WO2018032270A1

WO2018032270A1 - Low complexity tamper detection in video analytics

Info

Publication number: WO2018032270A1
Application number: PCT/CN2016/095354
Authority: WO
Inventors: Ying Chen; Xuan ZOU; Lei Wang; Jian Wei; Ning Bi
Original assignee: Qualcomm Incorporated
Priority date: 2016-08-15
Filing date: 2016-08-15
Publication date: 2018-02-22

Abstract

Provided are methods, apparatuses, and computer-readable medium for automatic tamper detection that are both robust and low in complexity. The described methods can detect many different tamper types while also reducing false positives. In various implementations, the described methods include comparing an input frame against a background picture, using tiles of pixels taken from both the input frame and the background picture. When enough differences are detected between the tiles of pixels from the input frame and the tiles of pixels from the background picture, tamper is suspected. When tamper is suspected, further checking of the frame may be enabled, including checking for blur and/or checking a downsampled version of the whole frame. The additional checks can confirm that an actual tamper of the camera has occurred.

Description

LOW COMPLEXITY TAMPER DETECTION IN VIDEO ANALYTICS

FIELD

The present disclosure generally relates to video analytics, and more specifically to techniques and systems for automatically detecting whether a surveillance camera has been tampered with.

BACKGROUND

Many devices and systems allow a scene to be captured by generating video data of the scene. For example, an Internet protocol camera (IP camera) is a type of digital video camera that can be employed for surveillance or other applications. Unlike analog closed circuit television (CCTV) cameras, an IP camera can send and receive data via a computer network and the Internet. The video data from these devices and systems can be captured and output for processing and/or consumption.

Video analytics, also referred to as Video Content Analysis (VCA) , is a generic term used to describe computerized processing and analysis of a video sequence acquired by a camera. Video analytics provides a variety of tasks, including immediate detection of events of interest, analysis of pre-recorded video for the purpose of extracting events in a long period of time, and many other tasks. For instance, using video analytics, a system can automatically analyze the video sequences from one or more cameras to detect one or more events. In some cases, video analytics can send alerts or alarms for certain events of interest. More advanced video analytics is needed to provide efficient and robust video sequence processing.

BRIEF SUMMARY

In various implementations, techniques and systems are described for automatic detection of tampering of a camera. In various examples, video analytics can be performed on a video stream being captured by a stationary camera. Video analytics can include detecting blobs (e.g., moving objects) in the scene being captured by the camera, and tracking the blobs. A blob represents at least a portion of one or more objects in a video frame (also referred to as a “picture” ) .

Blob detection and tracking, however, can be thwarted if the camera is tampered with. A camera can be tampered with by, for example, redirecting the camera, covering up the camera, defocusing the camera, or interfering with the camera in some other way, including shaking the camera, creating excessive brightness in front of the camera, or creating excessive darkness. Ideally, when camera has been tampered with, the camera automatically detects the tampering and informs a system administrator. Automated tamper detection methods, however, tend to be computationally complex, requiring either a large amount of processing power or a long time to determine whether tampering has occurred. Less computationally complex methods, on the other hand, may produce too many false positives.

The techniques and systems described herein reduce the computational complexity of tamper detection and also reduce the rate of tamper being incorrectly detected. For example, suspected incidents of tamper can first be detected by comparing an input frame against a background picture. The background picture is assumed to be a stable representation of the background in the scene being viewed by the camera. Computational complexity can be reduced by dividing both the input frame and the background picture into a same grid of tiles, then selecting a group of tiles to compare. When the pixels in a tile from the input frame are dissimilar to the pixels in a tile from the background picture, tampering may be suspected.

Tampering can be confirmed in various ways. For example, when tampering is suspected, the tiles selected for similarity comparison can be tested for blurring. When the pixels from the input frame show blurring, then tampering may be confirmed. When the pixels from the input frame do not show blurring, then a downsampled version of the entire input frame can be compared against a downsampled version of the entire background picture. Downsampling the input frame and the background picture reduces the computational complexity required to compare a whole frame. When the downsampled versions of the input frame and the background picture are dissimilar, tampering is confirmed. To reduce the computational complexity that may be needed for blur detection and frame-level tampering, the blur detection and frame-level tampering may be activated after a sequential number of input frames show suspected tampering based on testing the similarity of tiles.

As another example, when tampering is suspected, the tamper detection system may maintain a counter. When a sequence of input frames each show suspected tampering, based on tile similarity testing, tampering may be confirmed.

According to at least one example, a method of automated tamper detection is provided that includes obtaining an input frame and a background picture. The background picture may be based at least in part on the input frame. The method further includes selecting a first tile of pixels from the input frame. The first tile of pixels may be selected by subdividing the frame into a grid of tiles. The first tile can have a first location within the input frame. The method further includes selecting a second tile of pixels from the background picture. The second tile can have a second location within the background picture. The second location in the background picture can correspond to the first location in the input frame. The method further includes comparing the first tile of pixels to the second tile of pixels. The method further includes determining a suspect incident of tampering using a result of the comparison. The result may indicate that the first tile of pixels includes pixel values that are not included in the second tile of pixels.

In another example, an apparatus is provided that includes a memory configured to store video data and a processor. The processor is configured to and can obtain an input frame and a background picture. The background picture may be based at least in part on the input frame. The processor is configured to and can select a first tile of pixels from the input frame. The first tile of pixels may be selected by subdividing the frame into a grid of tiles. The first tile can have a first location within the input frame. The processor is configured to and can select a second tile of pixels from the background picture. The second tile can have a second location within the background picture. The second location in the background picture can correspond to the first location in the input frame. The processor is configured to and can compare the first tile of pixels to the second tile of pixels. The process is configured to and can determine a suspect incident of tampering using a result of the comparison. The result may indicate that the fist tile of pixels includes pixel values that are not included in the second tile of pixels.

In another example, a computer-readable medium is provided having stored thereon instructions that when executed by a processor perform a method that includes: obtaining an input frame and a background picture. The background picture may be based at least in part on the input frame. The method further includes selecting a first tile of pixels from the input frame. The first tile of pixels may be selected by subdividing the frame into a grid of tiles. The first tile can have a first location within the input frame. The method further includes selecting a second tile of pixels from the background picture. The second tile can have a second location within the background picture. The second location in the background picture can correspond to the first location in the input frame. The method further includes comparing the first tile of pixels to the second tile of pixels. The method further includes determining a suspect incident of tampering using a result of the comparison. The result may indicate that the first tile of pixels includes pixel values that are not included in the second tile of pixels.

In another example, an apparatus is provided that includes means for obtaining an input frame and a backroad picture. The background picture may be based at least in part on the input frame. The apparatus further comprises means for selecting a first tile of pixels form the input frame. the first tile of pixels may be selected by subdividing the frame in to a grid of tiles The first tile can have a first location within the input frame. The apparatus further comprises means for selecting a second tile of pixels from the background picture. The second tile can have a second location within the background picture The second location can correspond to the first location in the input frame. . The apparatus further comprises means for comparing the first tile of pixels to the second tile of pixels. The apparatus further comprises means for determining a suspect incident of tampering using a result of the comparison. The result may indicate that the first tile of pixels includes pixel values that are not included in the second tile of pixels.

In some aspects, the methods, apparatuses, and computer-readable medium described above further comprise selecting the first tile by grouping the plurality of tiles into a top-left quadrant, a top-right quadrant, a bottom-left quadrant, and a bottom-right quadrant, and selecting the first tile of pixels from the input frame from the top-left quadrant.

In some aspects, the methods, apparatuses, and computer-readable medium described above further comprise selecting a second input tile of pixels from the bottom-right quadrant. A location of the second input tile within the bottom-right quadrant can be based on a location of the first tile within the top-left quadrant. The second input tile can is selected from the input frame. The methods, apparatuses, and computer-readable medium described above further comprise selecting a third input tile of pixels from the top-right quadrant. A location of the third input tile within the top-right quadrant can be based on the location of the first tile within the top-left quadrant. The third input tile is selected from the input frame. The methods, apparatuses, and computer-readable medium described above further comprise selecting a fourth input tile of pixels from the bottom-left quadrant. A location of the fourth tile within the bottom-left quadrant can be based on the location of the first tile within the top-left quadrant. The fourth input tile of pixels is selected from the input frame.

In some aspects, the methods, apparatuses, and computer-readable medium described above further comprise selecting four additional tiles of pixels from the input frame.

In some aspects, the methods, apparatuses, and computer-readable medium described above further comprise comparing the first tile of pixels to the second tile of pixels by identifying edge pixels in the first tile of pixels, identifying edge pixels in the second tile of pixels, and determining that the first tile of pixels includes edges pixels that are different from the edge pixels identified in the second tile of pixels.

In some aspects, the methods, apparatuses, and computer-readable medium described above further comprise confirming the suspect incident of tampering as an actual incident of tampering. Confirming can include examining an additional sequence of input frames and a corresponding sequence of background pictures.

In some aspects, the methods, apparatuses, and computer-readable medium described above further comprise confirming the suspect incident of tampering by selecting a test tile of pixels from each of the sequence of input frames. Each test tile can be in a different location in each successive frame from the sequence of input frames. The methods, apparatuses, and computer-readable medium described above can further comprise comparing each test tile of pixels to a corresponding tile of pixels from a corresponding background picture from the sequence of background pictures.

In some aspects, a test tile in a current frame from the sequence of input frames is in a location neighboring the location of a test tile in a previous frame from the sequence of input frames. In some aspects, a test tile in a current frame from the sequence of input frames is selected based on a location of a test tile in a previous frame from the sequence of input frames.

In some aspects, the methods, apparatuses, and computer-readable medium described above further comprise, upon determining a suspect incident of tampering, incrementing a duration count. When the duration count is equal to or greater than a duration limit, the suspect incident of tampering can be confirmed as an actual incident of tampering.

In some aspects, the methods, apparatuses, and computer-readable medium described above further comprise, upon determining a suspect incident of tampering, incrementing a duration count, determining that the duration count is equal to or greater than a portion of a duration limit, testing the first tile of pixels for blur, and confirming the suspect incident of tampering as an actual incident of tampering using a result of the testing, wherein the result of the testing indicates the presence of blur in the first tile of pixels.

In some aspects, the methods, apparatuses, and computer-readable medium described above further comprise, upon determining a suspect incident of tampering, incrementing a duration count, determining that the duration count is equal to or greater than a portion of a duration limit, testing the first tile of pixels for blur, wherein the testing includes determining a lack of blur in the first tile of pixels, downsampling the input frame, downsampling the background picture, comparing the downsampled input frame to the downsampled background picture, and confirming the suspect incident of tampering as an actual incident of tampering using a result of comparing the downsampled input frame to the downsampled background picture. The result may indicate that the downsampled input frame is dissimilar to the downsampled background picture.

This summary is not intended to identify key or essential features of the claimed subject matter, nor is it intended to be used in isolation to determine the scope of the claimed subject matter. The subject matter should be understood by reference to appropriate portions of the entire specification of this patent, any or all drawings, and each claim.

The foregoing, together with other features and embodiments, will become more apparent upon referring to the following specification, claims, and accompanying drawings.

BRIEF DESCRIPTION OF THE DRAWINGS

Illustrative embodiments of the present invention are described in detail below with reference to the following drawing figures:

FIG. 1 is a block diagram illustrating an example of a system including a video source and a video analytics system, in accordance with some embodiments；

FIG. 2 is an example of a video analytics system processing video frames, in accordance with some embodiments；

FIG. 3 is a block diagram illustrating an example of a blob detection engine, in accordance with some embodiments；

FIG. 4 is a block diagram illustrating an example of an object tracking engine, in accordance with some embodiments；

FIGS. 5A-5B illustrate an example of a camera that has been redirected；

FIGS. 6A-6B illustrate an example of a camera that has suffered occlusion；

FIGS. 7A-7B illustrates an example of a camera that has been defocused；

FIG. 8 illustrates an example of a system for automatic camera tamper detection that may not require a high degree of computational complexity；

FIG. 9 illustrates an example of a frame that has been divided into a grid of tiles；

FIG. 10A illustrates an example of a background picture that may be input into an automated tamper detection system；

FIG. 10B illustrates an example of an input frame that includes the same scene illustrated in FIG. 10A, but with an object blocking approximately half of the camera’s view；

FIG. 11 illustrates an example of selecting tiles once tampering is suspected；

FIG. 12 illustrates an example of a process that may be implemented by a tamper detection system to confirm that a tamper event has occurred； and

FIG. 13 illustrates an example of a process 1300 for automatic tamper detection.

