TW202343250A - Cloud server and anomaly detection system and method for network surveillance - Google Patents

Abstract

A cloud server and anomaly detection system and method for network surveillance is provide therefore. The anomaly detection system comprises a local server, a cloud server and a surveillance camera. The local server provides a remote storage information. The surveillance camera connects to the local server and cloud server by Ethernet. The surveillance camera sends a streaming video to the cloud server according to the remote storage information. The cloud server transform the streaming video to a plurality of video file. The cloud server counts the number of the video files according to a recording option of the video file. When the number of the video files more than a first threshold, the cloud server outputs an alarm signal.

Description

Anomaly detection system, method and cloud server for network surveillance video

It relates to a network surveillance video recording system, method and server, and in particular to an anomaly detection system, method and cloud server for network surveillance video recording.

With the growth of network bandwidth and infrastructure, many security alarm systems have begun to convert to Ethernet transmission architecture. In particular, the combination of surveillance video equipment and cloud network servers further provides users with the ability to view real-time images captured by camera devices at any time.

The recording methods used in existing surveillance video alarm systems are mainly divided into two types: full-time recording and event recording. The full-time recording method is that the surveillance video equipment continuously records without interruption. Event recording starts recording when the monitoring equipment detects an abnormal event. Although full-time video recording can obtain complete image data, it is difficult to obtain the required materials from all the image data.

For full-time recording of abnormal events, users can receive relevant notifications through electronic devices. However, if an abnormality occurs in the surveillance video equipment, the back-end system or the user may not know whether there is any abnormality in the surveillance video equipment. The user cannot immediately detect that the abnormal state has occurred.

In view of this, in some embodiments, an anomaly detection system for network surveillance video is provided to cooperate with a cloud server. The anomaly detection system for network surveillance video includes a local server, surveillance video equipment, and an edge host. The local server provides remote storage path information; the surveillance video equipment includes a camera unit, a first communication unit and a first processor. The first processor is electrically connected to the camera unit and the first communication unit. The first processor is based on the camera unit. The image signal captured by the unit generates streaming image information. The first communication unit is connected to the local server and the cloud server through the network. The first processor drives the first communication unit to send the streaming image information according to the remote storage path information. to the cloud server. The cloud server records the streaming image information into multiple video files according to the file recording option; the edge host is connected to the local server and the cloud server. The edge host executes the anomaly detection program and counts the anomaly detection program. The number of video files in the cloud server's video files. When the number of video files is greater than the upper warning threshold, the anomaly detection program outputs a warning message, or when the number of video files is less than the lower warning threshold, the anomaly detection program outputs a warning message. In addition to being able to achieve full-time recording, the above-mentioned abnormality detection system for network surveillance video can also instantly determine whether an abnormality occurs in each network recording equipment, thereby prompting the cloud server or the user that an abnormal state has occurred.

In some embodiments, the anomaly detection method for network surveillance recording includes the following steps of connecting multiple surveillance recording devices to a local server; the surveillance recording device obtains remote storage path information from the local server, and the monitoring The recording equipment transmits streaming image information to the cloud server; the cloud server executes an abnormality detection program to detect whether the video files of the surveillance video equipment are abnormal; if any abnormality occurs in the video files of any surveillance video equipment, the cloud server Output warning signals.

In some embodiments, the cloud server includes a second communication unit, a storage unit and a second processor. The second communication unit receives the video file; the storage unit stores a plurality of video files and the abnormality detection program; the second processor is electrically connected to the second communication unit and the storage unit, and the second processing unit executes the abnormality detection program. The detection program counts the number of video files of each video recording option of each surveillance video device. When the number of video files is greater than the warning upper limit threshold, the anomaly detection program outputs a warning message.

In addition to providing uninterrupted full-time recording, the above-mentioned anomaly detection system and cloud server for network surveillance recording can also detect whether an abnormal event or disconnection occurs in each surveillance recording device. The cloud server The server sends the warning signal to the designated electronic device.

