A method and apparatus for creating an anomalous behavior detection log for reporting anomalous behavior of a monitored individual in an environment are described including training an anomaly detection classifier using first time-stamped event data for an initial period of time and raw sensor data, accepting second time-stamped event data of subsequent behavior from sensors in the environment for a subsequent period of time, logging the second time-stamped event data of subsequent behavior of the monitored individual, mining an action sequence based on a selected subset of mined manipulation patterns, calculating an anomaly score of each mined action sequence using the anomaly detection classifier and creating an anomalous behavior detection log based on the anomaly scores.