DETAILED DESCRIPTION

Certain aspects and embodiments of this disclosure are provided below. Some of these aspects and embodiments may be applied independently and some of them may be applied in combination as would be apparent to those of skill in the art. In the following description, for the purposes of explanation, specific details are set forth in order to provide a thorough understanding of embodiments of the invention. However, it will be apparent that various embodiments may be practiced without these specific details. The figures and description are not intended to be restrictive.

The ensuing description provides exemplary embodiments only, and is not intended to limit the scope, applicability, or configuration of the disclosure. Rather, the ensuing description of the exemplary embodiments will provide those skilled in the art with an enabling description for implementing an exemplary embodiment. It should be understood that various changes may be made in the function and arrangement of elements without departing from the spirit and scope of the invention as set forth in the appended claims.

Specific details are given in the following description to provide a thorough understanding of the embodiments. However, it will be understood by one of ordinary skill in the art that the embodiments may be practiced without these specific details. For example, circuits, systems, networks, processes, and other components may be shown as components in block diagram form in order not to obscure the embodiments in unnecessary detail. In other instances, well-known circuits, processes, algorithms, structures, and techniques may be shown without unnecessary detail in order to avoid obscuring the embodiments.

Also, it is noted that individual embodiments may be described as a process which is depicted as a flowchart, a flow diagram, a data flow diagram, a structure diagram, or a block diagram. Although a flowchart may describe the operations as a sequential process, many of the operations can be performed in parallel or concurrently. In addition, the order of the operations may be re-arranged. A process is terminated when its operations are completed, but could have additional steps not included in a figure. A process may correspond to a method, a function, a procedure, a subroutine, a subprogram, etc. When a process corresponds to a function, its termination can correspond to a return of the function to the calling function or the main function.

The term “computer-readable medium” includes, but is not limited to, portable or non-portable storage devices, optical storage devices, and various other mediums capable of storing, containing, or carrying instruction (s) and/or data. A computer-readable medium may include a non-transitory medium in which data can be stored and that does not include carrier waves and/or transitory electronic signals propagating wirelessly or over wired connections. Examples of a non-transitory medium may include, but are not limited to, a magnetic disk or tape, optical storage media such as compact disk (CD) or digital versatile disk (DVD) , flash memory, memory or memory devices. A computer-readable medium may have stored thereon code and/or machine-executable instructions that may represent a procedure, a function, a subprogram, a program, a routine, a subroutine, a module, a software package, a class, or any combination of instructions, data structures, or program statements. A code segment may be coupled to another code segment or a hardware circuit by passing and/or receiving information, data, arguments, parameters, or memory contents. Information, arguments, parameters, data, etc. may be passed, forwarded, or transmitted via any suitable means including memory sharing, message passing, token passing, network transmission, or the like.

Furthermore, embodiments may be implemented by hardware, software, firmware, middleware, microcode, hardware description languages, or any combination thereof. When implemented in software, firmware, middleware or microcode, the program code or code segments to perform the necessary tasks (e.g., a computer-program product) may be stored in a computer-readable or machine-readable medium. A processor (s) may perform the necessary tasks.

A video analytics system can obtain a video sequence from a video source and can process the video sequence to provide a variety of tasks. One example of a video source can include an Internet protocol camera (IP camera) , or other video capture device. An IP camera is a type of digital video camera that can be used for surveillance, home security, or other suitable application. Unlike analog closed circuit television (CCTV) cameras, an IP camera can send and receive data via a computer network and the Internet. In some instances, one or more IP cameras can be located in a scene or an environment, and can remain static while capturing video sequences of the scene or environment.

An IP camera can be used to send and receive data via a computer network and the Internet. In some cases, IP camera systems can be used for two-way communications. For example, data (e.g., audio, video, metadata, or the like) can be transmitted by an IP camera using one or more network cables or using a wireless network, allowing users to communicate with what they are seeing. In one illustrative example, a gas station clerk can assist a customer with how to use a pay pump using video data provided from an IP camera (e.g., by viewing the customer’s actions at the pay pump) . Commands can also be transmitted for pan, tilt, zoom (PTZ) cameras via a single network or multiple networks. Furthermore, IP camera systems provide flexibility and wireless capabilities. For example, IP cameras provide for easy connection to a network, adjustable camera location, and remote accessibility to the service over Internet. IP camera systems also provide for distributed intelligence. For example, with IP cameras, video analytics can be placed in the camera itself. Encryption and authentication is also easily provided with IP cameras. For instance, IP cameras offer secure data transmission through already defined encryption and authentication methods for IP based applications. Even further, labor cost efficiency is increased with IP cameras. For example, video analytics can produce alarms for certain events, which reduces the labor cost in monitoring all cameras (based on the alarms) in a system.

Video analytics provides a variety of tasks ranging from immediate detection of events of interest, to analysis of pre-recorded video for the purpose of extracting events in a long period of time, as well as many other tasks. Various research studies and real-life experiences indicate that in a surveillance system, for example, a human operator typically cannot remain alert and attentive for more than 20 minutes, even when monitoring the pictures from one camera. When there are two or more cameras to monitor or as time goes beyond a certain period of time (e.g., 20 minutes) , the operator’s ability to monitor the video and effectively respond to events is significantly compromised. Video analytics can automatically analyze the video sequences from the cameras and send alarms for events of interest. This way, the human operator can monitor one or more scenes in a passive mode. Furthermore, video analytics can analyze a huge volume of recorded video and can extract specific video segments containing an event of interest.

Video analytics also provides various other features. For example, video analytics can operate as an Intelligent Video Motion Detector by detecting moving objects and by tracking moving objects. In some cases, the video analytics can generate and display a bounding box around a valid object. Video analytics can also act as an intrusion detector, a video counter (e.g., by counting people, objects, vehicles, or the like) , a camera tamper detector, an object left detector, an object/asset removal detector, an asset protector, a loitering detector, and/or as a slip and fall detector. Video analytics can further be used to perform various types of recognition functions, such as face detection and recognition, license plate recognition, object recognition (e.g., bags, logos, body marks, or the like) , or other recognition functions. In some cases, video analytics can be trained to recognize certain objects. Another function that can be performed by video analytics includes providing demographics for customer metrics (e.g., customer counts, gender, age, amount of time spent, and other suitable metrics) . Video analytics can also perform video search (e.g., extracting basic activity for a given region) and video summary (e.g., extraction of the key movements) . In some instances, event detection can be performed by video analytics, including detection of fire, smoke, fighting, crowd formation, or any other suitable even the video analytics is programmed to or learns to detect. A detector can trigger the detection of event of interest and sends an alert or alarm to a central control room to alert a user of the event of interest.

An IP camera that is used for video analytics can, however, be tampered with. For example, the camera can be moved, covered up, and/or defocused. Ideally, a surveillance camera is able to automatically detect that the camera has been tampered with, so that a system administrator can be informed and proper action can be taken. Generally, the different ways in which a camera can be tampered with may require different tamper detection methods, with each tamper type typically requiring examining the video data at the pixel level. Pixel-level detection methods may further be computationally complex.

In various implementations, provided are methods for automatic tamper detection that are both robust and low in complexity. The described methods can detect many different tamper types while also reducing false positives (that is, flagging a tamper event when no tampering has actually occurred) . In various implementations, the described methods include comparing an input frame against a background picture, using tiles of pixels taken from both the input frame and the background picture. When enough differences are detected between the tiles of pixels from the input frame and the tiles of pixels from the background picture, tamper is suspected. When tamper is suspected, further checking of the frame may be enabled, including checking for blur and/or checking a downsampled version of the whole frame. The additional checks can confirm that an actual tamper of the camera has occurred.

FIG. 1 is a block diagram illustrating an example of a video analytics system 100. The video analytics system 100 receives video frames 102 from a video source 130. The video frames 102 can also be referred to herein as a video picture or a picture. The video frames 102 can be part of one or more video sequences. The video source 130 can include a video capture device (e.g., a video camera, a camera phone, a video phone, or other suitable capture device) , a video storage device, a video archive containing stored video, a video server or content provider providing video data, a video feed interface receiving video from a video server or content provider, a computer graphics system for generating computer graphics video data, a combination of such sources, or other source of video content. In one example, the video source 130 can include an IP camera or multiple IP cameras. In an illustrative example, multiple IP cameras can be located throughout an environment, and can provide the video frames 102 to the video analytics system 100. For instance, the IP cameras can be placed at various fields of view within the environment so that surveillance can be performed based on the captured video frames 102 of the environment.

In some embodiments, the video analytics system 100 and the video source 130 can be part of the same computing device. In some embodiments, the video analytics system 100 and the video source 130 can be part of separate computing devices. In some examples, the computing device (or devices) can include one or more wireless transceivers for wireless communications. The computing device (or devices) can include an electronic device, such as a camera (e.g., an IP camera or other video camera, a camera phone, a video phone, or other suitable capture device) , a mobile or stationary telephone handset (e.g., smartphone, cellular telephone, or the like) , a desktop computer, a laptop or notebook computer, a tablet computer, a set-top box, a television, a display device, a digital media player, a video gaming console, a video streaming device, or any other suitable electronic device.

The video analytics system 100 includes a blob detection engine 104 and an object tracking engine 106. Object detection and tracking allows the video analytics system 100 to provide various end-to-end features, such as the video analytics features described above. For example, intelligent motion detection, intrusion detection, and other features can directly use the results from object detection and tracking to generate end-to-end events. Other features, such as people, vehicle, or other object counting and classification can be greatly simplified based on the results of object detection and tracking. The blob detection engine 104 can detect one or more blobs in video frames (e.g., video frames 102) of a video sequence, and the object tracking engine 106 can track the one or more blobs across the frames of the video sequence. As used herein, a blob refers to pixels of at least a portion of an object in a video frame. For example, a blob can include a contiguous group of pixels making up at least a portion of a foreground object in a video frame. In another example, a blob can refer to a contiguous group of pixels making up at least a portion of a background object in a frame of image data. A blob can also be referred to as an object, a portion of an object, a blotch of pixels, a pixel patch, a cluster of pixels, a blot of pixels, a spot of pixels, a mass of pixels, or any other term referring to a group of pixels of an object or portion thereof. In some examples, a bounding box can be associated with a blob.

As described in more detail below, blobs can be tracked using blob trackers. A blob tracker can be associated with a tracker bounding box. In some examples, a bounding box for a blob tracker in a current frame can be the bounding box of a previous blob in a previous frame for which the blob tracker was associated. For instance, when the blob tracker is updated in the previous frame (after being associated with the previous blob in the previous frame) , updated information for the blob tracker can include the tracking information for the previous frame and also prediction of a location of the blob tracker in the next frame (which is the current frame in this example) . The prediction of the location of the blob tracker in the current frame can be based on the location of the blob in the previous frame. A history or motion model can be maintained for a blob tracker, including a history of various states, a velocity, and a location for the blob tracker, as described in more detail below.

In some examples, a motion model for a blob tracker can determine and maintain two locations of the blob tracker for each frame. For example, a first location for a blob tracker for a current frame can include a predicted location in the current frame. The first location is referred to herein as the predicted location. The predicted location of the blob tracker in the current frame includes a location in a previous frame of a blob with which the blob tracker was associated. Hence, the location of the blob associated with the blob tracker in the previous frame can be used as the predicted location of the blob tracker in the current frame. A second location for the blob tracker for the current frame can include a location in the current frame of a blob with which the tracker is associated in the current frame. The second location is referred to herein as the actual location. Accordingly, the location in the current frame of a blob associated with the blob tracker is used as the actual location of the blob tracker in the current frame. The actual location of the blob tracker in the current frame can be used as the predicted location of the blob tracker in a next frame. The location of the blobs can include the locations of the bounding boxes of the blobs.

The velocity of a blob tracker can include the displacement of a blob tracker between consecutive frames. For example, the displacement can be determined between the centers (or centroids) of two bounding boxes for the blob tracker in two consecutive frames. In one illustrative example, the velocity of a blob tracker can be defined as V_t＝C_t-C_t-1, where C_t-C_t-1＝ (C_tx-C_t-1x， C_ty-C_t-1y) . The term C_t (C_tx, C_ty) denotes the dimensions of a bounding box of the tracker in a current frame, with C_tx being the width of the bounding box, and C_ty being the height of the bounding box. The term C_t-1 (C_t-1x, C_t-1y) denotes the dimensions (width and height) of a bounding box of the tracker in a previous frame. In some cases, because the timing for video frame data is constant (according to the frame rate, such as 30 frames per second, 60 frames per second, 120 frames per second, or other suitable frame rate) , a time variable may not be needed in the velocity calculation. In some cases, a time constant can be used (according to the frame rate) .

