A spatio-temporal topology learning system for detection of suspicious access control behavior in a physical access control system (PACS). The spatio-temporal topology learning system including an access pathways learning module configured to determine a set of spatio-temporal properties associated with a resource in the PACS, an inconsistency detection module in operable communication with the access pathways learning module, the inconsistencies detection module configured to analyze a plurality of historical access control events and identify an inconsistency with regard to the set of spatio-temporal properties, and if an inconsistency is detected, at least one of the events is flagged as potentially suspicious access control behavior.