TWI805334B - Cloud server and anomaly detection system and method for network surveillance - Google Patents

Abstract

A cloud server and anomaly detection system and method for network surveillance is provide therefore. The anomaly detection system comprises a local server, a cloud server and a surveillance camera. The local server provides a remote storage information. The surveillance camera connects to the local server and cloud server by Ethernet. The surveillance camera sends a streaming video to the cloud server according to the remote storage information. The cloud server transform the streaming video to a plurality of video file. The cloud server counts the number of the video files according to a recording option of the video file. When the number of the video files more than a first threshold, the cloud server outputs an alarm signal.

Description

Anomaly detection system, method and cloud server for network surveillance video

A system, method and server for network surveillance video, in particular to an anomaly detection system, method and cloud server for network surveillance video.

With the growth of network bandwidth and infrastructure, many security alarm systems have also begun to switch to Ethernet transmission architecture. In particular, the combination of surveillance video equipment and cloud network server further provides users with the ability to watch real-time images captured by the camera device at any time.

The video recording methods adopted by the existing monitoring video alarm system are mainly divided into two types: full-time video recording and event video recording. The way of full-time video recording is the uninterrupted continuous video recording of the surveillance video equipment. Event recording is when the monitoring equipment detects that there is an abnormal event, it will start recording. And although full-time video recording can obtain complete video data, it is difficult to obtain the required materials from all video data.

For the full-time video recording of abnormal events, although the user can receive relevant notifications through the electronic device. However, if there is an abnormality in the surveillance video equipment, the back-end system or the user may not be able to know whether there is any abnormality in the surveillance video equipment. The user cannot immediately find out that the abnormal state has occurred.

In view of this, in some embodiments, an anomaly detection system for network surveillance video is provided. Cooperating with a cloud server, the anomaly detection system for network surveillance video includes a local server, surveillance video equipment and an edge host. The local server provides remote storage path information; the surveillance video equipment includes a camera unit, a first communication unit and a first processor, the first processor is electrically connected to the camera unit and the first communication unit, and the first processor The image signal captured by the unit generates stream image information, the first communication unit is connected to the local server and the cloud server, and the first processor drives the first communication unit to send the stream image information according to the remote storage path information To the cloud server, the cloud server records the streaming video information into multiple video files according to the file recording option; the edge host is connected to the local server and the cloud server, the edge host executes the abnormality detection program, and the abnormality detection program counts The number of video files of the video files in the cloud server, when the number of video files is greater than the warning upper threshold, the abnormality detection program outputs a warning message, or when the number of video files is less than the warning lower limit threshold, the abnormality detection program outputs a warning message. In addition to realizing full-time video recording, the abnormality detection system of the network surveillance video can also judge in real time whether each network video recording device is abnormal, so as to remind the cloud server or the user of an abnormal state.

In some embodiments, the anomaly detection method of network surveillance video includes the following steps of connecting a plurality of surveillance video recording devices to a local server; the surveillance video device obtains remote storage path information from the local server, and the monitoring The video recording equipment transmits streaming image information to the cloud server; the cloud server executes an abnormality detection program to detect whether the video files of the surveillance video equipment are abnormal; if any video file of any surveillance video equipment is abnormal, the cloud server Output warning signal.

In some embodiments, the cloud server includes a second communication unit, a storage unit and a second processor. The second communication unit receives the video file; the storage unit stores a plurality of video files and an abnormality detection program; the second processor is electrically connected to the second communication unit and the storage unit, and the second processing unit executes the abnormality detection program, abnormality The detection program counts the number of video files in the video files of each file recording option for each surveillance video device, and when the number of video files is greater than the warning upper limit threshold, the abnormality detection program outputs a warning message.

In addition to providing uninterrupted full-time video recording, the above-mentioned anomaly detection system and cloud server of network surveillance video can also detect whether abnormal events or disconnections occur in each surveillance video equipment. The server sends the warning signal to the designated electronic device.

