Method and electronic device for detecting video surveillance equipment

Abstract

The present application provides a method and electronic device for detecting video surveillance equipment, the method comprising: obtaining MAC address information and port information of at least one target device connected to the same wireless network as the electronic device, determining whether the target device is a video surveillance device according to the MAC address information; if it cannot be determined according to the MAC address information, determining whether the target device is a video surveillance device according to the port information, or the MAC address information and the port information; if it still cannot be determined, obtaining the fingerprint information of the target device based on the detection protocol of the TCP port or the UDP port, and further determining whether the target device is a video surveillance device according to the fingerprint information. The technical solution provided by the present application can improve the detection accuracy and reduce the missed detection rate.

Description

Technical Field

[0001] The present application relates to the technical field of video surveillance equipment detection, and in particular to a method and electronic equipment for detecting video surveillance equipment. Background Art

[0002] In recent years, the market has become increasingly rife with miniature cameras, which are now in large quantities and in widespread use. Cases of voyeuristic video recording in private places like hotels are on the rise, drawing increasing attention from relevant national judicial and law enforcement departments. Currently, most of these cameras are internet protocol cameras (IPCs), supporting networking and storage capabilities, with over 90% connecting to wireless fidelity (Wi-Fi) networks. Surveillance footage can be uploaded to the cloud for real-time storage or viewed by users via monitoring applications (APPs), leading to potential privacy violations.

[0003] Currently, specialized detection equipment is commercially available. These devices primarily utilize optical, thermal, and electromagnetic principles to inspect IPC devices. For example, they use a flashlight to illuminate the surrounding area and observe for reflective spots; a thermal imager to scan the surrounding area for localized hot spots; and a video scanner to scan the 50MHz-3GHz frequency band for devices operating in this band. However, these specialized detection devices are relatively expensive, and the hardware used is difficult to integrate into mobile phones. Furthermore, they often require users to actively search and detect throughout the desired area, resulting in a less user-friendly experience. Furthermore, in common scenarios, environmental interference from reflections, heat, and electromagnetic waves is high, resulting in high false detection and missed detection rates.

[0004] To address these issues, some internet companies have introduced camera detection features in their apps. These typically scan and detect other devices within the local area network to which the phone is connected to obtain device information. However, these detection methods are relatively simple, and the fingerprint databases they maintain are incomplete or not updated in a timely manner, resulting in many missed detections. Furthermore, actual testing has shown that these detection features are unstable, with the number of detected devices fluctuating widely and a high rate of missed detections. Summary of the Invention

[0005] The method and electronic device for detecting video surveillance equipment provided by this application can improve detection accuracy and reduce the missed detection rate. The scenarios to which the technical solution of this application is applicable can be places such as hotel lobbies and rooms. The electronic device of this application can effectively detect maliciously installed hidden camera IPCs in such places, thereby reducing the occurrence of user privacy violations.

[0006] In a first aspect, a method for detecting a video surveillance device is provided, which is applied to an electronic device and includes: obtaining media access control MAC address information of at least one target device, wherein the electronic device and the target device are connected to the same wireless network; obtaining port information of the target device; determining whether the target device is a video surveillance device based on the MAC address information; if it cannot be determined that the target device is the video surveillance device based on the MAC address information, determining whether the target device is the video surveillance device based on first information, wherein the first information includes the MAC address information and the port information, or the first information includes the port information; if it cannot be determined that the target device is the video surveillance device based on the first information, obtaining fingerprint information of the target device based on a TCP port detection protocol or a UDP port detection protocol; and determining whether the target device is the video surveillance device based on the fingerprint information.

[0007] The solution provided by the present application determines whether the target device is a video surveillance device by obtaining the MAC address information / port information of the target device connected to the same wireless network, and obtaining the fingerprint information of the target device based on the detection protocol of the TCP port or UDP port according to different situations. The technical solution of the present application is aimed at the various types of video surveillance devices on the market, and uses a variety of detection methods including MAC address information, port information, and detection protocols based on TCP ports or UDP ports, providing a more comprehensive detection solution, effectively improving the detection accuracy and reducing the missed detection rate. The scenarios to which the technical solution of the present application is applicable can be hotel lobbies, rooms and other places. The use of the electronic equipment of the present application can effectively detect maliciously installed sneak shots IPCs in such places, thereby reducing the occurrence of user privacy violations.

