What Is Pattern-of-Life Analysis?

Last updated: October 19, 2026

Why it matters to your mission. A subject of interest leaves traces across signals, imagery, human, open-source, and movement reporting, but those traces sit in separate systems and no one has time to line them up by hand. Pattern-of-life analysis reconstructs the subject's recurring activity over time so the routine, and any break from it, becomes visible. The outcome is an analyst who can anticipate what a watched entity does next instead of reacting after it has already acted.

Definition

Pattern-of-life analysis is the intelligence technique of studying an entity's observed activities across many sources over time to establish its normal routine - where it goes, when it is active, and who it interacts with - so analysts can detect deviations and anticipate what it will do next. It is sometimes called pattern analysis, activity pattern analysis, or a component of activity-based intelligence. It is built on top of resolved entities and fused multi-source reporting; you cannot pattern an entity you have not first assembled from its fragments.

A pattern of life is not a single report. It is the accumulation of many observations, placed in time and space, until a routine emerges and the exceptions stand out against it. The analytic value is in the exceptions: the night the usual vehicle does not appear, the new number that joins the network, the facility that goes quiet before an operation.

Key takeaways

• What it is: reconstructing an entity's recurring activity over time from many sources, to establish a baseline routine and detect departures from it.
• Why it is hard: the observations are fragmented across disciplines and systems, carry conflicting identifiers, and have to be tied to one resolved entity before any pattern is real.
• What it needs first: entity resolution and multi-INT fusion. A pattern built on mismatched records is fiction.
• What to require: multi-source and temporal coverage, provenance on every observation, analyst adjudication, and the ability to run where the mission runs.
• The payoff: a routine an analyst can brief, an anomaly an analyst can act on, and a line from every point in the pattern back to the report it came from.

Why Does Pattern-of-Life Analysis Matter for Intelligence?

Most mission questions are not "what happened once." They are "what does this entity normally do, and what does a change in that routine mean." A single sighting tells you an entity exists. A reconstructed pattern of life tells you when it is vulnerable, when it is preparing, and when something has shifted.

Consider a facilitator under watch. One geospatial track of a vehicle at a compound is a data point. Thirty tracks over two months, correlated with when a phone is active and when payments move, is a routine: the compound is used on specific nights, the vehicle arrives before the phone goes active, and the money follows within a day. Now the exception carries meaning. When the vehicle appears on an unusual night and the phone stays dark, that break from the baseline is the indicator worth a collection decision.

This is where the cost of getting the earlier steps wrong compounds. If two different people were resolved into one entity, the pattern averages two lives and describes neither; if a real match was missed, half the routine is invisible. Pattern-of-life analysis inherits every error in the entity resolution and fusion beneath it and amplifies it into a confident-looking conclusion, which is why the discipline sits on resolved, fused, provenance-bearing data and not raw feeds.

The Department of War treats the underlying data problem as a program-level obstacle, not a detail. Independent oversight has found that for defense AI, usable and labeled data, not the algorithm, is the central bottleneck: the U.S. Government Accountability Office reports that building an AI capability to detect an adversary's submarines "requires gathering many images of various submarines and labeling them so the AI can learn to identify one on its own" (see GAO, Artificial Intelligence: Status of Developing and Acquiring Capabilities for Weapon Systems, GAO-22-104765, 2022). Pattern-of-life analysis is the same problem at the behavioral level: without fused, resolved, time-stamped observations, there is no baseline to pattern and no anomaly to detect.

How Does Pattern-of-Life Analysis Work?

