When monitoring a large crowd, anomaly-detection techniques focus on:

Explanation

Effective crowd observation is baseline-and-anomaly: first, internalize the normal pattern of movement, density, sound, and behavior at the venue and time; then attend to deviations — a person stationary while others flow, lingering and scanning, repeated visits to sensitive locations, atypical clothing for weather, tension or avoidance behaviors, or hand-near-waistband adjustments. Single observations rarely justify action; clusters of indicators trigger heightened attention and possibly engagement. Profiling by appearance (a) is unlawful and operationally weak. Continuous counting (b) is impossible and not useful. Entrance-only monitoring (d) ignores threats already inside.