Using the blob detection engine 104 and the object tracking engine 106, the video analytics system 100 can perform blob generation and detection for each frame or picture of a video sequence. For example, the blob detection engine 104 can perform background subtraction for a frame, and can then detect foreground pixels in the frame. Foreground blobs are generated from the foreground pixels using morphology operations and spatial analysis. Further, blob trackers from previous frames need to be associated with the foreground blobs in a current frame, and also need to be updated. Both the data association of trackers with blobs and tracker updates can rely on a cost function calculation. For example, when blobs are detected from a current input video frame, the blob trackers from the previous frame can be associated with the detected blobs according to a cost calculation. Trackers are then updated according to the data association, including updating the state and location of the trackers so that tracking of objects in the current frame can be fulfilled. Further details related to the blob detection engine 104 and the object tracking engine 106 are described with respect to FIGS. 3-4.

FIG. 2 is an example of the video analytics system (e.g., video analytics system 100) processing video frames across time t. As shown in FIG. 2, a video frame A 202A is received by a blob detection engine 204A. The blob detection engine 204A generates foreground blobs 208A for the current frame A 202A. After blob detection is performed, the foreground blobs 208A can be used for temporal tracking by the object tracking engine 206A. Costs (e.g., a cost including a distance, a weighted distance, or other cost) between blob trackers and blobs can be calculated by the object tracking engine 206A. The object tracking engine 206A can perform data association to associate or match the blob trackers (e.g., blob trackers generated or updated based on a previous frame or newly generated blob trackers) and blobs 208A using the calculated costs (e.g., using a cost matrix or other suitable association technique) . The blob trackers, including in terms of positions of the trackers, can be updated according to the data association to generate updated blob trackers 310A. For example, a blob tracker’s state and location for the video frame A 202A can be calculated and updated. The blob trackers location in a next video frame N 202N can also be predicted from the current video frame A 202A. For example, the predicted location of a blob tracker for the next video frame N 202N can include the location of the blob tracker (and its associated blob) in the current video frame A 202A. Tracking of blobs of the current frame A 202A can be performed once the updated blob trackers 310A are generated.

When a next video frame N 202N is received, the blob detection engine 204N generates foreground blobs 208N for the frame N 202N. The object tracking engine 206N can then perform temporal tracking of the blobs 208N. For example, the object tracking engine 206N obtains the blob trackers 310A that were updated based on the prior video frame A 202A. The object tracking engine 206N can then calculate a cost and can associate the blob trackers 310A and the blobs 208N using the newly calculated cost. The blob trackers 310A can be updated according to the data association to generate updated blob trackers 310N.

FIG. 3 is a block diagram illustrating an example of a blob detection engine 104. Blob detection is used to segment moving objects from the global background in a video scene. The blob detection engine 104 includes a background subtraction engine 312 that receives video frames 302. The background subtraction engine 312 can perform background subtraction to detect foreground pixels in one or more of the video frames 302. For example, the background subtraction can be used to segment moving objects from the global background in a video sequence and to generate a foreground-background binary mask (referred to herein as a foreground mask) . In some examples, the background subtraction can perform a subtraction between a current frame or picture and a background model including the background part of a scene (e.g., the static or mostly static part of the scene) . Based on the results of background subtraction, the morphology engine 314 and connected component analysis engine 316 can perform foreground pixel processing to group the foreground pixels into foreground blobs for tracking purpose. For example, after background subtraction, morphology operations can be applied to remove noisy pixels as well as to smooth the foreground mask. Connected component analysis can then be applied to generate the blobs. Blob processing can then be performed, which may include further filtering out some blobs and merging together some blobs to provide bounding boxes as input for tracking.

The background subtraction engine 312 can model the background of a scene (e.g., captured in the video sequence) using any suitable background subtraction technique (also referred to as background extraction) . One example of a background subtraction method used by the background subtraction engine 312 includes modeling the background of the scene as a statistical model based on the relatively static pixels in previous frames which are not considered to belong to any moving region. For example, the background subtraction engine 312 can use a Gaussian distribution model for each pixel location, with parameters of mean and variance to model each pixel location in frames of a video sequence. All the values of previous pixels at a particular pixel location are used to calculate the mean and variance of the target Gaussian model for the pixel location. When a pixel at a given location in a new video frame is processed, its value will be evaluated by the current Gaussian distribution of this pixel location. A classification of the pixel to either a foreground pixel or a background pixel is done by comparing the difference between the pixel value and the mean of the designated Gaussian model. In one illustrative example, if the distance of the pixel value and the Gaussian Mean is less than 3 times of the variance, the pixel is classified as a background pixel. Otherwise, in this illustrative example, the pixel is classified as a foreground pixel. At the same time, the Gaussian model for a pixel location will be updated by taking into consideration the current pixel value.

The background subtraction engine 312 can also perform background subtraction using a mixture of Gaussians (GMM) . A GMM models each pixel as a mixture of Gaussians and uses an online learning algorithm to update the model. Each Gaussian model is represented with mean, standard deviation (or covariance matrix if the pixel has multiple channels) , and weight. Weight represents the probability that the Gaussian occurs in the past history.

An equation of the GMM model is shown in equation (1) , wherein there are K Gaussian models. Each Guassian model has a distribution with a mean of μ and variance of ∑, and has a weight ω. Here, i is the index to the Gaussian model and t is the time instance. As shown by the equation, the parameters of the GMM changes over time after one frame (at time t) is processed.

The background subtraction techniques mentioned above are based on the assumption that the camera is mounted still, and if anytime the camera is moved or orientation of the camera is changed, a new background model will need to be calculated. There are also background subtraction methods that can handle foreground subtraction based on a moving background, including techniques such as tracking key points, optical flow, saliency, and other motion estimation based approaches.

The background subtraction engine 312 can generate a foreground mask with foreground pixels based on the result of background subtraction. For example, the foreground mask can include a binary image containing the pixels making up the foreground objects (e.g., moving objects) in a scene and the pixels of the background. In some examples, the background of the foreground mask (background pixels) can be a solid color, such as a solid white background, a solid black background, or other solid color. In such examples, the foreground pixels of the foreground mask can be a different color than that used for the background pixels, such as a solid black color, a solid white color, or other solid color. In one illustrative example, the background pixels can be black (e.g., pixel color value 0 in 8-bit grayscale or other suitable value) and the foreground pixels can be white (e.g., pixel color value 255 in 8-bit grayscale or other suitable value) . In another illustrative example, the background pixels can be white and the foreground pixels can be black.

Using the foreground mask generated from background subtraction, a morphology engine 314 can perform morphology functions to filter the foreground pixels. The morphology functions can include erosion and dilation functions. In one example, an erosion function can be applied, followed by a series of one or more dilation functions. An erosion function can be applied to remove pixels on object boundaries. For example, the morphology engine 314 can apply an erosion function (e.g., FilterErode3x3) to a 3x3 filter window of a center pixel, which is currently being processed. The 3x3 window can be applied to each foreground pixel (as the center pixel) in the foreground mask. One of ordinary skill in the art will appreciate that other window sizes can be used other than a 3x3 window. The erosion function can include an erosion operation that sets a current foreground pixel in the foreground mask (acting as the center pixel) to a background pixel if one or more of its neighboring pixels within the 3x3 window are background pixels. Such an erosion operation can be referred to as a strong erosion operation or a single-neighbor erosion operation. Here, the neighboring pixels of the current center pixel include the eight pixels in the 3x3 window, with the ninth pixel being the current center pixel.

A dilation operation can be used to enhance the boundary of a foreground object. For example, the morphology engine 314 can apply a dilation function (e.g., FilterDilate3x3) to a 3x3 filter window of a center pixel. The 3x3 dilation window can be applied to each background pixel (as the center pixel) in the foreground mask. One of ordinary skill in the art will appreciate that other window sizes can be used other than a 3x3 window. The dilation function can include a dilation operation that sets a current background pixel in the foreground mask (acting as the center pixel) as a foreground pixel if one or more of its neighboring pixels in the 3x3 window are foreground pixels. The neighboring pixels of the current center pixel include the eight pixels in the 3x3 window, with the ninth pixel being the current center pixel. In some examples, multiple dilation functions can be applied after an erosion function is applied. In one illustrative example, three function calls of dilation of 3x3 window size can be applied to the foreground mask before it is sent to the connected component analysis engine 316. In some examples, an erosion function can be applied first to remove noise pixels, and a series of dilation functions can then be applied to refine the foreground pixels. In one illustrative example, one erosion function with 3x3 window size is called first, and three function calls of dilation of 3x3 window size are applied to the foreground mask before it is sent to the connected component analysis engine 316. Details regarding content-adaptive morphology operations are described below.

After the morphology operations are performed, the connected component analysis engine 316 can apply connected component analysis to connect neighboring foreground pixels to formulate connected components and blobs. One example of the connected component analysis performed by the connected component analysis engine 316 is implemented as follows:

for each pixel of the foreground mask {

-if it is a foreground pixel and has not been processed, the following steps apply:

-Apply FloodFill function to connect this pixel to other foreground and

generate a connected component

-Insert the connected component in a list of connected component.

-Mark the pixels in the connected component as being processed }

The Floodfill (seed fill) function is an algorithm that determines the area connected to a seed node in a multi-dimensional array (e.g., a 2-D image in this case) . This Floodfill function first obtains the color or intensity value at the seed position (e.g., a foreground pixel) of the source foreground mask, and then finds all the neighbor pixels that have the same (or similar) value based on 4 or 8 connectivity. For example, in a 4 connectivity case, a current pixel’s neighbors are defined as those with a coordination being (x+d, y) or (x, y+d) , wherein d is equal to 1 or -1 and (x, y) is the current pixel. One of ordinary skill in the art will appreciate that other amounts of connectivity can be used. Some objects are separated into different connected components and some objects are grouped into the same connected components (e.g., neighbor pixels with the same or similar values) . Additional processing may be applied to further process the connected components for grouping. Finally, the blobs 308 are generated that include neighboring foreground pixels according to the connected components. In one example, a blob can be made up of one connected component. In another example, a blob can include multiple connected components (e.g., when two or more blobs are merged together) .

The blob processing engine 318 can perform additional processing to further process the blobs generated by the connected component analysis engine 316. In some examples, the blob processing engine 318 can generate the bounding boxes to represent the detected blobs and blob trackers. In some cases, the blob bounding boxes can be output from the blob detection engine 104. In some examples, the blob processing engine 318 can perform content-based filtering of certain blobs. For instance, a machine learning method can determine that a current blob contains noise (e.g., foliage in a scene) . Using the machine learning information, the blob processing engine 318 can determine the current blob is a noisy blob and can remove it from the resulting blobs that are provided to the object tracking engine 106. In some examples, the blob processing engine 318 can merge close blobs into one big blob to remove the risk of having too many small blobs that could belong to one object. In some examples, the blob processing engine 318 can filter out one or more small blobs that are below a certain size threshold (e.g., an area of a bounding box surrounding a blob is below an area threshold) . In some embodiments, the blob detection engine 104 does not include the blob processing engine 318, or does not use the blob processing engine 318 in some instances. For example, the blobs generated by the connected component analysis engine 316, without further processing, can be input to the object tracking engine 106 to perform blob and/or object tracking.

FIG. 4 is a block diagram illustrating an example of an object tracking engine 106. Object tracking in a video sequence can be used for many applications, including surveillance applications, among many others. For example, the ability to detect and track multiple objects in the same scene is of great interest in many security applications. When blobs (making up at least portions of objects) are detected from an input video frame, blob trackers from the previous video frame need to be associated to the blobs in the input video frame according to a cost calculation. The blob trackers can be updated based on the associated foreground blobs. In some instances, the steps in object tracking can be conducted in a series manner.

A cost determination engine 412 of the object tracking engine 106 can obtain the blobs 408 of a current video frame from the blob detection engine 104. The cost determination engine 412 can also obtain the blob trackers 410A updated from the previous video frame (e.g., video frame A 202A) . A cost function can then be used to calculate costs between the object trackers 410A and the blobs 408. Any suitable cost function can be used to calculate the costs. In some examples, the cost determination engine 412 can measure the cost between a blob tracker and a blob by calculating the Euclidean distance between the centroid of the tracker (e.g., the bounding box for the tracker) and the centroid of the bounding box of the foreground blob. In one illustrative example using a 2-D video sequence, this type of cost function is calculated as below:

The terms (t_x， t_y) and (b_x， b_y) are the center locations of the blob tracker and blob bounding boxes, respectively. As noted herein, in some examples, the bounding box of the blob tracker can be the bounding box of a blob associated with the blob tracker in a previous frame. In some examples, other cost function approaches can be performed that use a minimum distance in an x-direction or y-direction to calculate the cost. Such techniques can be good for certain controlled scenarios, such as well-aligned lane conveying. In some examples, a cost function can be based on a distance of a blob tracker and a blob, where instead of using the center position of the bounding boxes of blob and tracker to calculate distance, the boundaries of the bounding boxes are considered so that a negative distance is introduced when two bounding boxes are overlapped geometrically. In addition, the value of such a distance is further adjusted according to the size ratio of the two associated bounding boxes. For example, a cost can be weighted based on a ratio between the area of the blob tracker bounding box and the area of the blob bounding box (e.g., by multiplying the determined distance by the ratio) .

