The present invention relates generally to a method and system (10) for classifying vehicle behaviour, particularly abnormal behaviour of civil aircraft (12). The method may comprise receiving aircraft data from an aircraft (12) which is to be classified; and determining whether the received aircraft data comprises identification information for the aircraft (12). In response to a determination that the received aircraft data comprises identification information, the method may comprise using said identification information to classify the behaviour of the aircraft (12). In response to a determination that the received aircraft data does not comprises identification information, the method may comprise obtaining the position of the aircraft and comparing the obtained position to an expected route for the aircraft to classify the behaviour of the aircraft (12).