In many multiagent domains, no single observation event is sufficient to determine that the behavior of individuals is suspicious. Instead, suspiciousness must be inferred from a combination of multiple events, where events refer to the individual’s interactions with
other individuals. Hence, a detection system must employ a detector that combines evidence from multiple events, in contrast to most
previous work, which focuses on the detection of a single, clearly
suspicious event. This paper proposes a two-step detection system,
where it first detects trigger events from multiagent interactions,
and then combines the evidence to provide a degree of suspicion.
The paper provides three key contributions: (i) proposes a novel
detector that generalizes a utility-based plan recognition with arbitrary utility functions, (ii) specifies conditions that any reasonable
detector should satisfy, and (iii) analyzes three detectors and compares them with the proposed approach. The results on a simulated
airport domain and a dangerous-driver domain show that our new
algorithm outperforms other approaches in several settings.