Security in physical environments has become increasingly important in the wake of terror and criminal activity, particularly over the past decade. One of the challenges is to identify activities that may not be outright illegal or breaches of security, but that are suspicious, i.e. where there is a possibility that these activities may lead to breaches of security. Technology such as RFH) is used to track the access and movement of people in highly security physical environments. This paper presents methods of detecting patterns of suspicious activity in logs collected by such physical access control systems. It also outlines methods of predicting future suspicious activities based on such logs.