{'fraction_non_alphanumeric': 0.01335113484646195, 'fraction_numerical': 0.0, 'mean_word_length': 5.410256410256411, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Identifying Suspicious Behavior from Multiple Events

Suspicious behavior detection becomes increasingly more challenging when agents are observed over a longer period of time. The detection system has to identify suspicious subjects from a collection of individual’s events, where no single event is enough to decide whether his/her behavior is suspicious, but the combination of multiple events enables reasoning. We establish a probabilistic Bayesian framework for evaluating multiple events and show that the optimal evaluation is not possible in practice. We propose a naïve and a heuristic approach and test them on an airport domain. The heuristic approach achieves high performance resulting in high detection rate and low false-alarm ratio.