Please refer to FIG. 1A and FIG. 1B , which are respectively a structural diagram and component block diagram of an anomaly detection system 100 for network surveillance video according to an embodiment. The anomaly detection system 100 for network surveillance video includes a local server 110 , a cloud server 120 , at least one surveillance video device 130 and an edge host 140 . The local server 110 is connected to the cloud server 120 through Ethernet. The local server 110 can also be connected to the monitoring and recording device 130 through Ethernet, or connected to the monitoring and recording device 130 through other communication protocols. For example, it is a closed-circuit television system (Closed-Circuit Television, CCTV) and its transmission interface BNC connector (Bayonet Neill-Concelman).

The monitoring and recording device 130 can be connected to the local server 110 and the cloud server 120 through a cable network, or can be connected to the local server 110 and the cloud server 120 through a wireless network. The wireless network also includes the 4th generation of mobile phone mobile communication technology standards (referred to as 4G network), the 5th generation of mobile phone mobile communication technology standards (referred to as 5G network) or Satellite Communications (Communications Satellite), etc.

The local server 110 and the surveillance video recording device 130 may belong to the same local area network or the same actual field. The local server 110 may be, but not limited to, a Network Video Recorder (NVR for short), and the local server 110 may also be a personal computer or an embedded system.

The local server 110 provides remote storage path information 111 to each monitoring and recording device 130 . The local server 110 can assign the corresponding remote storage path information 111 according to the monitoring and recording devices 130 in different regions. The local server 110 can also store the streaming video information 134 of each surveillance video device 130 as a video file 124 . The remote storage path information 111 records relevant path information (Uniform Resource Locator, URL), connection port number (port number) or login information (login) of the cloud server 120 .

The monitoring and video recording device 130 includes a camera unit 131 , a first communication unit 132 and a first processor 133 . The first processor 133 is electrically connected to the camera unit 131 and the first communication unit 132 . The camera unit 131 converts optical image signals into digital image data. The type of the camera unit 131 is any one of a charge-coupled device (CCD) and a complementary metal oxide semiconductor active pixel sensor (CMOS active pixel sensor). The first communication unit 132 supports the Ethernet communication protocol.

The monitoring and recording device 130 can be connected to the cloud server 120 through the Internet, and connected to the local server 110 through the local area network. The first processor 133 encodes the image signal captured by the camera unit 131 to generate the stream image information 134 , and drives the first communication unit 132 to transmit the stream image information 134 . The first communication unit 132 also receives the remote storage path information 111 from the local server 110 . The first processor 133 transmits the streaming image information 134 to the cloud server 120 according to the remote storage path information 111 .

The cloud server 120 includes a second communication unit 121 , a storage unit 122 and a second processor 123 . The second processor 123 is electrically connected to the second communication unit 121 and the storage unit 122 . The storage unit 122 stores a video file 124 and an image encoding program 125 . The second processor 123 executes the video encoding program 125 to convert the streaming video information 134 into a video file 124 . The cloud server 120 can store video files 124 in the form of files according to the operating system and the adopted file structure, or mount each video file 124 as a single node.

The cloud server 120 may be, but not limited to, a server of the same network provider, or may be a cluster server constructed between a plurality of different network providers. For example, the surveillance video equipment 130 can transmit the streaming video information 134 to the cloud server 120 of Chunghwa Telecom. Alternatively, the surveillance video device 130 can transmit the streaming video information 134 to the cloud server 120 of Amazon (Amazon). Amazon's cloud server 120 assembles the designated video files 124 and then forwards the video files 124 to Chunghwa Telecom's cloud server 120 .

The video encoding program 125 determines the method of transferring the streaming video information 134 into the video file 124 according to the file recording option. File recording options include recording time options or recording capacity options. The image encoding program 125 stores a plurality of corresponding video files 124 according to different surveillance video devices 130 . The recording time option can be any one of minutes, hours, days, weeks, months, seasons or years as the recording length.

