A surveillance system implements an architecture and process to support real-time abnormal behavior assessment operations in a distributed scalable sensor network. An automated behavior model builder generates behavior models from sensor data. A plurality of abnormal behavior scoring engines operating concurrently to generate abnormal behavior assessment models by scoring the behavior models. An execution performance manager performs fast switching of behavior models for the abnormal behavior scoring engines. The execution performance manager performs detection of abnormal behavior score distribution characteristic deviation by comparing a current abnormal behavior assessment model to a pre-recorded abnormal behavior assessment model. The execution performance manager selects a pre-recorded behavior model for the abnormal behavior scoring engines when the deviation exceeds a predetermined threshold.