In some embodiments, a cost is determined for each tracker-blob pair between each tracker and each blob. For example, if there are three trackers, including tracker A, tracker B, and tracker C, and three blobs, including blob A, blob B, and blob C, a separate cost between tracker A and each of the blobs A, B, and C can be determined, as well as separate costs between trackers B and C and each of the blobs A, B, and C. In some examples, the costs can be arranged in a cost matrix, which can be used for data association. For example, the cost matrix can be a 2-dimensional matrix, with one dimension being the blob trackers 410A and the second dimension being the blobs 408. Every tracker-blob pair or combination between the trackers 410A and the blobs 408 includes a cost that is included in the cost matrix. Best matches between the trackers 410A and blobs 408 can be determined by identifying the lowest cost tracker-blob pairs in the matrix. For example, the lowest cost between tracker A and the blobs A, B, and C is used to determine the blob with which to associate the tracker A.

Data association between trackers 410A and blobs 408, as well as updating of the trackers 410A, may be based on the determined costs. The data association engine 414 matches or assigns a tracker with a corresponding blob and vice versa. For example, as described previously, the lowest cost tracker-blob pairs may be used by the data association engine 414 to associate the blob trackers 410A with the blobs 408. Another technique for associating blob trackers with blobs includes the Hungarian method, which is a combinatorial optimization algorithm that solves such an assignment problem in polynomial time and that anticipated later primal-dual methods. For example, the Hungarian method can optimize a global cost across all blob trackers 410A with the blobs 408 in order to minimize the global cost. The blob tracker-blob combinations in the cost matrix that minimize the global cost can be determined and used as the association.

In addition to the Hungarian method, other robust methods can be used to perform data association between blobs and blob trackers. For example, the association problem can be solved with additional constraints to make the solution more robust to noise while matching as many trackers and blobs as possible.

Regardless of the association technique that is used, the data association engine 414 can rely on the distance between the blobs and trackers. The location of the foreground blobs are identified with the blob detection engine 104. However, a blob tracker location in a current frame may need to be predicated from a previous frame (e.g., using a location of a blob associated with the blob tracker in the previous frame) . The calculated distance between the identified blobs and estimated trackers are used for data association. After the data association for the current frame, the tracker location in the current frame can be identified with its associated blob (s) ’ location in the current frame. The tracker’s location can be further used to update the tracker’s motion model and predict its location in the next frame.

Once the association between the blob trackers 410A and blobs 408 has been completed, the blob tracker update engine 416 can use the information of the associated blobs, as well as the trackers’ temporal statuses, to update the states of the trackers 410A for the current frame. Upon updating the trackers 410A, the blob tracker update engine 416 can perform object tracking using the updated trackers 410N, and can also provide the update trackers 410N for use for a next frame.

The state of a blob tracker can includes the tracker’s identified location (or actual location) in a current frame and its predicted location in the next frame. The state can also, or alternatively, include a tracker’s temporal status. The temporal status can include whether the tracker is a new tracker that was not present before the current frame, whether the tracker has been alive for certain frames, or other suitable temporal status. Other states can include, additionally or alternatively, whether the tracker is considered as lost when it does not associate with any foreground blob in the current frame, whether the tracker is considered as a dead tracker if it fails to associate with any blobs for a certain number of consecutive frames (e.g., 2 or more) , or other suitable tracker states.

Other than the location of a tracker, there may be other status information needed for updating the tracker, which may require a state machine for object tracking. Given the information of the associated blob (s) and the tracker’s own status history table, the status also needs to be updated. The state machine collects all the necessary information and updates the status accordingly. Various statuses can be updated. For example, other than a tracker’s life status (e.g., new, lost, dead, or other suitable life status) , the tracker’s association confidence and relationship with other trackers can also be updated. Taking one example of the tracker relationship, when two objects (e.g., persons, vehicles, or other object of interest) intersect, the two trackers associated with the two objects will be merged together for certain frames, and the merge or occlusion status needs to be recorded for high level video analytics.

One method for performing a tracker location update is using a Kalman filter. The Kalman filter is a framework that includes two steps. The first step is to predict a tracker’s state, and the second step is to use measurements to correct or update the state. In this case, the tracker from the last frame predicts (using the blob tracker update engine 416) its location in the current frame, and when the current frame is received, the tracker first uses the measurement of the blob (s) to correct its location states and then predicts its location in the next frame. For example, a blob tracker can employ a Kalman filter to measure its trajectory as well as predict its future location (s) . The Kalman filter relies on the measurement of the associated blob (s) to correct the motion model for the blob tracker and to predict the location of the object tracker in the next frame. In some examples, if a blob tracker is associated with a blob in a current frame, the location of the blob is directly used to correct the blob tracker’s motion model in the Kalman filter. In some examples, if a blob tracker is not associated with any blob in a current frame, the blob tracker’s location in the current frame is identified as its predicted location from the previous frame, meaning that the motion model for the blob tracker is not corrected and the prediction propagates with the blob tracker’s last model (from the previous frame) .

Regardless of the tracking method being used, a new tracker starts to be associated with a blob in one frame and, moving forward, the new tracker may be connected with possibly moving blobs across multiple frames. When a tracker has been continuously associated with blobs and a duration has passed, the tracker may be promoted to be a normal tracker and output as an identified tracker-blob pair. A tracker-blob pair is output at the system level as an event (e.g., presented as a tracked object on a display, output as an alert, or other suitable event) when the tracker is promoted to be a normal tracker. A tracker that is not promoted as a normal tracker can be removed (or killed) , after which the track can be considered as dead.

Blob detection and tracking, however, can be thwarted if a surveillance camera is tampered with. When the camera is tampered with, the image captured by the camera may be so altered that blobs that were being tracked can no longer be found. In the worst case, the camera is rendered useless. When this occurs, a system administrator should be informed as quickly as possible so that the situation can be remedied.

A camera can be tampered with in various ways. For example, a camera can suffer redirection, occlusion, defocusing, or some other event such as shaking, excessive brightness, and/or excessive darkness.

FIGS. 5A-5B illustrate an example of a camera that has been redirected. FIG. 5A illustrates the scene 500 that a particular camera has been configured to record. In FIG. 5B, the camera has been turned nearly 90 degrees to the viewer’s left, resulting in a different scene 510 being visible to the camera. In the scene 510 of FIG. 5B, anything moving in the right-hand area of the original scene 500 of FIG. 5A (e.g., someone coming out of the door in the middle of the original scene 500) will not be captured. Thus once moved, the camera in this example may be unable to fulfill its original surveillance purpose.

FIGS. 6A-6B illustrate an example of a camera that has suffered occlusion. FIG. 6A illustrates the scene 600 that a particular camera has been configured to record. In FIG. 6B, the camera’s view has been mostly obscured due to an object having been placed in front of the camera. The resulting scene 610 includes primarily the blocking object, and little of the room that is visible in the original scene 600. A camera can be occluded or obscured in various other ways. For example, an object can be placed over the entire camera or over the camera lens, possibly resulting in the camera’s entire view being blocked. In some cases, such as in the example of FIG. 6B, partially obscuring the camera’s view may be enough to disable the camera’s ability to monitor a scene.

FIGS. 7A-7B illustrates an example of a camera that has been defocused. FIG. 7A illustrates the scene 700 that a particular camera has been configured to record. In FIG. 7B, the camera’s picture has been put out of focus, resulting in a blurry scene 710. Blurring of the scene may hinder the camera’s ability to separate blobs from the background. Additionally, important details, such as a person’s face or a license plate number, may no longer be clearly visible. Defocusing the camera can be accomplished in various ways, including manually modifying the focus of the camera’s lens, placing a lens or other clear object in front of the camera, and/or fogging the lens.

The examples discussed above are a few ways in which a camera can be tampered with. Other ways include shaking or otherwise rendering the camera unstable. When the camera is not stable, its ability to capture movement may be hampered. Additionally, the camera’s ability to identify blobs may be hindered. Another way that a camera can be tampered with is to over-expose the scene； that is, making the scene in front of the camera too bright. For example, a light can be shone directly into the camera lens. Another way to tamper with a camera is to under-expose the scene； that is to make the scene too dark. For example, light sources in the scene can be covered up.

The different ways in which a camera can be tampered with generally require different detection methods. Furthermore, a video may need to be checked for each tamper type, since a video frame may have been subjected to one tamper type (e.g., blur) while not at the same time suffering another tamper type (e.g., occlusion) . In such a case, testing for only one tamper type (e.g., blur) may result in the other tamper type (e.g. occlusion) being missed and the camera incorrectly reporting that it has not been tampered with. Detecting even one tamper type, however, may require a large amount of computation. For example, each pixel in a scene may need to be examined. The amount of computation required may exceed the computational capabilities of a camera, and may require external compute servers. Sequential detection of all tamper types, moreover, may require not only a large amount of computation, but also a large amount of time, making it difficult to detect tampering in real time.

One method for reducing the computational complexity needed to detect tampering is to examine only part of a video frame instead of the whole frame. For example, the pixels in only a square taken from the center of the frame can be examined. Selectively examining regions of the frame has the advantage of reducing the number of pixels that need to be examined. It may be difficult, however, to select the region of the frame to examine. For example, it may be that no one region is representative of the activity happening in the whole frame. This method thus may miss some tamper incidents when the tamper is not evident in the region of the frame that was selected for examination.

Another method for reducing the computational complexity in tamper detection is to downsample the video frame and then examine the downsampled frame. Downsampling effectively reduces the size of the frame. For example, a frame that is 1920 pixels wide by 1080 pixels high can be reduced to 1156 x 648 (a60％reduction) . Downsampling, however, may cause some loss in detail in the picture. For example, a downsampled frame may appear blurry, or pixelated, and edges may no longer be sharply delineated. This loss of detail may cause some tamper events to be missed. For example, defocusing may not be detected in a downsampled frame because the downsampled may cause the same loss of detail that defocusing does.

Another method for automated tamper detection reduces the computational complexity by combining the above approaches and incorporating constrained random testing. FIG. 8 illustrates an example of an automated tamper detection system 800 configured to implement this method. The system 800 includes a blob detection 810 engine and a tamper detection 820 engine. The system 800 can receive a current input frame 802, and for the input frame 802 produces a tamper determination 840. The tamper determination 840 may indicate that tamper is suspected in a particular input frame 802, and/or that tampering of the camera has been confirmed. In various implementations, the system 800 may be included in an IP camera as software engines, hardware engines, or a combination of software and hardware engines.

The blob detection 810 engine is similar to the blob detection systems discussed above. Specifically, the blob detection 810 engine includes a background subtraction 812 engine, which separates the foreground pixels from the background pixels in an input frame 802. The background subtraction 812 may produce background-foreground masks 814, which may be used for future background subtraction, and/or for blob tracking.

The background subtraction 812 engine can also produce a background picture 804. The background picture 804 is an image that represents the assumed background of the scene being viewed by the camera, absent any moving objects that would otherwise be tracked. In various implementations, the background picture 804 may be determined over time (e.g., 60 frames, 30 seconds, or some other time frame) . The background picture 804 produced by the background subtraction 812 engine generally incorporates the current input frame 802. In some examples, the background picture 804 may also be referred to as background mean picture.

Various methods can be used to determine the background picture 804. For example, the background picture 804 can be derived using the GMM models discussed above. As another example, for a specific input frame 802, the closest background picture can be selected as the background picture 804. The closest background picture can be generated by selecting, for each pixel location in the frame, either: 1) when the pixel has been identified as a foreground pixel, the most probable model for the pixel； or 2) when the pixel has been identified as a background pixel, the closest model for pixel. The most probable model for a pixel location is the model for the pixel that has the largest weight. The closest model is the model whose distance to the pixel is the smallest among all available models for the pixel’s location.