Pattern-of-life analysis is a pipeline that runs on top of fused data, not a single algorithm. In an intelligence setting the stages are:

• Resolve the entity first. Every observation has to be tied to one real-world subject before it can be patterned. This is the entity resolution step, and it is a precondition, not an afterthought.
• Assemble multi-source observations in time and space. Pull signals, geospatial tracks, human reporting, open-source activity, and movement or financial records into a common timeline, each keeping its original timestamp and source.
• Establish the baseline. Sort the observations to find the recurring structure: which locations, which hours, which days, which contacts repeat. Army doctrine describes this with a pattern analysis plot sheet, a circular calendar that arranges activity by day and hour to surface when an event habitually occurs.
• Map the network around the entity. Pattern of life is rarely about one actor in isolation; link analysis ties the subject to the people, places, and objects that recur in its routine.
• Detect deviations. Compare new observations against the established baseline and flag what departs from it: a missing routine, a new contact, an unusual time or place.
• Adjudicate and attach confidence. Route ambiguous observations and anomalies to an analyst rather than asserting them, and carry a confidence score with every element.
• Preserve provenance. Keep every point in the pattern linked back to the report it came from, with its original classification, so the conclusion can be inspected, briefed, and reversed.

The sorting technique is doctrinal, not novel. U.S. Army intelligence doctrine lists pattern analysis, chronologies, and link analysis among its structured analytic techniques, because a routine only becomes visible once scattered observations are arranged against time and against each other.

What Data Does Pattern-of-Life Analysis Need?

A pattern of life is only as rich as the observations it draws on, and no single discipline is enough. It combines:

• Geospatial and movement data: tracks, locations, and imagery-derived observations that place the entity in space over time.
• Signals and technical data: selectors, device identifiers, and network activity that show when an entity is active and who it communicates with.
• Human and open-source reporting: context, associations, and events that technical collection alone does not explain.
• Transactional and financial records: payments, registrations, and logistics that reveal supporting activity.

Two properties matter as much as the sources. First, time: every observation needs a reliable timestamp, because the pattern lives in the temporal structure, not the raw count. Second, provenance: because a pattern-of-life conclusion can drive a collection or operational decision, each observation has to stay traceable to its source and classification, so an analyst can defend why the baseline looks the way it does and why an anomaly was called.

What Is the Difference Between Pattern-of-Life Analysis and Activity-Based Intelligence?

These terms travel together and are often blurred. They describe different scopes. The table separates them so each can be cited on its own.

Pattern-of-life analysis is one of the methods inside activity-based intelligence, applied once you have an entity worth watching. Both depend on the same foundation of resolved, fused, time-stamped, multi-source data.

What Makes Pattern-of-Life Analysis Hard in a Multi-INT Environment?

• It rests on everything beneath it. A pattern is only as sound as the entity resolution and fusion under it. Over-resolve and you blend two routines into one; under-resolve and half the routine disappears.
• Adversaries break their own patterns on purpose. A subject that varies routine, uses new selectors, or inserts deliberate noise is attacking the baseline directly.
• Observations are sparse and uneven. Collection is not continuous; gaps in coverage can look like changes in behavior that are really changes in what was observed.
• Classification and releasability constrain correlation. Observations arrive at different classification levels and compartments; the pattern has to be built without pooling data that rules say cannot be combined.
• Anomalies are not automatically meaningful. A deviation from routine may be an indicator or may be noise. Separating the two is analytic judgment, not a threshold.
• It has to be defensible. A pattern that drives a decision must be inspectable back to its sources; an anomaly no one can trace is a liability, not an indicator.

How Torch.AI Approaches Pattern-of-Life Analysis

Torch.AI builds reasoning infrastructure the customer can own and govern, available as a government-owned (GOTS) deployment when a mission requires it. It produces the foundation pattern-of-life analysis depends on, not the pattern-of-life product itself. The reasoning layer connects to mission data where it lives and does not replace the systems of record it draws from.

Three capabilities map to the problem this page describes. NEXUS makes fragmented data meaningful: it normalizes records and extracts entities and events from unstructured text, so observations carry consistent, time-stamped representation. HALO resolves records into one entity through graph-based fusion and ties it to the people, places, and objects that recur around it, which is the network and temporal structure a pattern of life is read from. ORCUS provides the multi-source ingestion, normalization, and cross-classification data availability underneath both, so observations from different disciplines and classification levels can be correlated without being improperly pooled. Every resolved entity and relationship stays traceable to its sources. See how this is packaged as a capability on the Torch.AI software page.

