Disclosed herein are a method and a device for surveilling an abnormal behavior using 3D image information. The surveilling device converts depth information, which is the 3D image information, into a real world coordinate and uses the real world coordinate to calculate a plane reference distance value. The surveilling device uses the plane reference distance value to generate a background model and compares the background model with the plane reference distance value of a current image to detect a region of interest. Further, the surveilling device extracts the 3D feature information of the region of interest to determine an abnormal behavior of an object.