The recording capacity option depends on the image encoding bit rate (bit rate) or file format (file format) of the upper limit of the file. Taking constant bitrate as an example, the cloud server 120 can set the same data rate for each frame of the streaming image information 134 . The cloud server 120 calculates the data volume of each frame according to the data traffic and frame per second (FPS), and then generates a video file 124 with a fixed data volume. Alternatively, the cloud server 120 will create a new video file 124 every time a preset time (or preset capacity) passes. Take the 32-bit file allocation table (File Allocation Table, FAT32) as an example, and the upper limit of the file capacity of FAT32 is 4 Gigabyte. Assume that the cloud server 120 uses FAT32 as the storage format of the video file 124 . If the current video file 124 reaches 4 Gigabyte, the cloud server 120 will create another video file 124 to store the subsequent streaming video information 134 .

The edge host 140 is network connected to the cloud server 120 . The edge host 140 executes an anomaly detection program 141 . The anomaly detection program 141 counts whether the video file 124 is abnormal to the cloud server 120 . If the abnormality detection program 141 confirms that the video file 124 is abnormal, the abnormality detection program 141 outputs a warning message 142 . In addition to executing the anomaly detection program 141 according to an external requirement, the edge host 140 can also execute the anomaly detection program 141 periodically. The anomaly detection program 141 can target the video files 124 of all surveillance video devices 130 , or select the video files 124 of a specific surveillance video device 130 . Please refer to FIG. 2 , which is a schematic flowchart of anomaly detection of network surveillance video according to an embodiment. Step S210: Connect the monitoring and video recording device 130 to the local server 110; Step S220: the monitoring and recording device 130 acquires remote storage path information from the local server 110, and the monitoring and recording device 130 transmits the streaming video information 134 to the cloud server 120; Step S230: the cloud server 120 stores the streaming image information 134 as a plurality of video files 124; Step S240: Execute the anomaly detection program 141 from the edge host 140 to the cloud server 120 to detect whether the number of video files 124 is abnormal; Step S250: If the number of video files 124 is greater than the warning upper limit threshold, the abnormality detection program 141 outputs a warning message 142; Step S260: if the number of video files 124 is less than the lower warning threshold, the abnormality detection program 141 outputs a warning message 142; and Step S270: If the video file 124 of the monitoring and video recording device 130 is normal, the cloud server 120 executes step S240.

Firstly, enable the installed monitoring video recording device 130 and connect to the local server 110 through the aforementioned communication protocol. After the monitoring and video recording device 130 acquires the remote storage path information 111 from the local server 110 , the monitoring and recording device 130 performs image recording and encoding recording of the captured area. The monitoring and video recording device 130 transmits the video signal captured by the remote storage path information 111 to the cloud server 120 in a streaming manner.

As mentioned above, the cloud server 120 can store the video file 124 according to the file recording option. The cloud server 120 can also control the file quantity of the video file 124 through the adjustment of the video volume option and the video encoding bit rate. If the monitoring and video recording equipment 130 is abnormal, the cloud server 120 may not be able to continuously receive the streaming video information 134 . Therefore, the cloud server 120 becomes unable to receive the streaming image information 134 regularly, and the cloud server 120 will create video files 124 irregularly. Or, the network of the local server 110 is abnormal, so that the externally transmitted network packets are repeatedly transmitted or lost, causing the cloud server 120 to create duplicate video files 124 at the same time. Or any monitoring and video recording device 130 continuously detects the occurrence of events, so a large number of video files 124 are generated at the same time.

The edge host 140 may be an independent host, or may be executed by the local server 110 . The anomaly detection program 141 can not only count the number of video files of a single surveillance video device 130 , but also count the total amount of video files 124 of all surveillance video devices 130 . The anomaly detection program 141 determines whether the total amount of the video files 124 is greater than the upper warning threshold, or whether the total amount of the video files 124 is smaller than the lower warning threshold.