Please refer to FIG. 1A and FIG. 1B , which are respectively a schematic structural diagram and a schematic component block diagram of an anomaly detection system 100 for network surveillance video recording according to an embodiment. The anomaly detection system 100 for network surveillance recording includes a local server 110, a cloud server 120, at least one surveillance recording device 130 and an edge host 140. The local server 110 is connected to the cloud server 120 via Ethernet. The local server 110 may also be connected to the surveillance video recording device 130 through an Ethernet network, or may be connected to the surveillance video recording device 130 through other communication protocols. For example, it is a closed-circuit television system (Closed-Circuit Television, CCTV) and its transmission interface BNC connector (Bayonet Neill-Concelman).

The surveillance video recording device 130 can be connected to the local server 110 and the cloud server 120 through a cable network, or can be connected to the local server 110 and the cloud server 120 through a wireless network. The wireless network also includes the 4th generation of mobile phone mobile communication technology standards (4G network), the 5th generation of mobile phone mobile communication technology standards (4G network for short) and the 5th generation of mobile phone mobile communication technology standards (4G network for short). 5G network) or Communications Satellite, etc.

The local server 110 and the surveillance video device 130 may belong to the same local area network or the same actual field. The local server 110 may be, but is not limited to, a Network Video Recorder (NVR). The local server 110 may also be a personal computer or an embedded system (embedded system).

The local server 110 provides remote storage path information 111 to each surveillance video device 130 . The local server 110 can assign corresponding remote storage path information 111 according to the surveillance video equipment 130 in different areas. The local server 110 can also store the streaming image information 134 of each surveillance video device 130 as a video file 124. The remote storage path information 111 records information such as relevant path information (Uniform Resource Locator, URL), connection port number (port number) or login information (login) of the cloud server 120 .

The surveillance video equipment 130 includes a camera unit 131, a first communication unit 132 and a first processor 133. The first processor 133 is electrically connected to the camera unit 131 and the first communication unit 132 . The camera unit 131 converts optical image signals into digital image data. The type of the camera unit 131 is either a charge-coupled device (CCD) or a complementary metal oxide semiconductor active pixel sensor (CMOS Active pixel sensor). The first communication unit 132 supports the Ethernet communication protocol.

The surveillance video equipment 130 can be connected to the cloud server 120 through the Internet, and connected to the local server 110 through a local area network. The first processor 133 performs image encoding on the image signal captured by the camera unit 131 to generate streaming image information 134, and drives the first communication unit 132 to transmit the streaming image information 134. The first communication unit 132 also receives remote storage path information 111 from the local server 110 . The first processor 133 transmits the streaming image information 134 to the cloud server 120 according to the remote storage path information 111 .

The cloud server 120 includes a second communication unit 121, a storage unit 122 and a second processor 123. The second processor 123 is electrically connected to the second communication unit 121 and the storage unit 122 . The storage unit 122 stores video files 124 and image encoding programs 125 . The second processor 123 executes the image encoding program 125 to convert the streaming image information 134 into a video file 124 . Depending on the operating system and the adopted file structure, the cloud server 120 may store the video files 124 in file form, or may mount each video file 124 as a single node.

The cloud server 120 may be, but is not limited to, a server of the same network provider, or may be a cluster server built between multiple different network providers. For example, the surveillance video equipment 130 can transmit the streaming image information 134 to the cloud server 120 of Chunghwa Telecom. Alternatively, the surveillance video equipment 130 can transmit the streaming image information 134 to the cloud server 120 of the e-commerce company Amazon. Amazon's cloud server 120 then assembles the specified video file 124 and forwards the video file 124 to Chunghwa Telecom's cloud server 120.

The image encoding program 125 determines how to transfer the streaming image information 134 to the video file 124 according to the file recording option. File recording options include recording time options or recording capacity options. The image encoding program 125 stores corresponding multiple video files 124 according to different surveillance video devices 130 . The recording time option can be any one of minutes, hours, days, weeks, months, quarters or years as the recording length.