As discussed above, the intensity of each pixel location in a video frame can be modelled by a mixture of K Gaussian Models. Each model has its own weight, mean, and variance. The intensity of each pixel location of the background picture is the mean of the selected Gaussian Model of that location. When, in a current frame, a particular pixel location is determined to be a foreground pixel, the intensity of the background at that pixel location can be estimated. The most possible intensity value is the mean μ_i of the most probable model (with highest weight w_i) among the K Gaussian Models. When, in a current frame, a particular pixel location is determined to be a background pixel, the intensity of the background at that pixel location can be represented by the model from among the K Gaussian model that best represents the intensity of the pixel location. For example, if the intensity of pixel location in the current frame is p, we choose the μ_i which is closest to p than all other μ_j， where j＝1, .., K, j！＝i , as the intensity of the background picture for the pixel location.

The tamper detection 820 engine receives both the background picture 804 and the current input frame 802. The tamper detection 820 engine in this example includes a complexity controller 822 and a detection controller 830. As discussed further below, the complexity controller’s 822 engines make determinations that reduce the computation complexity required to detect a tamper event, while the detection controller’s 830 engines perform tamper detection operations.

The complexity controller 822 includes a tile size determination 824 engine, a tile selection 828 engine, and a downsample size determination 826 engine. The tile size determination 824 engine can be used to determine a tile size. Generally, the tamper detection 820 engine divides the frame into tiles, and performs a first stage of tamper detection on selected tiles. To select tiles, the complexity controller 822 uses the tile selection 828 engine.

In various implementations, the automated tamper detection system 800 may detect tampering using a first stage check and a second stage check. Generally, and as discussed further below, the first stage check includes selecting tiles of pixels from the input frame 802, selecting corresponding (that is, in the same corresponding location as the selected tile of pixels from the input frame 802) tiles of pixels from the background picture 804, and determining whether the tiles from the input frame 802 are similar to the tiles taken from the background picture 804. To perform the first stage check, the complexity controller 822 may include a tile size determination 824 engine and a tile selection 828 engine, and the detection controller 830 may include a tile-based similarity detection 832 engine. The tile size determination 824 engine can determine the size of a tile of pixels. The tile selection 828 engine can determine the location within a frame where a tile of pixels should be taken. In various implementations, the tile selection is constrained to improve the probability that a representative area of the frame is being examined. The tile-based similarity detection 832 engine can check whether a tile of pixels from the input frame 802 is similar to a corresponding tile of pixels from the background picture 804. For example, as discussed further below, the tile-based similarity detection 832 may examine each tile for edges, and may determine whether the tile from the input frame 802 and the tile from the background picture 804 have the same edges.

Relying on only one input frame 802 to detect tampering, however, may be insufficient to identify a true tamper incident. For example, a legitimate blob may cause the first stage check to report a mismatch in the selected tiles. Thus, the result of the first stage check only indicates that tampering is suspected.

In various implementations, the automated tamper detection system 800 further includes a second stage check. In the second stage check, the system 800 may, once tampering is suspected, examine subsequent frames in a systematic fashion. When some or all of these frames indicate tampering, then tampering is confirmed.

In some implementations, the second stage check may include conducting additional types of tests on data from the input frame 802 and the background picture 804. For example, the detection controller 830 may include a blur detection 834 engine, which can check tiles of pixels (e.g., the tiles used for similarity checking or other tiles) for blurring. The blur detection 834 engine may thus confirm that blur tampering has occurred. As another example, the system 800 may downsample both the input frame 802 and the background picture 804 and compare the downsampled results. In this case, the entire input frame 802 and the entire background picture 804 are compared, so that the tamper checking can be thorough.

To conduct the comparison of the downsampled data, the complexity controller 822 may include a downsample size determination 826 engine, to determine to what degree the images should be downsampled, and a similarity detection on downsampled data 836 engine, to conduct the comparison. The downsample size determination 826 engine may, for example, determine that the input frame 802 and the background picture 804 should be downsampled by a factor of N in both the horizontal and vertical directions, resulting in a downsampled image with the resolution w/N x h/N. The similarity detection on downsampled data 836 engine may, for example, compare edges found in the input frame 802 and the background picture 804.

In some implementations, once tampering is suspected, the second stage check may continue to examine tiles of pixels from the input frame 802 and the background picture 804 over the course of multiple frames. When each of these subsequent frames indicate tampering, a tamper event is confirmed.

As noted above, when conducting a first stage check, an automated tamper detection may examine tiles of pixels taken from both an input frame and a background picture. FIG. 9 illustrates an example of a frame 900 that has been divided into a grid of tiles 910. In various implementations, and automated tamper detection system can divide a frame into M tiles across by M tiles high. In this example, the frame 900 has been divided into eighth tiles across by eight tiles high. In various implementations, the number of tiles across and the number of tiles high need not be the same. In some cases, the boundary tiles may need to be shifted towards the left and/or top so that no padding is required to make all the tiles the same size. In this example, each tile 910 has a resolution of w/M by h/M, where w and h are the width and height of the frame 900, in pixels. The tiles 910 can be indexed with relative coordinates (idxX, idxY) , wherein each tile 910 has a starting position (e.g., the upper left corner of the tile) of (idxX x (w/M) , idxY x (h/M) ) and a size of w/M x h/M.

The MxM tile layout is applied to both the input frame and the background picture. The automated tamper detection system can then select a group of tiles to test for similarity. In some implementations, the system may first divide the frame 900 into four

equal quadrants

912, 914, 916, 918. The system may then select a random tile 922 in the top-left quadrant 912. The first selected tile 922, which may have index coordinates (tileX, tileY) , will have a tileX value that is less than M/2, and also a tileY value that is less than M/2. Additionally, the upper-leftmost tile may be considered to have coordinates (0, 0) and the lower-rightmost tile may be considered to have the coordinates (M-1, M-1) .

Using the first tile 922 as a starting point, in various implementations, the system may then select

tiles

924, 926, 928 in the other three

quadrants

914, 916, 918, where the position of the other three

tiles

924, 926, 928 is based on the position of the first tile 922. For example, the system may select a tile 926 in the bottom-right quadrant 918 with the index (M-1-tileX, M-1-tileY) . In this example, the system may also select a tile 924 in the top-right quadrant 914 with index coordinates (M-1-tileY, tileX) and a tile 928 in the bottom-left quadrant 916 with index coordinates (tileY, M-1-tileX) . In some implementations, an additional fifth tile may be selected in the center of the frame, where the fifth tile is selected irrespective of the quadrants. In these implementations, the selected

tiles

922, 924, 926, 928 form a diamond shape.

Generally, randomly selecting tiles positively affects the probability that the system will select a tile 910 that that indicates evidence of tampering. Constraining the selection to the four

quadrants

912, 914, 916, 918 additionally improves the probability by increasing the areas of the frame 900 that will be checked. Dividing the frame into quadrants also enables smaller tiles of pixels to be used. Constraining the selection of the

tiles

924, 926, 928 in the top-right 914, bottom-right 918, and bottom-left 916 quadrants to be based on the location of the top-left 922 tile further improves the probability that tiles will not be overlooked. In various implementations, however, the group of tiles can be selected in other ways. For example, the system can select a random tile in each of the four

quadrants

912, 914, 916, 918, rather than tiles that correspond to each other.

Once tiles are selected from the grid of tiles, the automated tamper detection system may compare a tile of pixels from an input frame and a corresponding tile of pixels from a background picture for similarity. Testing the tiles for similarity allows the system to detect whether something has changed, possibly suspiciously, in the scene being viewed by the camera.

FIG. 10A illustrates an example of a background picture 1004 that may be input into an automated tamper detection system. In this example, the grid of tiles 1010 described with respect to FIG. 9 has been overlaid onto the background picture 1004. The background picture 1004 of FIG. 10A is thus divided into four

quadrants

1012, 1014, 1016, 1018, where each

quadrant

1012, 1014, 1016, 1018 includes, according to this example, a grid of four-by-four tiles. In this example, a group of

tiles

1022, 1024, 1026, 1028 has been selected for testing, a tile each in the top-left quadrant 1012, the top-right quadrant 1024, the bottom left-quadrant 1016, and the bottom-right quadrant 1018. In various implementations, a tile in each of the top-right 1024, bottom-left 1026, and bottom-right 1018 quadrants may be selected relative to the tile 1022 selected in the top-left 1022 quadrant, as described above. As illustrated in this example, the group of

tiles

1022, 1024, 1026, 1028, though each possibly only including a small set of pixels from the background picture 1004, may provide a broad representation of the scene.

FIG. 10B illustrates an example of an input frame 1002 that includes the same scene illustrated in FIG. 10A, but with an object blocking approximately half of the camera’s view. The input frame 1002 of FIG. 10B has been overlaid with the same grid of tiles 1010, divided into four

quadrants

1012, 1014, 1016, 1018, as was overlaid onto the background picture 1004. Furthermore, because the objective is to determine whether there are any differences between the input frame 1002 and the background picture 104, the

same tiles

1022, 1024, 1026, 1028 are selected from the input frame 1002. Using the selected tiles, the automated tamper detection system can attempt to determine whether the input frame 1002 has changed from the background picture 1004 by testing whether tiles of pixels from the input frame 1002 are similar to, or different from, the corresponding tiles of pixels from the background picture 1004.

Similarity testing may involve first dividing a tile from the group of tiles into blocks. For example, the size of the block can be 8x8 or 16x16 pixels. Alternatively or additionally, the block size can be selected based on the size of the frame. In both the input frame 1002 and the background picture 1004, each blocks can be tested for edges. For example canny edge detection may be applied, where a per-pixel map is generated. The pixel map includes a value for each pixel in the block, and the value may be set to one value (e.g., 1) when an edge is detected and another value (e.g., 0) when no edge is detected at the pixel. After edge detection has been applied to the blocks, morphology functions, such as for example two dilations among each 3x3 pixel window, may be applied to blocks that include edges.

The system may maintain a count of blocks where an edge was detected in the input frame or the background picture (edgeBlockPairCnt) . The system may also maintain a count of the blocks where there was a difference in the detected edges between the input frame and background picture (edgeBlkDiffCnt) . That is, when either the block in the input frame or the block in the background picture included an edge, the edgeBlockPairCnt is incremented. When one block (e.g., the one in the background picture) included an edge but the corresponding block (e.g., the one in the input frame) did not include an edge, the edgeBlkDiffCnt is incremented.

When both blocks included an edge, the blocks may be compared pixel-by-pixel to determine whether the blocks include the same edges. For example, the system may maintain a count of pixels detected as edge pixels (pEdgeCnt) and a count of pixels that are different between the input frame and the background picture (pDiffCnt) . A pixel-by-pixel comparison may then proceed as follows: for each pixel location, e1 [i] can designate the edge value of a pixel in the input frame 1002 and e2 [i] can designate the edge value of the corresponding pixel in the background picture 1004. When e1 [i] is not equal to e2 [i] , pDiffCnt is incremented. When either e1 [i] or e2 [i] indicate an edge pixel, pEdgeCnt is incremented. Once each pixel in the block has been compared, the system can then check whether pDiffCnt is greater than T x pEdgeCnt, where T is a threshold value set to any suitable value between 0 and 1 (e.g., 0.3, 0.4, 0.5, 0.6, 0.7, or other suitable value) . When pDiffCnt is greater than T x pEdgeCnt (and equal to in some cases) , the block from the input frame 1002 is considered different from the block from the background frame 1004.

Referring to the examples of FIGS. 10A-10B, each of the selected

tiles

1022, 1024, 1026, 1028 can be examined. In the tile 1022 from the top-left quadrant 1012, the system may detect edges in the ceiling of the illustrated room, but may further determine that the same edges are present in both the input frame 1002 and the background picture 1004. Thus, the upper-left tile 1022 may contribute to the edgBlockPairCnt (e.g., the count of blocks where either edges were detected in either the input frame 1002 or the background picture 1004) but not to the edgeBlkDiffCnt (e.g., the count of blocks where one frame included edges but the other did not) .

The tile 1024 from the top-right quadrant 1014, in this example, will produce a different result. In the background picture 1004, this tile 1024 includes only a blank wall, and thus may not have any edges. In the input frame 1002, on the other hand, the tile 1024 has at least one significant edge corresponding to the edge of the notebook occluding the scene. The upper-right tile 1024 thus may contribute an equal amount to both the edgeBlockPairCnt and the edgeBlkDiffCnt.

The tile 1026 in the bottom-right quadrant 1014, in this example, may produce a similar result. In the input frame 1002, this tile 1026 includes a small part of the obstruction. Most likely the obstruction will be detected as an edge in the input frame 1002, but in some cases it might not be. Thus the lower-left tile 1026 may contribute to both the edgeBlockPairCnt and the edgeBlkDiffCnt, but in some cases may not contribute to the edgeBlkDiffCnt.

