A system for monitoring operation of a vehicle includes a processing device including an interface configured to receive measurement data from sensing devices configured to measure parameters of a vehicle system. The processing device is configured to receive measurement data from each of the plurality of sensing devices, and in response to detection of a malfunction in the vehicle, input at least a subset of the measurement data to a machine learning classifier associated with a vehicle subsystem, the classifier configured to define a class associated with normal operation of the vehicle subsystem. The processing device is also configured to determine whether the subset of the measurement data belongs to the class, and based on at least a selected amount of the subset of the measurement data being outside of the class, output a fault indication, the fault indication identifying the vehicle subsystem as having a contribution to the malfunction.