So, presumably, there are uber-secret flights that the military and cia, etc operate which are so clandestine that they appear civilian. However, their flight plans are probably quite similar to the known law enforcement/military stuff. Eg: circling over certain places or circling/tracking a moving car. So in theory you could train a network on known civilian vs known law enforcement and then have it identify the as yet unidentified law enforcement flight plans?
I don't think you'd even need anything fancy. Here's the list of things that are true of most of the surveillance aircraft I've found:
Flies in circles
Flies over one region for hours
Flies at around 5000 feet altitude
Squawks 4414 or 4415
Uses a callsign that starts with JENA or JENNA
Registered owner in Bristow VA, Greenville DE, Wilmington DE, or Manassas VA
I have some simple code that highlights planes that are flying in circles so that I can take a closer look at them.