A computer-implemented method, comprising: obtaining motion indicators for a plurality of samples of a video stream; obtaining an anomaly state for each of a plurality of time windows of the video stream, each of the time windows spanning a subset of the samples, by (i) obtaining estimated statistical parameters for the given time window based on measured statistical parameters characterizing the motion indicators for the samples in at least one time window of the video stream that precedes the given time window and (ii) determining the anomaly state for the given time window based on the plurality of motion indicators obtained for the samples in the given time window and the estimated statistical parameters; and processing the video stream based on the anomaly state for various ones of the time windows.