A security system monitors a behavior of a person included in a plurality of camera images captured continuously in time series by a surveillance camera. The security system performs tracking processing of detecting each person region of a person included in a plurality of camera images, and identifying a person included in the plurality of camera images in time series based on person image data included in the person region. When the identification by the tracking processing transitions to failure in the middle, it is determined that a person having suspicious behavior is included in the camera image. When it is determined that the suspicious behavior is included, alert information may be notified from an output device.