The recording capacity option depends on the image encoding bit rate (bit rate) or file format (file format) file limit. Taking the constant bitrate as an example, the cloud server 120 can set the same data flow rate for each frame of the streaming image information 134 . The cloud server 120 calculates the data amount of each frame based on the data flow and frame per second (FPS), and then generates a video file 124 with a fixed amount of data. Alternatively, the cloud server 120 will create a new video file 124 every time a preset time (or preset capacity) passes. Take the 32-bit File Allocation Table (FAT32) as an example. The upper limit of the file capacity of FAT32 is 4 Gigabyte. It is assumed that the cloud server 120 uses FAT32 as the storage format of the video file 124 . If the current video file 124 reaches 4 Gigabyte, the cloud server 120 will create another video file 124 to store the subsequent streaming image information 134 .

The edge host 140 is connected to the cloud server 120 through the network. The edge host 140 executes the anomaly detection program 141. The anomaly detection program 141 counts to the cloud server 120 whether an abnormality occurs in the video file 124 . If the anomaly detection program 141 confirms that an abnormality occurs in the video file 124, the anomaly detection program 141 outputs a warning message 142. In addition to executing the anomaly detection program 141 according to an external requirement, the edge host 140 can also execute the anomaly detection program 141 regularly. The anomaly detection program 141 can target the video files 124 of all surveillance video equipment 130 , or can select the video files 124 of a specific surveillance video equipment 130 . Please refer to FIG. 2 , which is a schematic flow chart of abnormality detection in network surveillance video recording according to an embodiment. Step S210: Connect the surveillance video equipment 130 to the local server 110; Step S220: The surveillance and video recording device 130 obtains the remote storage path information from the local server 110, and the surveillance and recording device 130 transmits the streaming image information 134 to the cloud server 120; Step S230: The cloud server 120 stores the streaming image information 134 as multiple video files 124; Step S240: The edge host 140 executes the anomaly detection program 141 on the cloud server 120 to detect whether the number of video files 124 is abnormal; Step S250: If the number of video files 124 is greater than the warning upper limit threshold, the anomaly detection program 141 outputs a warning message 142; Step S260: If the number of video files 124 is less than the lower warning threshold, the anomaly detection program 141 outputs a warning message 142; and Step S270: If the video file 124 of the surveillance video equipment 130 is normal, the cloud server 120 executes step S240.

First, the installed surveillance video equipment 130 is enabled and connected to the local server 110 through the aforementioned communication protocol. After the surveillance video recording device 130 obtains the remote storage path information 111 from the local server 110, the surveillance video recording device 130 performs image recording and encoding recording of the photographed range. The surveillance video equipment 130 transmits the captured image signals to the cloud server 120 in a streaming manner according to the remote storage path information 111 .

As mentioned above, the cloud server 120 can store the video file 124 according to the file recording option. The cloud server 120 can also control the number of video files 124 by adjusting the recording capacity option and the image encoding bit rate. If an abnormality occurs in the surveillance video equipment 130, the cloud server 120 may not be able to continue receiving the streaming image information 134. Therefore, the cloud server 120 becomes unable to receive the streaming image information 134 regularly, and the cloud server 120 will create video files 124 irregularly. Or, an abnormality occurs in the network of the local server 110, causing the externally transmitted network packets to be repeatedly transmitted or lost, causing the cloud server 120 to create duplicate video files 124 at the same time. Or any surveillance video device 130 continuously detects events, so a large number of video files 124 are generated at the same time.

The edge host 140 may be an independent host, or may be executed by the local server 110 . In addition to counting the number of video files of a single surveillance video device 130 , the anomaly detection program 141 can also count the total number of video files 124 of all surveillance video devices 130 . The anomaly detection program 141 determines whether the total amount of video files 124 is greater than the upper alert threshold, or whether the total amount of video files 124 is less than the lower alert threshold.