[0008] In combination with the first aspect, in some possible implementations, determining whether the target device is a video surveillance device based on the MAC address information includes: if the MAC address information is first-level MAC address information, determining that the target device is the video surveillance device; if the MAC address information is not first-level MAC address information, it is impossible to determine that the target device is the video surveillance device.

[0009] The solution provided in this application can save the time of electronic devices detecting IPC devices and improve detection efficiency by determining whether the MAC address information of the acquired target device is the first-level MAC address information and identifying whether the target device is an IPC device.

[0010] In combination with the first aspect, in some possible implementations, determining whether the target device is the video surveillance device based on the first information includes: if the port information is first-level port information, determining that the target device is the video surveillance device; if the port information is second-level port information and the MAC address information is second-level MAC address information, determining that the target device is the video surveillance device.

[0011] The solution provided in this application identifies whether the target device is an IPC device through the port information of the target device, or the port information combined with the MAC address information. It can further quickly identify the IPC based on the port and MAC information, saving the time of electronic equipment in detecting IPC devices while improving the comprehensiveness of detection.

[0012] With reference to the first aspect, in some possible implementations, obtaining fingerprint information of the target device using a TCP port-based detection protocol includes:

[0013] Determining the TCP port-based detection protocol according to the port information;

[0014] Sending a detection message to the target device based on the determined detection protocol;

[0015] receiving a response message from the target device;

[0016] Extract fingerprint information of the target device according to the response message.

[0017] The solution provided in this application can further ensure the accuracy of the acquired information and effectively improve the detection accuracy by determining the corresponding detection protocol based on the port information, sending the corresponding detection message, and then extracting the fingerprint information from the received response message.

[0018] In combination with the first aspect, in some possible implementations, the TCP port-based detection protocol includes one or more protocols of web protocol / hypertext transfer protocol Http, domain name system DNS protocol, Telnet protocol, text transfer protocol FTP, and real-time streaming protocol RTSP.

[0019] With reference to the first aspect, in some possible implementations, obtaining the fingerprint information of the target device using the UDP port-based detection protocol includes:

[0020] According to the preset detection protocol list, send the corresponding UDP detection message to the address and port corresponding to each detection protocol;

[0021] Receive a response message returned by the target device on the corresponding monitoring port;

[0022] Extract fingerprint information of the target device according to the response message.

[0023] The solution provided in this application can further ensure the accuracy of the obtained information by sending corresponding UDP detection messages to the addresses and ports corresponding to each detection protocol according to the preset detection protocol list, receiving response messages on the corresponding listening port, and then extracting fingerprint information from the received response messages, thereby effectively improving the detection accuracy.

[0024] In combination with the first aspect, in some possible implementations, the UDP port-based detection protocol includes one or more protocols including the Open Network Video Interface Forum ONVIF protocol, the Multicast Domain Name System MDNS protocol, the Session Initiation Protocol SIP, the Domain Name System DNS protocol, and a private protocol.

[0025] With reference to the first aspect, in some possible implementations, the fingerprint information of the target device includes one or more of the following information:

[0026] The target device includes the device type, device manufacturer information, IP address, MAC address, port status, port number, port service type, applications running on the port, device operating system, and service capabilities supported by the device.

[0027] In conjunction with the first aspect, in some possible implementations, the method further includes:

[0028] Acquire auxiliary information of the target device, wherein the auxiliary information includes one or more of the following information: location information, a Wireless Fidelity Service Set Identifier (Wi-Fi SSID), or a Wi-Fi name;

[0029] Determine whether the target device is a video surveillance device according to the fingerprint information and the auxiliary information.

[0030] The solution provided in this application can improve the accuracy of detection by jointly determining whether the target device is a video surveillance device based on the acquired fingerprint information and auxiliary information.

[0031] In conjunction with the first aspect, in some possible implementations, the method further includes:

[0032] If no video surveillance device is detected under the currently connected first wireless access point AP, switch to the second wireless access point AP under the wireless network;

[0033] Determine whether at least one target device connected to the second AP is the video surveillance device.

[0034] The solution provided by this application is that if the electronic device does not detect the video surveillance device under the first AP currently connected, it switches to the second AP under the wireless network to continue identifying the video surveillance device, which can improve the comprehensiveness of detection.

[0035] In a second aspect, a method for detecting video surveillance equipment is provided, which is applied to electronic devices and includes: obtaining media access control MAC address information of at least one target device, wherein the electronic device and the target device are connected to the same wireless network; determining whether the target device is a video surveillance device based on the MAC address information.

