Threat assessment system

Method of determining suspicious behaviour (degree of threat), comprising: processing an image 600 to identify 608 and track 610 an object, thereby generating first order data; processing first order data over time to generate second order data 612; estimating a rapid first threat level from the first order data 614, 616; estimating a slower second threat level from the second order data 622; and generating threat assessment based on the first and second threat levels 618. Generating second order data may comprise processing the first order data using a probabilistic behaviour inference algorithm. Second order data may comprise a scenario probability score which is compared to predefined probabilistic behaviour scenarios (Figs. 11-20) to determine a most probable behaviour and hence a threat level. A master threat score may be based on: motion intensity; a rapid threat score; a threat level of a probable behaviour scenario; and/or a threat level associated with a state within a behaviour scenario. An action 626-634, such as an alarm, may be performed in dependence on the master threat score and confidence level. Low confidence threats may be subject to user feedback in order to refine the model parameters 630, 636, 638.