Methods and apparatus for detecting a swarm attack based on a plurality of convergence hypotheses related to correlated movements of entities in an area of interest. Projected tracks for the entities are determined based on position reports received for the entities. At least one of the convergence hypotheses are updated based, at least in part on the projected tracks and a convergence hypotheses is output when a score assigned to the hypothesis exceeds a threshold value.