The tile 1028 from the bottom-quadrant 1018 is entirely different in the input frame 1002 than in the background picture 1004, due to the input frame 102 being entirely obstructed in this area. The lower-right tile 1028 may thus contribute to the edgeBlockPairCnt, but contribute significantly more to the edgeBlkDiffCnt.

The above block-based similarity check may result in a determination of whether a tile from the input frame 1002 was the same or was different from the corresponding tile from the background frame 1004. In various implementations, the system may also make a combined determination for all of the tiles in a group. For example, the edgeBlockPairCnt and edgeBlkDiffCnt, as described above, for each tile may be summed into an edgeBlkPairPicCnt and edgeBlkDiffPicCnt, respectively. In this example, when the edgeBlkDiffPicCnt is larger than a certain percentage (e.g., the threshold T or other threshold) of the edgeBlkPairPicCnt the tiles from the input frame 1002, as a group, are considered not similar to the tiles from the background picture 1004. The percentage can be set, for example, to 50％.

When the similarity detection process determines that an input frame is dissimilar from the background picture, the system may suspect that tampering has occurred, but in some cases the changes in the scene may be temporary, and may not be an actual occurrence of tampering. For example, a large object may have moved past the camera, mostly blocking the view, but then may continue moving out of view. To avoid erroneously detecting tampering, the automated tamper detection system may be configured to detect tampering in a certain number of frames dT before confirming that tampering has occurred. The number of frames dT may be referred to as the tamper duration. The system may further maintain a current tamper state. For example, when no tampering is detected in an input frame, the tamper state may be set to NONE. When edge similarity detection indicates that a particular input frame is different from the background picture, the tamper state may be set to ON. When the tamper state is ON and no edge differences are detected for a particular input frame, the tamper state may be set back to NONE and the frame duration dT is set to zero. When the tamper state is set to ON for at least a number of frames dT, the tamper state may be set to DETECTED and a tamper event may be reported.

In various implementations, once an input frame indicates possible tampering (e.g., the tamper state is ON) , tiles may be selected in subsequent frames in a systematic fashion. As noted above, when no tampering is indicated, tiles may be selected in a generally random fashion, and in some implementations tiles may be selected in a related group (e.g., in a diamond formation) . Once tampering is suspected, tiles may be selected in a more orderly fashion, to make sure that most or all tiles are checked and/or so that the area of tamper can be focused on.

FIG. 11 illustrates an example of selecting tiles in subsequent frames once tampering is suspected. FIG. 11 illustrates a frame 1100 that has been divided into a grid of tiles 1110, where the tiles 1110 are grouped into four

quadrants

1112, 1114, 1116, 1118. In this example, for the sake of clarity, sequentially selected tiles 1122a-1122f are illustrated only for the top-left quadrant 1112 of the frame 1100, and it is assumed that tiles in each of the other three

quadrants

1114, 1116, 1118 would also be selected in systematic fashion. For example, tiles in the bottom-right quadrant 1118, top-right quadrant 1114, and bottom-left quadrant 1116 can be selected with respect to the tile 1122a-1122f selected in the top-left quadrant 1112, according to, for example, the procedure described above with respect to FIG. 9. Alternatively or additionally, the

tiles

1114, 1116, 1118 in the top-right 1114, bottom-left 1116, and bottom-right 1118 quadrants can be selected according to a process similar to the process described below, or according to a different process.

In FIG. 11, in various implementations, the tile selected in the current frame may be based on the location of the tile that was selected in the previous frame. The tile selected in the previous frame –for example a first tile 1122a –may be specified as (tileX’ , tileY’ ) , and the tile selected in the current frame –for example a second tile 1122b –may be specified as (tileX, tileY) . In one example, the tile (tileX, tileY) in the current frame may be selected using guidelines. For example, four

lines

1132, 1134, 1136, 1138 can be defined for the top-left quadrant 1112. In this example, the tile (tileX, tileY) can be selected so that a line drawn from the previous tile (tileX’ , tileY’ ) (e.g., from the center of the tile) to the current tile (tileX, tileY) is perpendicular to one of the four

lines

1132, 1134, 1136, 1138. For example, in the illustrated example, the first tile 1122a (previous tile) is aligned with a diagonal line 1138 drawn from the upper right corner of the top-left quadrant 1112 to the bottom-left corner of the top-left quadrant 1112. A line perpendicular to the diagonal line 1138 provides the second tile 1122b (current tile) can be diagonally up and left from the first tile 1122a.

Additionally, when the previous tile (tileX’ , tileY’ ) is particularly close to a particular line (e.g. the vertical line 1134) , a different line (e.g. a diagonal line 1132) can be used to determine the direction from which the current tile (tileX, tileY) is selected. For example, the second tile 1122b may be considered close to the vertical line 1134, in which case the diagonal line 1132 from the upper-left corner of the top-left quadrant 1112 to the lower right corner of the top-left quadrant 1112 can be used as the reference line. In this example, a perpendicular line from the diagonal line 1132 can select a third tile 1122c down and to the left from the second tile 1122b. In some implementations, when the previous tile (tileX’ , tileY’ ) is not to close to a line, the current tile (tileX, tileY) will continue to be determined based on the previous (tileX’ , tileY’ ) until tampering is confirmed or it is determined that no tampering has occurred. For example, when the previous tile (tileX’ , tileY’ ) is sufficiently far from a line, the tile (tileX, tileY) is set to the previous tile (tileX’ , tileY’ ) .

Other methods can be used to select a tile (tileX, tileY) in the current frame. For example, in the illustrated example of FIG. 11, sequential tiles are selected in a counter-clockwise fashion. In other examples, tiles may be selected in a clockwise fashion, in an inward spiraling pattern, in an outward spiraling pattern, in raster scan order, in a reverse raster scan order, in an up-to-down or down-to-up order, or in some other systematic order. In some implementations, tiles may be selected based on the contents of the previous tiles. For example, when no edge differences were detected in the previous tile (tileX’ , tileY’ ) , the tile (tileX, tileY) may be selected by reversing the direction in which tiles are selected.

As noted above, once tile-based similarity checking determines that tampering is suspected, the tamper detection system may attempt to confirm that tampering has occurred by checking certain number of frames dT for tampering. In some implementations, the system may initiate a second stage of tamper detection once tampering is suspected.

FIG. 12 illustrates an example of a process 1200 that may be implemented by an automated tamper detection system to confirm that a tamper event has occurred. In this example, the system conducts a first stage check on selected tiles from the frame. This example also illustrates one implementations for a second stage check, which the automated tamper detection system can use to confirm that tampering has occurred.

At step 1202, the system fetches the next frame, including both the input frame and the background picture. At step 1204, the system engages in a first stage of tamper detection. The first stage check includes selecting tiles and determining whether any tampering is evident in the selected tiles. Testing the selected tiles for tampering may include checking whether tiles from the input frame are similar to tiles from the background picture, using, for example, an edge similarity check as described above. When no tampering is evident in the tiles, the system proceeds to step 1206. In step 1206, the tamper state is set to “NONE” and the duration counter is reset to zero. The system then returns to step 1202 to fetch a next frame.

Returning to step 1204, when tampering is evident in the selected tile (e.g., based on edge similarity checking) , the system proceeds to step 1208. At step 1208, the tamper state is set to “YES” because tampering is now suspected. The duration counter is also incremented. The process then proceeds to step 1210.

At step 1210, the system checks whether the duration counter is less than half the duration limit (e.g, the number of frames dT) . When the duration is less than half the duration limit, the process returns to step 1202 to fetch a next frame. Tampering is still suspected, but is not yet confirmed. In various implementations, step 1210 may test whether the duration is some other value that is less than the total duration limit, such as for example one-quarter the duration limit, one-third the duration limit, or other suitable percentage of the total duration limit.

When, at step 1210, the duration is greater than or equal to half (or some other value) the duration limit, the system engages in a second stage of tamper detection. The second stage of tamper detection can confirm that tampering has occurred, and may determine what type of tampering has occurred. According to some implementations, at step 1212, the system checks the tiles that were selected at step 1204 for blurring.

Blur detection may remove false positives. For example, the tiles tested at step 1204 may have tested positive for tampering because an object has innocently moved into the frame, and not because the camera has been defocused. In various implementations, one tile from a group of tiles may be selected to test for blurring. For example, the tile that has the most edge information may be selected for testing for blurring (e.g., the tile with the highest edgeBlockPairCnt) . Blur detection can be accomplished using a Laplacian operation on each pixel in the tile. A Laplacian operation may use a filter defined according to the following matrix:

In the above matrix, a coefficient of -4 is applied to the current pixel and a coefficient of 1 is applied to four neighboring pixels. After applying the filter, the absolute value of the result of filtering each pixel forms a sharpness image. The sum of the pixels in the sharpness image may further be divided by the number of pixels in the sharpness image to derive the sharpness level of a tile. When the difference between the sharpness level of the tile from the input picture and the sharpness level of the tile from the background picture is large enough, the system determines that blur has occurred in the input frame.

When blur has been detected at step 1212, the system proceeds to step 1218. At step 1218, the system determines whether the duration has reached the duration limit (e.g., the amount of frames dT) . Though the tile tested at step 1212 indicates that the tile has suffered blurring, tampering is only suspected at this point. Thus, when the duration is less that the duration limit, the system returns to step 1202 to fetch a next frame. When the duration is equal to or greater than the duration limit (or only greater than in some cases) , the system has found that a consecutive number of frames have detectable blurring in at least some areas. The system thus proceeds to step 1220. At step 1220, the tamper state is set to “DET” (or “DETECTED” ) and tampering has been confirmed. At this step, the system may also send a message to bring the tamper event to the attention of system administrators.

Returning to step 1212, when blurring has not been detected in one or more tiles, the process proceeds to

steps

1214 and 1216 to check the entire input frame for tampering. Checking the entire frame may aid in reducing false positives. For example, the tile-level testing at step 1204 may have indicated tampering due to an object innocently moving within the scene and thus temporarily blocking the background. As noted above, testing an entire frame may be computationally burdensome, thus the system first downsamples the input frame. To establish a point of comparison, , at step 1214, the system also downsamples the background picture, and proceeds to step 1216 to check both for tampering.

At step 1216, the system may conduct an edge-based similarity check similar to the edge-based similarity check that may be conducted, at step 1204, on selected tiles. Specifically, at step 1214, the system may produce a count of the edges detected in the input frame or the background picture (edgeBlockPairCnt) and a count of the edges that were in one frame (e.g., the background picture) but not in the other frame (edgeBlkDiffCnt) . When the edgeBlkDiffCnt is larger than the T x edgeBlkPairCnt, where T is a threshold value such as 50％or other suitable value, the system determines that the input frame and the background picture are different. When the system determines that the input frame and the background picture are different, the system proceeds to step 1220, having confirmed tampering.

When, at step 1216, the system finds no evidence of tampering in the whole input frame, the system proceeds to step 1222. At step 1222, the system has determined that no tampering has occurred, sets the tamper state to “NONE” , and resets the duration counter to zero. By checking the whole input frame, the system has been able to determine that the tile-level tampering detected at step 1204 was a false positive. The system thus returns to step 1202 to fetch the next frame and start checking for tampering anew.

Returning to step 1216, when the system finds that there was tampering in the input frame, the system proceeds to step 1218. At step 1218, the system determines whether the duration has reached the duration limit (e.g., the amount of frames dT) . The system has identified frame-level tampering, but one incident of tampering, seen in only one frame, may be insufficient to decide that tampering has occurred. Thus, at step 1218, when the duration is less than the duration limit, the system returns to step 1202 to fetch a next input frame. When, at step 1218, the duration is greater than or equal to (or only greater than in some cases) the duration limit, the system has seen enough frames with frame level tampering (or blurring) . The system thus proceeds to step 1220. At step 1220, the tamper state is set to “DET” (or “DETECTED” ) and tampering has been confirmed.

In some implementations, the system may determine tampering using only tile-based testing (e.g., the first stage of tamper detection described above) . In these implementations, tampering is confirmed when the duration counter reaches the duration limit. That is, tampering is confirmed when a sequential number of frames dT each have tampering detected in a group of tiles. For these implementations, in the example of FIG. 12, step 1210 would test whether the duration has reached the duration limit. When the duration limit has not been reached, the system returns to step 1202. When the duration limit has been reached, the system proceeds to step 1220 and confirms tampering.

In some implementations, when tampering has been confirmed (e.g., at step 1220) and a system administrator has been informed, the tamper state is set to “NO” again and the duration counter is reset to zero, regardless of whether the tampering has been remedied. In some cases, one tamper event may be followed by another tamper event, hence the tamper detection system should be reset and should be checking for more tampering even when the initial tampering has not been fixed. Once the tamper detection system has been reset, blob detection may proceed as normal, including updating the background picture to include the tampering.

