These are categories of suspicious behavior:
Surveillance: Someone recording or monitoring activities. This may include the use of cameras (either still or video), note taking, drawing diagrams, annotating on maps or using binoculars or other vision-enhancing devices.
Elicitation : People or organizations attempting to gain information about military operations, capabilities, or people. Elicitation attempts may be made by mail, fax, telephone, or in person. Examples could include being approached at a gas station (or mall or airport or library, etc) and asked about what's happening at the base; getting a fax (or an e-mail or a telephone call, etc) asking for troop strength numbers... or the number of airplanes on base... or deployment procedures... or how a trash-collection truck gets on base... or the location of the HQ building... or how many people live in a certain dorm... or where the commander lives... or how many people hang out at the officers/enlisted club at night... or which nightclubs/restaurants off base are highly frequented by military people... or the workings of the base's network firewall, etc.
Tests of security: Any attempts to measure reaction times to security breaches or to penetrate physical security barriers or procedures in order to assess strengths and weaknesses. Examples: a person grabs the base fence and shakes it and sees how long it takes for police to respond; a driver approaches the front gate (without ID and/or car sticker) and pretends to be lost or to have taken a wrong term, just to learn the procedures of how he is dealt with and how far into the gate he can get before being turned around; a person places a "smoke bomb" near the fence or throws it over the fence, just to learn how quickly police respond and what effect that has on front-gate operations, etc.
Acquiring supplies: Purchasing or stealing explosives, weapons, ammunition, detonators, timers, etc. Also includes acquiring military uniforms, decals, flight manuals, passes or badges (or the equipment to manufacture such items) or any other controlled items.
Suspicious persons out of place: People who don't seem to belong in the workplace, neighborhood, business establishment, or anywhere else. Includes suspicious border crossings and stowaways aboard ship or people jumping ship in port. This category is hard to define, but the point is that people know what looks right and what doesn't look right in their neighborhoods, office spaces, commutes, etc, and if a person just doesn't seem like he or she belongs, there's probably a reason for that.
Dry run: Putting people into position and moving them around according to their plan without actually committing the terrorist act. This is especially true when planning a kidnapping, but it can also pertain to bombings. An element of this activity could also include mapping out routes and determining the timing of traffic lights and flow. Take note of people moving around from place to place without any apparent purpose and doing it, perhaps, many times. The appropriate example here is the Sept. 11 hijackers, who are now known to have actually flown on those exact flights several times before Sept. 11. Their purpose was to practice getting their people into position, working out arrival times, parking, ticketing, going through security, boarding, etc. By taking note of everything around them, in one sense they were conducting surveillance and testing security, but they were also doing a dry run of the actual activity.
Deploying assets: People and supplies getting into position to commit the act. This is a person's last chance to alert authorities before the terrorist act occurs. Look for people loading up vehicles with weaponry/explosives, etc, and/or parking that vehicle somewhere, or people in military uniforms (who don't look right) approaching an installation or getting into a vehicle, or people who seem out of place standing by at a certain location as if waiting for something to happen. One fairly good example of this is the attack on the Khobar Towers in Saudi Arabia. When the explosives-laden truck pulled up to the fence line (which was the "deploying assets" step) and the driver jumped out and ran away, that was seen by a spotter on the roof of the dormitory, who recognized this as suspicious activity. He then sprinted down stairs and began pounding on doors, rousting people out of bed and getting them out of the building. Because of that, he saved many, many lives, and it's all because he recognized the "deploying assets" element.