A system for creating an access model for an individual for an access control system, that controls users' access to a building or facility by its users, the system comprising: one or more of a computer processor and a computer storage device configured to: store a plurality of access models used by the ACS, wherein the access models comprise patterns of access by an individual or a group of individuals to one or more resources protected by the ACS; store attributes for the individual or group of individuals, the attributes including information about each individual or group of individuals that relates to the ACS; receive attributes of an individual not associated with an access model, the attributes including information about the individual that relates to the ACS; compare the attributes of the individual not associated with an access model to the attributes of the individual or group of individuals who are associated with one or more of the plurality of access models; use the plurality of access models to create a new access model to be used for the individual not associated with the access model; and use the created access model for the individual not associated with an access model to classify access to the one or more resources protected by the ACS by the individual not associated with an access model as either normal or anomalous; wherein the new access model to be used for the individual not associated with an access model is created by selection of an access model for the individual from the plurality of access models used by the ACS as a function of a similarity of the attributes of the individual not associated with an access model to the attributes of one or more of the individual or group of individuals who are associated with one or more of the plurality of access models used by the ACS. one or more of a computer processor and a computer storage device configured to: store a plurality of access models used by the ACS, wherein the access models comprise patterns of access by an individual or a group of individuals to one or more resources protected by the ACS; store attributes for the individual or group of individuals, the attributes including information about each individual or group of individuals that relates to the ACS; receive attributes of an individual not associated with an access model, the attributes including information about the individual that relates to the ACS; compare the attributes of the individual not associated with an access model to the attributes of the individual or group of individuals who are associated with one or more of the plurality of access models; use the plurality of access models to create a new access model to be used for the individual not associated with the access model; and use the created access model for the individual not associated with an access model to classify access to the one or more resources protected by the ACS by the individual not associated with an access model as either normal or anomalous; store a plurality of access models used by the ACS, wherein the access models comprise patterns of access by an individual or a group of individuals to one or more resources protected by the ACS; store attributes for the individual or group of individuals, the attributes including information about each individual or group of individuals that relates to the ACS; receive attributes of an individual not associated with an access model, the attributes including information about the individual that relates to the ACS; compare the attributes of the individual not associated with an access model to the attributes of the individual or group of individuals who are associated with one or more of the plurality of access models; use the plurality of access models to create a new access model to be used for the individual not associated with the access model; and use the created access model for the individual not associated with an access model to classify access to the one or more resources protected by the ACS by the individual not associated with an access model as either normal or anomalous; wherein the new access model to be used for the individual not associated with an access model is created by selection of an access model for the individual from the plurality of access models used by the ACS as a function of a similarity of the attributes of the individual not associated with an access model to the attributes of one or more of the individual or group of individuals who are associated with one or more of the plurality of access models used by the ACS.