We introduce a new approach to characterize and detect threatening behaviors in surveillance systems, without relying on history or expertise. This approach consists in simulating the worst-case attack plans, fusing their semantic descriptions and using the produced patterns to raise alerts in operational conditions. We demonstrate our set of tools on a simple scenario involving geolocated sensors looking for moving vehicles targeting a protected objective. We find that the system is able to recover well-grounded graph patterns defining detection rules which make sense in the operational context. We believe that our approach achieves a relevant compromise between data-based and expertise-based systems, and allows for a good balance between efficiency and understandability.