[0036] The solution provided in this application determines whether the target device is a video surveillance device through the MAC address information of the target device, which can save the time of electronic equipment in detecting IPC devices and improve detection efficiency.

[0037] In conjunction with the second aspect, in some possible implementations, determining whether the target device is a video surveillance device based on the MAC address information includes:

[0038] If the MAC address information is first-level MAC address information, determining that the target device is the video surveillance device;

[0039] If the MAC address information is not first-level MAC address information, it is impossible to determine that the target device is the video surveillance device.

[0040] In conjunction with the second aspect, in some possible implementations, the method further includes:

[0041] If it is impossible to determine that the target device is the video surveillance device based on the MAC address information, determine whether the target device is the video surveillance device based on the first information, wherein the first information includes the MAC address information and the port information, or the first information includes the port information, and the port information is obtained based on the status of the port.

[0042] The solution provided in this application is that if the electronic device cannot determine that the target device is a video surveillance device based on the MAC address information, further determination is made based on the first information, which can improve the accuracy of detection.

[0043] In conjunction with the second aspect, in some possible implementations, determining whether the target device is the video surveillance device according to the first information includes:

[0044] If the port information is first-level port information, determining that the target device is the video surveillance device;

[0045] If the port information is second-level port information, and the MAC address information is second-level MAC address information, it is determined that the target device is the video surveillance device.

[0046] In conjunction with the second aspect, in some possible implementations, the method further includes:

[0047] If it cannot be determined that the target device is the video surveillance device according to the first information, obtaining fingerprint information of the target device based on a TCP port detection protocol or a UDP port detection protocol;

[0048] Determine whether the target device is the video surveillance device according to the fingerprint information.

[0049] The solution provided in this application is that if the electronic device cannot determine that the target device is the video surveillance device based on the first information, it can further determine it based on the fingerprint information obtained by the detection protocol, which can improve the accuracy of the detection.

[0050] In conjunction with the second aspect, in some possible implementations, the method further includes:

[0051] If the target device cannot be determined to be the video surveillance device according to the MAC address information, obtaining the fingerprint information of the target device based on a TCP port detection protocol or a UDP port detection protocol;

[0052] Determine whether the target device is the video surveillance device according to the fingerprint information.

[0053] The solution provided by this application is to make a judgment based on the detection protocol if it is impossible to determine that the target device is a video surveillance device based on the MAC address information, thereby saving the time of the electronic device in detecting the IPC device and improving the efficiency of the detection.

[0054] In conjunction with the second aspect, in some possible implementations, the obtaining of fingerprint information of the target device by using a TCP port-based detection protocol includes:

[0055] Determining the TCP port-based detection protocol according to the port information;

[0056] Sending a detection message to the target device based on the determined detection protocol;

[0057] receiving a response message from the target device;

[0058] Extract fingerprint information of the target device according to the response message.

[0059] The solution provided in this application can further ensure the accuracy of the acquired information by determining the corresponding detection protocol based on the port information and sending the corresponding detection message, and then extracting the fingerprint information from the received response message, thereby effectively improving the detection accuracy.

[0060] In combination with the second aspect, in some possible implementations, the TCP port-based detection protocol includes one or more protocols including web protocol / hypertext transfer protocol Http, domain name system DNS protocol, Telnet protocol, text transfer protocol FTP protocol, and real-time streaming protocol RTSP protocol.

[0061] In conjunction with the second aspect, in some possible implementations, the UDP port-based detection protocol obtains the fingerprint information of the target device, including:

[0062] According to the preset detection protocol list, send the corresponding UDP detection message to the address and port corresponding to each detection protocol;

[0063] Receive a response message returned by the target device on the corresponding monitoring port;

[0064] The fingerprint information of the target device is extracted according to the response message.

[0065] The solution provided in this application can further ensure the accuracy of the obtained information by sending corresponding UDP detection messages to the addresses and ports corresponding to each detection protocol according to the preset detection protocol list, receiving response messages on the corresponding listening port, and then extracting fingerprint information from the received response messages, thereby effectively improving the detection accuracy.

[0066] In combination with the second aspect, in some possible implementations, the UDP port-based detection protocol includes one or more protocols including the Open Network Video Interface Forum ONVIF protocol, the Multicast Domain Name System MDNS protocol, the Session Initiation Protocol SIP protocol, the Domain Name System DNS protocol, and a private protocol.