In some cases, the tamper detection system may need some time to distinguish one tamper event from a subsequent tamper event. Thus, in some implementations, the system may be configured to wait some time (e.g., 30 seconds, 60 seconds, 90 seconds, or other suitable amount of time) after confirming tampering before restarting tamper detection. In these implementations, once tamper detection has restarted, parameters such as the duration counter and the tamper state can be reset.

FIG. 13 illustrates an example of a process 1300 for automatic tamper detection according to techniques described herein. At 1302, the process 1300 includes obtaining an input frame and a background picture, wherein the background picture is based at least in part on the input frame. The background picture is an image that represents the assumed background of the scene being viewed by the camera, absent any moving objects that would otherwise be tracked. The input frame is a single frame obtained from a camera. In various implementations, the background picture can be updated with the data provided by each input frame. In this way, changes in the background can be recorded in the background picture.

At 1304, the process 1300 includes selecting a first tile of pixels from the input frame, wherein the first tile of pixels is selected by dividing the input frame into a grid of tiles, and wherein the first tile has a first location within the input frame. To reduce the computational complexity that may be required to test a whole frame for tampering, the process 1300 may divide the frame into a grid of tiles, and select one tile to test. In some implementations, the first tile is selected randomly. In various implementations, the process 1300 may divide the grid of tiles into four quadrants, and select the first tile from the top-left quadrant. In various implementations, the process 1300 may further select a tile in each of the bottom-right, top-right, and bottom-left quadrants. In some implementations, these three tiles may be selected from random locations. In some implementations, the location of these there tiles may be based on the location of the first tile within the top-left quadrant.

At 1306, the process 1300 includes selecting a second tile of pixels from the background picture, wherein the second tile has a second location within the background picture, and wherein the second location in the background picture corresponds to the first location in the input frame. The second tile is thus selected such that the second tile includes pixels representing the background that may be present in the first tile.

At 1308, the process 1300 includes comparing the first tile of pixels to the second tile of pixels. By making this comparison, the process 1300 can determine whether, in the first tile, pixels input frame are different from the background (as represented by the second tile) . The process 1300 may use various methods to compare the first tile to the second tile. For example, in various implementations, at step 1308 the process 1300 may determine whether the first tile includes the same edges as are included in the second tile.

At 1310, the process 1300 includes determining a suspect incident of tampering using a result of the comparing, wherein the result indicates that the first tile of pixels includes pixel values that are not included in the second tile of pixels. When the first tile of pixels is different from the second tile of pixels, the input frame has been changed from the background picture, but this change may not necessarily be due to tampering. Thus, having determined that the first tile’s pixels are different from the pixels in the second tile, the process 1300 at this point only suspects tampering. In various implementations, the process 1300 may proceed to additional steps to confirm tampering.

In some examples, the process 1300 may be performed by a computing device or an apparatus, such as the video analytics system 100. For example, the process 1300 can be performed by the video analytics system 100 and/or the object tracking engine 106 shown in FIG. 1. In some cases, the computing device or apparatus may include a processor, microprocessor, microcomputer, or other component of a device that is configured to carry out the steps of process 1300. In some examples, the computing device or apparatus may include a camera configured to capture video data (e.g., a video sequence) including video frames. For example, the computing device may include a camera device (e.g., an IP camera or other type of camera device) that may include a video codec. In some examples, a camera or other capture device that captures the video data is separate from the computing device, in which case the computing device receives the captured video data. The computing device may further include a network interface configured to communicate the video data. The network interface may be configured to communicate Internet Protocol (IP) based data.

Process 1300 is illustrated as logical flow diagrams, the operation of which represent a sequence of operations that can be implemented in hardware, computer instructions, or a combination thereof. In the context of computer instructions, the operations represent computer-executable instructions stored on one or more computer-readable storage media that, when executed by one or more processors, perform the recited operations. Generally, computer-executable instructions include routines, programs, objects, components, data structures, and the like that perform particular functions or implement particular data types. The order in which the operations are described is not intended to be construed as a limitation, and any number of the described operations can be combined in any order and/or in parallel to implement the processes.

Additionally, the process 1300 may be performed under the control of one or more computer systems configured with executable instructions and may be implemented as code (e.g., executable instructions, one or more computer programs, or one or more applications) executing collectively on one or more processors, by hardware, or combinations thereof. As noted above, the code may be stored on a computer-readable or machine-readable storage medium, for example, in the form of a computer program comprising a plurality of instructions executable by one or more processors. The computer-readable or machine-readable storage medium may be non-transitory.

The content-adaptive blob tracking operations discussed herein may be implemented using compressed video or using uncompressed video frames (before or after compression) . An example video encoding and decoding system includes a source device that provides encoded video data to be decoded at a later time by a destination device. In particular, the source device provides the video data to destination device via a computer-readable medium. The source device and the destination device may comprise any of a wide range of devices, including desktop computers, notebook (i.e., laptop) computers, tablet computers, set-top boxes, telephone handsets such as so-called “smart” phones, so-called “smart” pads, televisions, cameras, display devices, digital media players, video gaming consoles, video streaming device, or the like. In some cases, the source device and the destination device may be equipped for wireless communication.

The destination device may receive the encoded video data to be decoded via the computer-readable medium. The computer-readable medium may comprise any type of medium or device capable of moving the encoded video data from source device to destination device. In one example, computer-readable medium may comprise a communication medium to enable source device to transmit encoded video data directly to destination device in real-time. The encoded video data may be modulated according to a communication standard, such as a wireless communication protocol, and transmitted to destination device. The communication medium may comprise any wireless or wired communication medium, such as a radio frequency (RF) spectrum or one or more physical transmission lines. The communication medium may form part of a packet-based network, such as a local area network, a wide-area network, or a global network such as the Internet. The communication medium may include routers, switches, base stations, or any other equipment that may be useful to facilitate communication from source device to destination device.

In some examples, encoded data may be output from output interface to a storage device. Similarly, encoded data may be accessed from the storage device by input interface. The storage device may include any of a variety of distributed or locally accessed data storage media such as a hard drive, Blu-ray discs, DVDs, CD-ROMs, flash memory, volatile or non-volatile memory, or any other suitable digital storage media for storing encoded video data. In a further example, the storage device may correspond to a file server or another intermediate storage device that may store the encoded video generated by source device. Destination device may access stored video data from the storage device via streaming or download. The file server may be any type of server capable of storing encoded video data and transmitting that encoded video data to the destination device. Example file servers include a web server (e.g., for a website) , an FTP server, network attached storage (NAS) devices, or a local disk drive. Destination device may access the encoded video data through any standard data connection, including an Internet connection. This may include a wireless channel (e.g., a Wi-Fi connection) , a wired connection (e.g., DSL, cable modem, etc. ) , or a combination of both that is suitable for accessing encoded video data stored on a file server. The transmission of encoded video data from the storage device may be a streaming transmission, a download transmission, or a combination thereof.

The techniques of this disclosure are not necessarily limited to wireless applications or settings. The techniques may be applied to video coding in support of any of a variety of multimedia applications, such as over-the-air television broadcasts, cable television transmissions, satellite television transmissions, Internet streaming video transmissions, such as dynamic adaptive streaming over HTTP (DASH) , digital video that is encoded onto a data storage medium, decoding of digital video stored on a data storage medium, or other applications. In some examples, system may be configured to support one-way or two-way video transmission to support applications such as video streaming, video playback, video broadcasting, and/or video telephony.

In one example the source device includes a video source, a video encoder, and a output interface. The destination device may include an input interface, a video decoder, and a display device. The video encoder of source device may be configured to apply the techniques disclosed herein. In other examples, a source device and a destination device may include other components or arrangements. For example, the source device may receive video data from an external video source, such as an external camera. Likewise, the destination device may interface with an external display device, rather than including an integrated display device.

The example system above merely one example. Techniques for processing video data in parallel may be performed by any digital video encoding and/or decoding device. Although generally the techniques of this disclosure are performed by a video encoding device, the techniques may also be performed by a video encoder/decoder, typically referred to as a “CODEC. ” Moreover, the techniques of this disclosure may also be performed by a video preprocessor. Source device and destination device are merely examples of such coding devices in which source device generates coded video data for transmission to destination device. In some examples, the source and destination devices may operate in a substantially symmetrical manner such that each of the devices include video encoding and decoding components. Hence, example systems may support one-way or two-way video transmission between video devices, e.g., for video streaming, video playback, video broadcasting, or video telephony.

The video source may include a video capture device, such as a video camera, a video archive containing previously captured video, and/or a video feed interface to receive video from a video content provider. As a further alternative, the video source may generate computer graphics-based data as the source video, or a combination of live video, archived video, and computer-generated video. In some cases, if video source is a video camera, source device and destination device may form so-called camera phones or video phones. As mentioned above, however, the techniques described in this disclosure may be applicable to video coding in general, and may be applied to wireless and/or wired applications. In each case, the captured, pre-captured, or computer-generated video may be encoded by the video encoder. The encoded video information may then be output by output interface onto the computer-readable medium.

As noted, the computer-readable medium may include transient media, such as a wireless broadcast or wired network transmission, or storage media (that is, non-transitory storage media) , such as a hard disk, flash drive, compact disc, digital video disc, Blu-ray disc, or other computer-readable media. In some examples, a network server (not shown) may receive encoded video data from the source device and provide the encoded video data to the destination device, e.g., via network transmission. Similarly, a computing device of a medium production facility, such as a disc stamping facility, may receive encoded video data from the source device and produce a disc containing the encoded video data. Therefore, the computer-readable medium may be understood to include one or more computer-readable media of various forms, in various examples.

In the foregoing description, aspects of the application are described with reference to specific embodiments thereof, but those skilled in the art will recognize that the invention is not limited thereto. Thus, while illustrative embodiments of the application have been described in detail herein, it is to be understood that the inventive concepts may be otherwise variously embodied and employed, and that the appended claims are intended to be construed to include such variations, except as limited by the prior art. Various features and aspects of the above-described invention may be used individually or jointly. Further, embodiments can be utilized in any number of environments and applications beyond those described herein without departing from the broader spirit and scope of the specification. The specification and drawings are, accordingly, to be regarded as illustrative rather than restrictive. For the purposes of illustration, methods were described in a particular order. It should be appreciated that in alternate embodiments, the methods may be performed in a different order than that described.

Where components are described as being “configured to” perform certain operations, such configuration can be accomplished, for example, by designing electronic circuits or other hardware to perform the operation, by programming programmable electronic circuits (e.g., microprocessors, or other suitable electronic circuits) to perform the operation, or any combination thereof.

The various illustrative logical blocks, modules, circuits, and algorithm steps described in connection with the embodiments disclosed herein may be implemented as electronic hardware, computer software, firmware, or combinations thereof. To clearly illustrate this interchangeability of hardware and software, various illustrative components, blocks, modules, circuits, and steps have been described above generally in terms of their functionality. Whether such functionality is implemented as hardware or software depends upon the particular application and design constraints imposed on the overall system. Skilled artisans may implement the described functionality in varying ways for each particular application, but such implementation decisions should not be interpreted as causing a departure from the scope of the present invention.

The techniques described herein may also be implemented in electronic hardware, computer software, firmware, or any combination thereof. Such techniques may be implemented in any of a variety of devices such as general purposes computers, wireless communication device handsets, or integrated circuit devices having multiple uses including application in wireless communication device handsets and other devices. Any features described as modules or components may be implemented together in an integrated logic device or separately as discrete but interoperable logic devices. If implemented in software, the techniques may be realized at least in part by a computer-readable data storage medium comprising program code including instructions that, when executed, performs one or more of the methods described above. The computer-readable data storage medium may form part of a computer program product, which may include packaging materials. The computer-readable medium may comprise memory or data storage media, such as random access memory (RAM) such as synchronous dynamic random access memory (SDRAM) , read-only memory (ROM) , non-volatile random access memory (NVRAM) , electrically erasable programmable read-only memory (EEPROM) , FLASH memory, magnetic or optical data storage media, and the like. The techniques additionally, or alternatively, may be realized at least in part by a computer-readable communication medium that carries or communicates program code in the form of instructions or data structures and that can be accessed, read, and/or executed by a computer, such as propagated signals or waves.

