A method is provided for detecting a threat in a distributed multi-camera surveillance system. The method includes: monitoring movement of an object in a field of view of a first camera using software installed at the first camera; detecting a suspicious object at the first camera when movement of the object does not conform with a motion flow model residing at the first camera; sending a tracking request from the first camera to a second camera upon detecting the suspicious object at the first camera; monitoring movement of the object in a field of view of the second camera using software installed at the second camera; assigning threat scores at the second camera when the movement of the object does not conform with a motion flow model residing at the second camera; and generating an alarm based in part on the threat scores detected at the first camera and the second camera.