If the number of video files 124 is greater than the warning upper limit threshold, the anomaly detection program 141 outputs a warning message 142 . When the number of video files 124 is too large, it means that the surveillance video equipment 130 may have a network abnormality, a software error, or hardware damage of the surveillance video equipment 130 . In addition to the warning upper limit threshold being defined by the manufacturer, the anomaly detection program 141 can also obtain the number of video files 124 from at least a specific unit time and calculate the average. The anomaly detection program 141 uses the average value of the acquired video files 124 as the warning upper limit threshold.

Furthermore, the anomaly detection program 141 uses the number of video files 124 of multiple surveillance video devices 130 as the upper limit alert threshold. For example, the anomaly detection program 141 can select any number of surveillance video devices 130 from the same local network. The anomaly detection program 141 performs averaging processing on the selected surveillance video equipment 130 and video files 124 . The anomaly detection program 141 adds up the video files 124 in the unit time and divides it by the number of the selected surveillance video equipment 130 to obtain the average calculation result of the number of video files 124 that each surveillance video equipment 130 can produce in the unit time. . The anomaly detection program 141 uses the calculation result as the warning upper limit threshold. In the same way, the anomaly detection program 141 can also generate the warning lower limit threshold according to the aforementioned method.

In some embodiments, the anomaly detection program 141 may adjust the upper alert threshold or the lower alert threshold according to the error quantity value. Please refer to FIG. 3A and FIG. 3B , which are schematic diagrams of the upper warning limit threshold and the lower warning limit threshold, and the error quantity value, the upper warning limit threshold or the lower warning limit threshold respectively, according to an embodiment. For the convenience of illustration, the upper warning threshold value is defined as T _up , the lower warning threshold value is defined as T _low , the number of video files 124 is F, and the error quantity value is Δ. In Figure 3A, the straight arrow represents the number of files, the thick black horizontal lines represent the upper warning threshold value T _up and the lower warning threshold value T _low respectively, the gray horizontal line represents the number of detected video files, and the gray area represents the error Quantity value Δ.

In FIG. 3A , the number F of the video files 124 falls between the upper warning threshold T _up and the lower warning threshold T _low . The anomaly detection program 141 considers the video files of the surveillance video equipment 130 to be normal. If the number F of video files 124 is greater than the upper alert threshold T _up or the number F of video files 124 is less than the lower alert threshold T _low , the anomaly detection program 141 will output a warning message 142 to alert the edge host 140 and its users.

In FIG. 3B , an error quantity value Δ is added to the upper warning threshold T _up and the lower warning threshold T _low respectively. When the number F of video files 124 is greater than the warning upper limit threshold T _up and is within the error quantity value Δ, the anomaly detection program 141 determines that the video files 124 are still normal. If the number F of the video files 124 is greater than the warning upper limit threshold T _up and is outside the error quantity value Δ, the anomaly detection program 141 will output a warning message 142 .

For example, there are 10 surveillance video devices 130 in the field. The cloud server 120 sets for each surveillance video device 130 that "4000" video files 124 need to be recorded in a day (i.e. 24 hours), and also sets ±5% as the upper limit (lower limit) of the warning threshold, and the error quantity value Δ is 5%. . In other words, the warning upper limit threshold T _up is "4200*10=42000" video files 124, and the warning lower limit threshold T _low is "3800*10=38000" video files 124.

Under normal circumstances, the cloud server 120 can store "40,000" video files 124 every day. If the cloud server 120 only stores "39700" video files 124 on a certain day. Since the "39700" video file 124 is between the upper warning threshold value T _up and the lower warning threshold value T _low , the anomaly detection program 141 determines it as a normal situation. If the cloud server 120 only stores "37000" video files 124 on a certain day. Because the cloud server 120 is missing "3000" video files 124, and the missing video files 124 have exceeded the error quantity value Δ of 5%. The anomaly detection program 141 outputs a warning message 142. In addition to setting the aforementioned upper warning threshold T _up , lower warning threshold T _low and error quantity value Δ for all surveillance video equipment 130 , the anomaly detection program 141 can also set the upper warning threshold T for the designated surveillance video equipment 130 _up , warning lower limit threshold value T _low and error quantity value Δ.