If the number of video files 124 is greater than the warning upper threshold, the abnormality detection program 141 outputs a warning message 142 . When the number of video files 124 is too large, it means that the monitoring and video recording device 130 may have a network abnormality, a software error or hardware damage of the monitoring and recording device 130 . The warning upper threshold can be defined by the manufacturer, and the anomaly detection program 141 can also obtain the number of video files 124 in at least a specific unit of time and calculate the average value. The anomaly detection program 141 uses the average value of the acquired video files 124 as the upper warning threshold.

Furthermore, the anomaly detection program 141 is based on the number of video files 124 of a plurality of surveillance video devices 130 as the warning upper threshold. For example, the anomaly detection program 141 can select several monitoring and video recording devices 130 from the same local area network. The anomaly detection program 141 performs averaging processing on the selected surveillance video equipment 130 and video files 124 . The anomaly detection program 141 sums up the video files 124 per unit time and divides them by the number of selected surveillance video recording devices 130, so as to obtain the average calculation result of the number of video files 124 that each surveillance video device 130 can generate per unit time . The abnormality detection program 141 uses the calculation result as the upper warning threshold. Similarly, the anomaly detection program 141 can also generate the lower warning threshold according to the foregoing manner.

In some embodiments, the anomaly detection program 141 can adjust the upper warning threshold or the lower warning threshold according to the error value. Please refer to FIG. 3A and FIG. 3B , which are schematic diagrams of an upper warning threshold and a lower warning threshold, and a schematic diagram of an error value, an upper warning threshold, or a lower warning threshold, respectively, of an embodiment. For the convenience of illustration, the upper warning threshold is defined as T _up , the lower warning threshold is T _low , the number of video files 124 is F, and the number of errors is Δ. In Figure 3A, the straight arrows represent the number of files, the thick black horizontal lines represent the upper threshold T _up and the lower threshold T _low respectively, the gray horizontal lines represent the number of detected video files, and the gray blocks represent errors Quantity value Δ.

In FIG. 3A , the number F of the video files 124 falls between the upper warning threshold T _up and the lower warning threshold T _low . The anomaly detection program 141 considers the video files of the surveillance video equipment 130 to be normal. If the number F of the video files 124 is greater than the upper warning threshold T _up or the number F of the video files 124 is smaller than the lower warning threshold T _low , the anomaly detection program 141 will output a warning message 142 to remind the edge host 140 and its users.

In FIG. 3B , the upper warning threshold T _up and the lower warning threshold T _low are respectively added to the error value Δ. When the number F of the video files 124 is greater than the upper warning threshold T _up and within the error value Δ, the anomaly detection program 141 determines that the video files 124 are still normal. If the number F of the video files 124 is greater than the upper warning threshold T _up and is outside the error value Δ, the abnormality detection program 141 will output a warning message 142 .

For example, there are 10 monitoring and video recording devices 130 in the field. The cloud server 120 sets for each monitoring and video recording device 130 that “4000” video files 124 need to be recorded in one day (that is, 24 hours), and also sets ±5% as the upper limit (lower limit) threshold value of the warning, and the error value Δ is 5% . In other words, the upper alert threshold T _up is “4200*10=42000” video files 124 , and the lower alert threshold T _low is “3800*10=38000” video files 124 .

Under normal circumstances, the cloud server 120 can store "40000" video files 124 every day. If the cloud server 120 only stores "39700" video files 124 on a certain day. Since the "39700" record video file 124 is between the upper warning threshold T _up and the lower warning threshold T _low , the abnormality detection program 141 judges it as a normal situation. If the cloud server 120 only stores "37000" record video files 124 on a certain day. Since the cloud server 120 is missing "3000" video files 124, the missing video files 124 have exceeded the error value Δ of 5%. The anomaly detection program 141 outputs a warning message 142 . In addition to setting the aforementioned upper warning threshold T _up , lower warning threshold T _low , and error value Δ for all monitoring and video recording devices 130 , the anomaly detection program 141 can also set the upper warning threshold T for the specified monitoring and recording device 130 _up , the warning lower limit threshold value T _low and the error quantity value Δ.

