Plan recognition focuses on a mechanism for recognizing the unobservable state of an agent, given observations of its interaction with its environment (Avrahami-Zilberbrand, 2009). Most existing investigations assume discrete observations in the form of activities. To perform anomalous and suspicious behavior detection, plan recognition algorithms may use a hybrid approach. A symbolic plan recognizer is used to filter consistent hypotheses and passes them to an evaluation engine, which focuses on ranking.

These were advanced approaches that were applied to various real-life scenarios, targeted at discovering anomalies. In the following sections, we'll dive into more basic approaches for suspicious and anomalous pattern detection.