Most of the nuclear security-related incidents occurring in the world are the theft of nuclear materials and radioactive materials. Furthermore, these cases are mostly committed by insiders in nuclear facilities, it means that the current detection system and technology for nuclear materials theft by insiders is inadequate.? As a countermeasure, it is possible to strengthen the education of the nuclear security culture for employees and increase the number of observers, but that alone will not be a fundamental solution and the human and economic burden on the facility side will increase. In many theft, the stealing action appears independent of the actions that occur before and after it. When detecting such a simple theft, if each action is observed in order, it is possible to determine the removal of an object that should not be taken out. Therefore, if a typical unit act of taking out can be found, the theft may be determined. However, in order to detect theft in a nuclear facility, theft that is disguised as normal work must also be detected. If the theft is disguised as a normal work, it may not include the typical unit of theft, so it is necessary to detect the theft from a time-series sequence of the unit acts.? For this reason, in this study, a method was developed that makes it possible to identify the theft disguised as normal work from the time-series sequence of unit actions.?