In some embodiments, the electronic device 340 sends a call request 411 to the cloud server 120 , as shown in FIG. 4 . The call request 411 includes the recording history of the selected surveillance video device 130 and the selected video file 124 . The electronic device 340 may be, but not limited to, a mobile phone, a tablet computer, a notebook computer, or a personal computer. After the cloud server 120 receives the call request 411 , the cloud server 120 searches for the recording history of the corresponding surveillance video equipment 130 and video file 124 according to the call request 411 . The cloud server 120 packages the selected video file 124 into a review image file 422 . The cloud server 120 can clone the inspection image file 422 into a network folder 421 (bucket). The cloud server 120 opens the network folder 421 for the electronic device 340 to query or download and review the image file 422 , or the image index information (no symbol) of the selected video file 124 . The image index information is the file number of the video file 124 , and the image index information can be recorded as the file number according to timestamp, video format or serial number.

In some embodiments, the cloud server 120 creates an expiration tag (tag) for each video file 124 according to the video recording time. The expiration tag records the expiration time of the video file 124 . The cloud server 120 checks whether the expired tag matches the current time after a preset time period. For example, the cloud server 120 can check expired tags at midnight every day. If the expiration tag is later than the current time, the cloud server 120 deletes the corresponding video file 124 . Because the cloud server 120 performs file read and write access processing on the video file 124 stored by itself. Therefore, the local server 110 or the edge host 140 does not need to send operation requests to the cloud server 120 , thereby reducing network access and traffic to the cloud server 120 . In other words, the local server 110 does not need to continuously poll the cloud server 120 for the file deletion request.

In some embodiments, the cloud server 120 includes a second communication unit 121 , a storage unit 122 and a second processor 123 , please refer to FIG. 5 . The second communication unit 121 is connected to the monitoring and video recording device 130 through the network, and is used for transmitting the streaming image information 134 of the monitoring and recording device 130 . The second processor 123 is electrically connected to the second communication unit 121 and the storage unit 122 . The storage unit 122 stores the video file 124 , the image encoding program 125 and the anomaly detection program 141 . The second processor 123 executes the video encoding program 125 to convert the streaming video information 134 into a video file 124 . In addition, the second processor 123 can regularly execute the exception detection program 141 for counting the number of video files 124 . If the number of video files 124 is greater than the upper warning threshold or smaller than the lower warning threshold, the anomaly detection program 141 will output a warning message 142 .

In addition to providing uninterrupted full-time video recording, the abnormality detection system 100 of the network surveillance video recording can detect whether an event abnormality or a disconnection abnormality occurs in each surveillance video recording device 130. The cloud server The device 120 transmits the warning signal 142 to the designated electronic device 340 . In addition, the anomaly detection system 100 of network surveillance video can eliminate faults in real time according to the abnormal warning message 142 , and can also reduce the manpower burden of dispatching.

100: Anomaly detection system 110: Local server 111: Remote storage path information 120: Cloud server 121: Second communication unit 122: Storage unit 123: Second processor 124: Video file 125: Image encoding program 130 : Surveillance video equipment 131: Camera unit 132: First communication unit 133: First processor 134: Streaming image information 140: Edge host 141: Abnormal detection program 142: Warning message 340: Electronic device 411: Call request 421: Network folder 422: review image file Δ: error value T _up : warning upper limit threshold value T _low : warning lower limit threshold value F: quantity S210~S250: steps

[ FIG. 1A ] is a schematic diagram of an embodiment of an abnormality detection system for network surveillance video. [ FIG. 1B ] is a schematic block diagram of components of a network surveillance video recording according to an embodiment. [ FIG. 2 ] is a schematic flow chart of abnormal detection of network surveillance video according to an embodiment. [ FIG. 3A ] is a schematic diagram of an upper warning threshold and a lower warning threshold in an embodiment. [ FIG. 3B ] is a schematic diagram of an error value, an upper warning threshold or a lower warning threshold in an embodiment. [ FIG. 4 ] is a schematic diagram of an electronic device sending a calling request to a cloud server according to an embodiment. [ FIG. 5 ] is a schematic block diagram of components of a network surveillance video recording according to an embodiment.