In some embodiments, the electronic device 340 sends a calling request 411 to the cloud server 120, as shown in FIG. 4 . The calling request 411 includes the recording process of the selected surveillance video device 130 and the selected video file 124 . The electronic device 340 may be, but is not limited to, a mobile phone, a tablet computer, a notebook computer, a personal computer, etc. After the cloud server 120 receives the calling request 411, the cloud server 120 searches for the recording process of the corresponding surveillance video device 130 and the video file 124 according to the calling request 411. The cloud server 120 packages the selected video file 124 into a review image file 422. The cloud server 120 can copy (clone) the review image file 422 to a network folder 421 (bucket). The cloud server 120 opens the network folder 421 for the electronic device 340 to query or download and review the image file 422 or the image index information (unlabeled) of the selected video file 124 . The image index information is the file number of the video file 124. The image index information can be recorded as the file number based on timestamp, video format or serial number.

In some embodiments, the cloud server 120 creates an expired tag for each video file 124 based on the recording time. The expiration tag records the expiration time of the video file 124 . The cloud server 120 checks whether the expired tag matches the current time after each preset time period. For example, the cloud server 120 can check overdue tags at midnight every day. If the expired tag is later than the current time, the cloud server 120 deletes the corresponding video file 124. Because the cloud server 120 performs file reading and writing access processing on the video files 124 stored by itself. Therefore, the local server 110 or the edge host 140 does not need to send operation requests to the cloud server 120, thereby reducing network access and traffic to the cloud server 120. In other words, the local server 110 does not need to continuously poll the cloud server 120 for file deletion requests.

In some embodiments, the cloud server 120 includes a second communication unit 121, a storage unit 122, and a second processor 123, as shown in FIG. 5 . The second communication unit 121 is connected to the surveillance video equipment 130 via a network, and is used to transmit the streaming image information 134 of the surveillance video equipment 130 . The second processor 123 is electrically connected to the second communication unit 121 and the storage unit 122 . The storage unit 122 stores video files 124, image encoding programs 125 and anomaly detection programs 141. The second processor 123 executes the image encoding program 125 to convert the streaming image information 134 into a video file 124 . In addition, the second processor 123 can regularly execute the anomaly detection program 141 for counting the number of video files 124 . If the number of video files 124 is greater than the upper warning threshold or less than the lower warning threshold, the anomaly detection program 141 will output a warning message 142 .

In addition to providing uninterrupted full-time recording, the above-mentioned abnormality detection system 100 for network surveillance video recording can also detect whether an event abnormality or disconnection abnormality occurs in each surveillance video recording device 130. The cloud server 120 The device 120 transmits the warning signal 142 to the designated electronic device 340. In addition, the anomaly detection system 100 of the network surveillance video can immediately troubleshoot based on the abnormal warning message 142, and can also reduce the manpower burden of dispatch.

100: Anomaly detection system 110: Local server 111: Remote storage path information 120: Cloud server 121: Second communication unit 122: Storage unit 123: Second processor 124: Video file 125: Image encoding program 130 : Surveillance video equipment 131: Camera unit 132: First communication unit 133: First processor 134: Streaming image information 140: Edge host 141: Abnormality detection program 142: Warning message 340: Electronic device 411: Call request 421: Network folder 422: Review image files Δ: error quantity value T _up : warning upper limit threshold value T _low : warning lower limit threshold value F: quantity S210~S250: steps

[Fig. 1A] is a schematic structural diagram of an anomaly detection system for network surveillance video recording according to an embodiment. [Fig. 1B] is a component block diagram of network surveillance video recording according to an embodiment. [Figure 2] is a schematic flow chart of abnormality detection in network surveillance video recording according to an embodiment. [Fig. 3A] is a schematic diagram of the upper warning threshold and the lower warning threshold according to an embodiment. [Fig. 3B] is a schematic diagram of the error quantity value, the upper warning limit threshold value or the lower warning limit threshold value according to an embodiment. [Fig. 4] is a schematic diagram of an electronic device sending a calling request to a cloud server according to an embodiment. [Fig. 5] is a component block diagram of network surveillance video recording according to an embodiment.