Because the reasoning layer acts as a system of reason on top of the customer's existing systems of record, the authoritative observations stay intact and interoperable, and an analyst can inspect why the baseline looks the way it does and why an anomaly was flagged. The harder the entity resolution and multi-INT fusion problem, the more the underlying infrastructure decides whether the resulting pattern can be trusted. For the pillar behind this page, see multi-INT fusion.

For evaluators scoping a capability, see how Torch.AI delivers entity resolution and graph-based fusion on multi-INT data, deployable government-owned, on the software page, or request a technical walkthrough.

What to Require for Defense and Intelligence

A pattern-of-life capability is only as trustworthy as the data and the traceability beneath it. Require:

1. Built on entity resolution. The capability resolves observations to one real-world entity before patterning, and surfaces match confidence.
2. Multi-source and temporal. Correlates signals, geospatial, human, open-source, and transactional observations against a reliable timeline.
3. Provenance-preserving. Every observation in the pattern traces back to its source report and original classification.
4. Baseline and anomaly aware. Establishes a routine and flags departures from it, rather than only displaying activity.
5. Classification-aware. Respects classification, compartments, and releasability while correlating, not only after.
6. Human judgment preserved. Analysts adjudicate anomalies and ambiguous observations; confidence is surfaced, not hidden.
7. Runs where the mission runs. Enterprise, on-premise, classified, and disconnected or degraded edge.
8. Government-owned option. The customer can keep control of the reasoning layer, the resolved entities, and the logic, rather than renting them inside a vendor platform. Ownership varies (GOTS or COTS) with how the capability is deployed and purchased.

Evaluating a capability? These requirements are the backbone of a pattern-of-life evaluation you can score against. Bring them to a scoping call and we will walk each one against your environment: request a technical walkthrough.

Sources

• U.S. Government Accountability Office, Artificial Intelligence: Status of Developing and Acquiring Capabilities for Weapon Systems, GAO-22-104765 (2022), gao.gov - usable, labeled, fused data (not the algorithm) is the central bottleneck for defense AI; the behavioral analogue is pattern-of-life analysis, which needs fused, resolved, time-stamped observations before any baseline exists.
• U.S. Army, ATP 2-33.4, Intelligence Analysis (January 2020, public release; distribution unlimited) - defines pattern analysis, chronologies and timelines, and link analysis as structured analytic techniques, including the pattern analysis plot sheet that arranges activity by day and hour to reveal when an event habitually occurs.
• U.S. Joint Chiefs of Staff, Joint Publication 2-01.3, Joint Intelligence Preparation of the Operational Environment - describes time-pattern analysis for determining periods of highest threat from recurring adversary activity.

What is pattern-of-life analysis?

It is the intelligence technique of studying an entity's observed activities across many sources over time to establish its normal routine - where it goes, when it is active, and who it interacts with - so analysts can detect deviations and anticipate what it will do next.

Why does pattern-of-life analysis matter for intelligence?

Because most mission questions turn on what an entity normally does and what a change in that routine means; a reconstructed pattern of life tells an analyst when a subject is preparing, when it is vulnerable, and when something has shifted, which a single sighting cannot.

How does pattern-of-life analysis work?

It resolves observations to one entity, assembles multi-source reporting in time and space, establishes a baseline routine, maps the surrounding network with link analysis, detects deviations from the baseline, adjudicates anomalies with an analyst, and keeps every observation traced to its source.

What data does pattern-of-life analysis need?

Multi-source observations - geospatial and movement, signals and technical, human and open-source, and transactional records - each with a reliable timestamp and provenance back to its source, tied to one resolved entity.

What is the difference between pattern-of-life analysis and activity-based intelligence?

Pattern-of-life analysis reconstructs the recurring routine of a specific entity over time; activity-based intelligence is the broader discipline that studies activity in an area or domain and resolves entities from it. Pattern of life is one method inside activity-based intelligence.

What makes pattern-of-life analysis hard in a multi-INT environment?

It rests entirely on the entity resolution and fusion beneath it, adversaries deliberately vary their routines, collection is sparse and uneven, classification constrains what can be correlated, and every conclusion has to remain traceable enough to defend.