Human behavior alerts are determined from a video stream through application of video analytics that parse a video stream into a plurality of segments, wherein each of the segments are either temporally related to at least one of a plurality of temporally distinct transactions in an event data log; or they are each associated with a pseudo transaction marker if not temporally related to at least one of the temporally distinct transactions and an image analysis indicates a temporal correlation with at least one of the distinct transactions is expected. Visual image features are extracted from the segments and one-SVM classification is performed on the extracted features to categorize segments into inliers or outliers relative to a threshold boundary. Event of concern alerts are issued with respect to the inlier segments associated with the associated pseudo transaction marker.