A non-transitory computer storage medium, which, when executed on a processor, performs an operation for evaluating objects detected in a video stream, comprising:
- detecting a plurality of foreground objects present in the video stream;
- for each foreground object of the plurality of foreground objects, building a trajectory characterizing each foreground object in a series of successive frames of the single video stream, the trajectory comprising a vector comprising kinematic data for the foreground object from when the foreground object is first observed in the single video stream to when the foreground object leaves the single video stream;
- storing each trajectory in a memory;
- identifying one or more patterns of behavior of objects in the video stream using the stored trajectories;
- detecting a successive foreground object in the video stream;
- building a trajectory of the successive foreground object;
- determining a probability distribution that the trajectory of the successive object is anomalous based on the stored trajectories;
- and
- if the trajectory of the successive object is determined to be anomalous, generating an alert.