1. An apparatus for detection of abnormal activity in a video stream, the video stream having video frames, the apparatus comprising: a system maintenance and setup module; a module that extracts motion vectors, from each of the video frames, that represent an approximate common movement direction of a predetermined sub-part of each of said frames; a system training module that creates at least one statistical model representing usual activity based on said motion vectors or on at least one motion feature generated from said motion vectors; and a motion detection module that detects abnormal activity by determining according to the at least one statistical model, that a probability of at least one motion vector of said motion vectors associated with said predetermined sub-part or said at least one motion feature extracted from the at least one motion vector associated with said predetermined sub-part, is below a predetermined threshold when compared to the said at least one statistical model, wherein said predetermined sub-part is a macro-block; and wherein the at least one statistical model is represented as a one-dimensional histogram representing the distribution of values of one of the at least one motion feature.