The program code may be executed by a processor, which may include one or more processors, such as one or more digital signal processors (DSPs) , general purpose microprocessors, an application specific integrated circuits (ASICs) , field programmable logic arrays (FPGAs) , or other equivalent integrated or discrete logic circuitry. Such a processor may be configured to perform any of the techniques described in this disclosure. A general purpose processor may be a microprocessor； but in the alternative, the processor may be any conventional processor, controller, microcontroller, or state machine. A processor may also be implemented as a combination of computing devices, e.g.， a combination of a DSP and a microprocessor, a plurality of microprocessors, one or more microprocessors in conjunction with a DSP core, or any other such configuration. Accordingly, the term “processor, ” as used herein may refer to any of the foregoing structure, any combination of the foregoing structure, or any other structure or apparatus suitable for implementation of the techniques described herein. In addition, in some aspects, the functionality described herein may be provided within dedicated software modules or hardware modules configured for encoding and decoding, or incorporated in a combined video encoder-decoder (CODEC) .

Claims

A method for automated tamper detection of a camera, comprising:

obtaining an input frame and a background picture, wherein the background picture is based at least in part on the input frame；

selecting a first tile of pixels from the input frame, wherein the first tile of pixels is selected by subdividing the input frame into a grid of tiles, and wherein the first tile has a first location within the input frame；

selecting a second tile of pixels from the background picture, wherein the second tile has a second location within the background picture, and wherein the second location in the background picture corresponds to the first location in the input frame；

comparing the first tile of pixels to the second tile of pixels； and

determining a suspect incident of tampering using a result of the comparing, wherein the result indicates that the first tile of pixels includes pixel values that are not included in the second tile of pixels.
The method of claim 1, wherein selecting the first tile includes:

grouping the plurality of tiles into a top-left quadrant, a top-right quadrant, a bottom-left quadrant, and a bottom-right quadrant； and

selecting the first tile of pixels from the input frame from the top-left quadrant
The method of claim 2, further comprising:

selecting a second input tile of pixels from the bottom-right quadrant, wherein a location of the second input tile within the bottom-right quadrant is based on a location of the first tile within the top-left quadrant, and wherein the second input tile is selected from the input frame；

selecting a third input tile of pixels from the top-right quadrant, wherein a location of the third input tile within the top-right quadrant is based on the location of the first tile within the top-left quadrant, and wherein the third input tile is selected from the input frame； and

selecting a fourth input tile of pixels from the bottom-left quadrant, wherein a location of the fourth tile within the bottom-left quadrant is based on the location of the first tile within the top-left quadrant, and wherein the fourth input tile of pixels is selected from the input frame.
The method of claim 1, further comprising:

selecting four additional tiles of pixels from the input frame.
The method of claim 1, wherein comparing the first tile of pixels to the second tile of pixels includes:

identifying edge pixels in the first tile of pixels；

identifying edge pixels in the second tile of pixels； and

determining that the first tile of pixels includes edges pixels that are different from the edge pixels identified in the second tile of pixels.
The method of claim 1, further comprising:

confirming the suspect incident of tampering as an actual incident of tampering, wherein the confirming includes examining an additional sequence of input frames and a corresponding sequence of background pictures.
The method of claim 6, wherein confirming the suspect incident of tampering includes:

selecting a test tile of pixels from each of the sequence of input frames, wherein each test tile is in a different location in each successive frame from the sequence of input frames； and

comparing each test tile of pixels to a corresponding tile of pixels from a corresponding background picture from the sequence of background pictures.
The method of claim 7, wherein a test tile in a current frame from the sequence of input frames is in a location neighboring the location of a test tile in a previous frame from the sequence of input frames.
The method of claim 7, wherein a test tile in a current frame from the sequence of input frames is selected based on a location of a test tile in a previous frame from the sequence of input frames.
The method of claim 1, further comprising, upon determining a suspect incident of tampering:

incrementing a duration count, wherein, when the duration count is equal to or greater than a duration limit, the suspect incident of tampering is confirmed as an actual incident of tampering.
The method of claim 1, further comprising, upon determining a suspect incident of tampering:

incrementing a duration count；

determining that the duration count is equal to or greater than a portion of a duration limit；

testing the first tile of pixels for blur； and

confirming the suspect incident of tampering as an actual incident of tampering using a result of the testing, wherein the result of the testing indicates the presence of blur in the first tile of pixels.
The method of claim 1, further comprising, upon determining a suspect incident of tampering:

incrementing a duration count；

determining that the duration count is equal to or greater than a portion of a duration limit；

testing the first tile of pixels for blur, wherein the testing includes determining a lack of blur in the first tile of pixels；

downsampling the input frame；

downsampling the background picture；

comparing the downsampled input frame to the downsampled background picture； and

confirming the suspect incident of tampering as an actual incident of tampering using a result of comparing the downsampled input frame to the downsampled background picture； wherein the result indicates that the downsampled input frame is dissimilar to the downsampled background picture.
An apparatus, comprising:

a memory configured to store video data； and

a processor configured to:

obtain an input frame and a background picture, wherein the background picture is based at least in part on the input frame；

select a first tile of pixels from the input frame, wherein the first tile of pixels is selected by subdividing the input frame into a grid of tiles, and wherein the first tile has a first location within the input frame；

select a second tile of pixels from the background picture, wherein the second tile has a second location within the background picture, and wherein the second location in the background picture corresponds to the first location in the input frame；

compare the first tile of pixels to the second tile of pixels； and

determine a suspect incident of tampering using a result of the comparing, wherein the result indicates that the first tile of pixels includes pixel values that are not included in the second tile of pixels.
The apparatus of claim 13, wherein selecting the first tile includes:

grouping the plurality of tiles into a top-left quadrant, a top-right quadrant, a bottom-left quadrant, and a bottom-right quadrant； and

selecting the first tile of pixels from the input frame from the top-left quadrant
The apparatus of claim 14, wherein the processor is further configured to:

select a second input tile of pixels from the bottom-right quadrant, wherein a location of the second input tile within the bottom-right quadrant is based on a location of the first tile within the top-left quadrant, and wherein the second input tile is selected from the input frame；

select a third input tile of pixels from the top-right quadrant, wherein a location of the third input tile within the top-right quadrant is based on the location of the first tile within the top-left quadrant, and wherein the third input tile is selected from the input frame； and

select a fourth input tile of pixels from the bottom-left quadrant, wherein a location of the fourth tile within the bottom-left quadrant is based on the location of the first tile within the top-left quadrant, and wherein the fourth input tile of pixels is selected from the input frame.
The apparatus of claim 13, wherein the processor is further configured to:

select four additional tiles of pixels from the input frame.
The apparatus of claim 13, wherein comparing the first tile of pixels to the second tile of pixels includes:

identifying edge pixels in the first tile of pixels；

identifying edge pixels in the second tile of pixels； and

determining that the first tile of pixels includes edges pixels that are different from the edge pixels identified in the second tile of pixels.
The apparatus of claim 13, wherein the processor is further configured to:

confirm the suspect incident of tampering as an actual incident of tampering, wherein the confirming includes examining an additional sequence of input frames and a corresponding sequence of background pictures.
The apparatus of claim 18, wherein confirming the suspect incident of tampering includes:

selecting a test tile of pixels from each of the sequence of input frames, wherein each test tile is in a different location in each successive frame from the sequence of input frames； and

comparing each test tile of pixels to a corresponding tile of pixels from a corresponding background picture from the sequence of background pictures.
The apparatus of claim 19, wherein a test tile in a current frame from the sequence of input frames is in a location neighboring the location of a test tile in a previous frame from the sequence of input frames.
The apparatus of claim 19, wherein a test tile in a current frame from the sequence of input frames is selected based on a location of a test tile in a previous frame from the sequence of input frames.
The apparatus of claim 13, wherein the processor is further configured to, upon determining a suspect incident of tampering:

increment a duration count, wherein, when the duration count is equal to or greater than a duration limit, the suspect incident of tampering is confirmed as an actual incident of tampering.
The apparatus of claim 13, wherein the processor is further configured to, upon determining a suspect incident of tampering:

increment a duration count；

determine that the duration count is equal to or greater than a portion of a duration limit；

test the first tile of pixels for blur； and

confirm the suspect incident of tampering as an actual incident of tampering using a result of the testing, wherein the result of the testing indicates the presence of blur in the first tile of pixels.
The apparatus of claim 13, wherein the processor is further configured to, upon determining a suspect incident of tampering:

increment a duration count；

determine that the duration count is equal to or greater than a portion of a duration limit；

test the first tile of pixels for blur, wherein the testing includes determining a lack of blur in the first tile of pixels；

downsample the input frame；

downsample the background picture；

compare the downsampled input frame to the downsampled background picture； and

confirm the suspect incident of tampering as an actual incident of tampering using a result of comparing the downsampled input frame to the downsampled background picture； wherein the result indicates that the downsampled input frame is dissimilar to the downsampled background picture.
A computer-readable medium having stored thereon instructions that, when executed by a processor, perform a method, the method including:

obtaining an input frame and a background picture, wherein the background picture is based at least in part on the input frame；

selecting a first tile of pixels from the input frame, wherein the first tile of pixels is selected by subdividing the input frame into a grid of tiles, and wherein the first tile has a first location within the input frame；

selecting a second tile of pixels from the background picture, wherein the second tile has a second location within the background picture, and wherein the second location in the background picture corresponds to the first location in the input frame；

comparing the first tile of pixels to the second tile of pixels； and

determining a suspect incident of tampering using a result of the comparing, wherein the result indicates that the first tile of pixels includes pixel values that are not included in the second tile of pixels.
The computer-readable medium of claim 25, wherein selecting the first tile includes:

grouping the plurality of tiles into a top-left quadrant, a top-right quadrant, a bottom-left quadrant, and a bottom-right quadrant； and

selecting the first tile of pixels from the input frame from the top-left quadrant
The computer-readable medium of claim 26, further comprising:

selecting a second input tile of pixels from the bottom-right quadrant, wherein a location of the second input tile within the bottom-right quadrant is based on a location of the first tile within the top-left quadrant, and wherein the second input tile is selected from the input frame；

selecting a third input tile of pixels from the top-right quadrant, wherein a location of the third input tile within the top-right quadrant is based on the location of the first tile within the top-left quadrant, and wherein the third input tile is selected from the input frame； and

selecting a fourth input tile of pixels from the bottom-left quadrant, wherein a location of the fourth tile within the bottom-left quadrant is based on the location of the first tile within the top-left quadrant, and wherein the fourth input tile of pixels is selected from the input frame.
The computer-readable medium of claim 25, further comprising:

selecting four additional tiles of pixels from the input frame.
The computer-readable medium of claim 25, wherein comparing the first tile of pixels to the second tile of pixels includes:

identifying edge pixels in the first tile of pixels；

identifying edge pixels in the second tile of pixels； and

determining that the first tile of pixels includes edges pixels that are different from the edge pixels identified in the second tile of pixels.
The computer-readable medium of claim 25, further comprising:

confirming the suspect incident of tampering as an actual incident of tampering, wherein the confirming includes examining an additional sequence of input frames and a corresponding sequence of background pictures.
The computer-readable medium of claim 30, wherein confirming the suspect incident of tampering includes:

selecting a test tile of pixels from each of the sequence of input frames, wherein each test tile is in a different location in each successive frame from the sequence of input frames； and

comparing each test tile of pixels to a corresponding tile of pixels from a corresponding background picture from the sequence of background pictures.
The computer-readable medium of claim 31, wherein a test tile in a current frame from the sequence of input frames is in a location neighboring the location of a test tile in a previous frame from the sequence of input frames.
The computer-readable medium of claim 31, wherein a test tile in a current frame from the sequence of input frames is selected based on a location of a test tile in a previous frame from the sequence of input frames.
The computer-readable medium of claim 25, further comprising, upon determining a suspect incident of tampering:

incrementing a duration count, wherein, when the duration count is equal to or greater than a duration limit, the suspect incident of tampering is confirmed as an actual incident of tampering.
The computer-readable medium of claim 25, further comprising, upon determining a suspect incident of tampering:

incrementing a duration count；

determining that the duration count is equal to or greater than a portion of a duration limit；

testing the first tile of pixels for blur； and

confirming the suspect incident of tampering as an actual incident of tampering using a result of the testing, wherein the result of the testing indicates the presence of blur in the first tile of pixels.
The computer-readable medium of claim 25, further comprising, upon determining a suspect incident of tampering:

incrementing a duration count；

determining that the duration count is equal to or greater than a portion of a duration limit；

testing the first tile of pixels for blur, wherein the testing includes determining a lack of blur in the first tile of pixels；

downsampling the input frame；

downsampling the background picture；

comparing the downsampled input frame to the downsampled background picture； and

confirming the suspect incident of tampering as an actual incident of tampering using a result of comparing the downsampled input frame to the downsampled background picture； wherein the result indicates that the downsampled input frame is dissimilar to the downsampled background picture.