100: Anomaly Detection System

110:Local server

111:Remote storage path information

120: Cloud server

121: The second communication unit

122: storage unit

123: second processor

124:Video file

125: Abnormal detection program

130: Surveillance video equipment

131: camera unit

132: The first communication unit

133: The first processor

134: Streaming video information

140: Edge host

141:Anomaly detection program

142: Warning message

Claims (10)

An anomaly detection system for network surveillance video, which cooperates with a cloud server, the anomaly detection system for network surveillance video includes: a local server, providing a remote storage path information; a surveillance video equipment, It includes a camera unit, a first communication unit and a first processor, the first processor is electrically connected to the camera unit and the first communication unit, and the first processor is based on an image captured by the camera unit The signal generates a stream of image information, the first communication unit is network-connected to the local server and the cloud server, and the first processor drives the first communication unit to stream the stream according to the remote storage path information The image information is sent to the cloud server, and the cloud server records a stream of image information into multiple video files according to a file recording option; and an edge host is connected to the local server and the cloud server, the The edge host executes an abnormality detection program. The abnormality detection program counts the number of video files in the video files of the cloud server. When the number of video files is greater than a warning upper threshold, the abnormality detection program outputs a warning. message, or when the number of video files is less than a lower warning threshold, the anomaly detection program outputs the warning message; wherein, the cloud server searches for the corresponding surveillance video equipment and the video files according to a call request, and the cloud The server packages the selected video files into a review image file, and the cloud server copies the review image file to a network folder. The anomaly detection system for network surveillance video as described in claim 1, which further includes an electronic device connected to the cloud server through the network, and the electronic device receives the warning message output by the anomaly detection program . The anomaly detection system for network surveillance video as described in claim 2, wherein the electronic device downloads the video files corresponding to the file recording option, or the selected videos to the cloud server according to the warning message An image index information of the file. The anomaly detection system for network surveillance video according to claim 1, wherein the anomaly detection program increases or decreases the upper warning threshold and the lower warning threshold according to an error value. The anomaly detection system for network surveillance video as described in claim 1, wherein the file recording option is a recording time option or a recording capacity option. An anomaly detection method for network surveillance video, which includes: connecting a plurality of surveillance video recording devices to a local server; these surveillance video devices obtain a remote storage path information from the local server, and the monitoring The video recording device transmits a stream of image information to a cloud server; the cloud server saves a plurality of video files according to the stream image information; an edge host performs an anomaly detection program to the cloud server for detecting Whether the number of these video files is abnormal; if the number of video files is greater than an upper warning threshold, the abnormality detection program outputs a warning message; If the number of video files is less than a warning lower limit threshold, the abnormality detection program outputs the warning message; the cloud server searches for the corresponding monitoring video equipment and the video files according to a call request; and the cloud server will receive The selected video files are encapsulated into a review image file, and the cloud server copies the review image file to a network folder. A cloud server that receives a stream of image information from at least one monitoring and video recording device, the cloud server includes: a second communication unit that receives the stream image information; a storage unit that stores multiple video files and an abnormal detection and a second processor, the second processor is electrically connected to the second communication unit and the storage unit, the second processor records the streaming video information as the video files, the second The processor executes the anomaly detection program. The anomaly detection program counts the number of video files in the video files of the cloud server. When the video file number is greater than a warning upper threshold, the anomaly detection program outputs a warning. message, or when the number of video files is less than a lower warning threshold, the anomaly detection program outputs the warning message; wherein, the second processor searches for the surveillance video equipment and the video files according to a call request, the second The processor packages the selected video files into a review image file, and the second processor copies the review image file into a network folder of the storage unit. The cloud server according to claim 7, wherein the second processor generates image index information according to the video files. The cloud server according to claim 7, wherein when the number of video files is less than a lower warning threshold, the abnormality detection program outputs the warning message. The cloud server according to claim 9, wherein the anomaly detection program increases or decreases the upper warning threshold and the lower warning threshold according to an error value.

Images