the size of the comparison catalog. That gain depended on the regional archive and processing effort.

The fingerprint metaphor has a technical neighbor. FAST, introduced by Yoon et al. (2015), searches compact fingerprints for similar waveform segments without requiring a preselected earthquake template. The experiment here uses conventional waveform cross-correlation, not FAST.

A threshold such as 0.5 is an operational choice, not a probability that an event is real. Its meaning changes with window duration, filtering, station coverage, template quality, and noise. Scanning more time and more templates creates more chances for an accidental peak.

Many workflows use a threshold based on median absolute deviation, or MAD, to adapt to the background correlation level. A multiplier still needs calibration against the actual noise and the desired false-alarm tolerance. Check the software’s exact definition: implementations can differ in whether and how the correlation series is centered.

Station consistency gives an additional check. A large network mean can hide one poor station match. Requiring support at every station is more selective, but can also discard an earthquake when one station is noisy. Inspect both the stack and its individual contributions before choosing that trade-off.

The threshold sweep illustrates this sensitivity: requiring every station to exceed 0.3 produces 52 candidates, with 33 catalog matches; at 0.4, there are 20 and 18; at 0.6, only two candidates remain, both matched. These counts exclude self-matches. Unmatched counts are not measured false-alarm counts. One station-time-offset control produced no candidates here, but does not calibrate a false-alarm rate.

Known catalog matches are useful checks. Unmatched peaks need waveform review and, ideally, additional stations or independent picking and association. A missing catalog entry alone does not establish a newly discovered earthquake.

Self matches. A template searched against the recording from which it was cut should find itself. That tests processing and alignment. It does not count as an independent detection, and should be excluded when reporting additional events.

Timing. A correlation peak refers to the template’s chosen time reference. Turning it into an origin-time estimate requires keeping the offset between the template window and the reference event’s origin. Fine sampling can produce many decimal places without providing equally accurate earthquake locations. Relative timing and relocation require their own checks.

Magnitude. Normalized correlation deliberately discards amplitude scaling. Its peak height cannot tell us an earthquake’s magnitude. Relative amplitudes can help for sufficiently similar events, but source spectra, instrument gain, noise, and path differences matter. Even a convenient software magnitude estimate needs calibration to the magnitude scale being reported. The experiment therefore uses catalog magnitudes for catalog-associated matches rather than treating correlation as a magnitude meter.

A credible workflow keeps its template choices, processing parameters, station availability, thresholds, exclusions, and validation together. EQcorrscan provides tools for template construction, matched-filter detection, and subsequent analysis (Chamberlain et al., 2018). ObsPy makes a compact demonstration accessible, as in the accompanying example.

The payoff is a more detailed view of an earthquake family’s activity. Getting there requires showing both what the detector finds and what its design makes easy to miss.

The accompanying script, results, detection CSV, and figures record the exact run and input-file checksums. Reproduction downloads the ObsPy waveform example and original WEBNET catalog. The source catalog reports times to whole seconds, so timing agreement does not establish subsecond absolute accuracy. No instrument-response removal or independent relocation was performed.