The present disclosure includes systems and methods for detecting an anomaly in crowd behavior. The method includes receiving sensor data representing a crowd, and partitioning the sensor data into local areas forming neighborhoods. The method further includes, for each local area, characterizing motion in the local area to determine real-time estimates of motion of sub-populations based on the sensor data, providing a crowd model for each local area, representing continuous functions describing expected motion near each local area, and determining parametric values of the crowd model based on the real-time estimates of the motion of the sub-populations. The method further includes learning and adapting auxiliary stochastic models characterizing normal evolution of the parametric values of the crowd model over time associated with each local area, and identifying a potential anomaly associated with the local area by comparing predictions from an auxiliary stochastic model with parametric values of the crowd model.