100: Anomaly detection system

110:Local server

111:Remote storage path information

120:Cloud server

121: Second communication unit

122:Storage unit

123: Second processor

124:Video files

125: Anomaly detection program

130: Surveillance video equipment

131:Camera unit

132: First communication unit

133:First processor

134:Streaming video information

140: Edge host

141: Anomaly detection program

142: Warning message

Claims (10)

An anomaly detection system for network surveillance video that cooperates with a cloud server. The anomaly detection system for network surveillance video includes: A local server that provides remote storage path information; A surveillance video equipment includes a camera unit, a first communication unit and a first processor. The first processor is electrically connected to the camera unit and the first communication unit. The first processor is based on the camera unit. A captured image signal generates a stream of image information. The first communication unit is network-connected to the local server and the cloud server. The first processor drives the first communication based on the remote storage path information. The unit sends the streaming image information to the cloud server, and the cloud server records the streaming image information into multiple video files according to a file recording option; and An edge host is connected to the local server and the cloud server. The edge host executes an anomaly detection program. The anomaly detection program counts the number of video files of the video files of the cloud server. When the When the number of video files is greater than an upper warning threshold, the anomaly detection program outputs a warning message, or when the number of video files is less than a lower warning threshold, the anomaly detection program outputs the warning message. The anomaly detection system for network surveillance video as described in claim 1, further comprising an electronic device connected to the cloud server through the network, and the electronic device receives the warning message output by the anomaly detection program. . The anomaly detection system for network surveillance video as described in request 2, wherein the electronic device downloads the video files corresponding to the file recording options or the selected videos from the cloud server based on the warning message. An image index information for the file. The anomaly detection system for network surveillance video as described in claim 1, wherein the anomaly detection program increases or decreases the upper alert threshold and the lower alert threshold based on an error quantity value. The anomaly detection system for network surveillance video as described in claim 1, wherein the file recording option is a recording time option or a recording capacity option. An anomaly detection method for network surveillance video, which includes: Connect multiple surveillance video devices to a local server; The surveillance video equipment obtains a remote storage path information from the local server, and the surveillance video equipment transmits a stream of image information to a cloud server; The cloud server stores the streaming image information as multiple video files; An edge host executes an anomaly detection program on the cloud server to detect whether the number of video files is abnormal; If the number of video files is greater than an upper warning threshold, the anomaly detection program outputs a warning message; and If the number of video files is less than a warning lower limit threshold, the anomaly detection program outputs the warning message. A cloud server receives a stream of image information from at least one surveillance video device. The cloud server includes: a second communication unit to receive the streaming image information; a storage unit that stores multiple video files and an anomaly detection program; and A second processor, the second processor is electrically connected to the second communication unit and the storage unit, the second processor records the streaming image information into the video files, and the second processor executes the An anomaly detection program counts the number of video files of the video files in the cloud server. When the number of video files exceeds a warning upper limit threshold, the anomaly detection program outputs a warning message, or when The number of video files is less than a warning lower limit threshold, and the anomaly detection program outputs the warning message. The cloud server of claim 7, wherein the second processor generates image index information based on the video files. The cloud server as described in claim 7, wherein when the number of video files is less than a warning lower limit threshold, the anomaly detection program outputs the warning message. The cloud server as described in claim 9, wherein the anomaly detection program increases or decreases the upper alert threshold and the lower alert threshold based on an error quantity value.

Images