[0067] With reference to the second aspect, in some possible implementations, the fingerprint information of the target device includes one or more of the following information:

[0068] The target device includes the device type, device manufacturer information, IP address, MAC address, port status, port number, port service type, applications running on the port, device operating system, and service capabilities supported by the device.

[0069] In conjunction with the second aspect, in some possible implementations, the method further includes:

[0070] Acquire auxiliary information of the target device, wherein the auxiliary information includes one or more of the following information: location information, a Wireless Fidelity Service Set Identifier (Wi-Fi SSID), or a Wi-Fi name;

[0071] Determine whether the target device is a video surveillance device according to the fingerprint information and the auxiliary information.

[0072] The solution provided in this application can improve the accuracy of detection by jointly determining whether the target device is a video surveillance device based on the acquired fingerprint information and auxiliary information.

[0073] In conjunction with the second aspect, in some possible implementations, the method further includes:

[0074] If no video surveillance device is detected under the currently connected first wireless access point AP, switch to the second wireless access point AP under the wireless network;

[0075] Determine whether at least one target device connected to the second AP is the video surveillance device.

[0076] The solution provided by this application is that if the electronic device does not detect the video surveillance device under the first AP currently connected, it switches to the second AP under the wireless network to continue identifying the video surveillance device, which can improve the comprehensiveness of detection.

[0077] In a third aspect, a method for detecting video surveillance equipment is provided, which is applied to electronic devices and includes: obtaining fingerprint information of at least one target device based on a detection protocol of a UDP port, wherein the electronic device and the target device are connected to the same wireless network; determining whether the target device is a video surveillance device based on the fingerprint information.

[0078] The technical solution provided by this application obtains the device fingerprint information of the target device through a UDP port-based detection protocol and matches the acquired device fingerprint information with a preset fingerprint information database to determine whether the detected target device is an IPC device. This technical solution can effectively improve the efficiency of IPC device detection while reducing costs.

[0079] In conjunction with the third aspect, in some possible implementations, before obtaining device fingerprint information of at least one target device based on a UDP port detection protocol, the method further includes:

[0080] Obtaining media access control MAC address information of the target device;

[0081] If the MAC address information is first-level MAC address information, determining that the target device is a video surveillance device;

[0082] If the MAC address information is not first-level MAC address information, it cannot be determined that the target device is a video surveillance device;

[0083] If it cannot be determined that the target device is a video surveillance device based on the MAC address information, the device fingerprint information of the target device is obtained based on the detection protocol of the UDP port.

[0084] The solution provided by this application allows electronic devices to perform a priori judgment based on the acquired MAC address information before determining that the target device is a video surveillance device based on a UDP port-based detection protocol. If the target device can be determined to be a video surveillance device based on the MAC address information, then the judgment based on the detection protocol is not required. If the target device cannot be determined to be a video surveillance device based on the MAC address information, then the judgment based on the detection protocol is performed, thus saving the electronic device time in detecting IPC devices and improving detection efficiency.

[0085] In conjunction with the third aspect, in some possible implementations, the acquiring of fingerprint information of at least one target device by the UDP port-based detection protocol includes:

[0086] According to the preset detection protocol list, send the corresponding UDP detection message to the address and port corresponding to each detection protocol;

[0087] Receive a response message returned by the target device on the corresponding monitoring port;

[0088] Extract fingerprint information of the target device according to the response message.

[0089] In conjunction with the third aspect, in some possible implementations, the UDP port-based detection protocol includes one or more of the following protocols:

[0090] Open Network Video Interface Forum ONVIF protocol, Multicast Domain Name System MDNS protocol, Session Initiation Protocol SIP, Domain Name System DNS protocol, and private protocols.

[0091] In conjunction with the third aspect, in some possible implementations, the fingerprint information of the target device includes one or more of the following information:

[0092] The target device includes the device type, device manufacturer information, IP address, MAC address, port status, port number, port service type, applications running on the port, device operating system, and service capabilities supported by the device.

[0093] In conjunction with the third aspect, in some possible implementations, the method further includes:

[0094] Acquire auxiliary information of the target device, wherein the auxiliary information includes one or more of the following information: location information, a Wireless Fidelity Service Set Identifier (Wi-Fi SSID), or a Wi-Fi name;

[0095] Determine whether the target device is a video surveillance device according to the fingerprint information and the auxiliary information.

[0096] In conjunction with the third aspect, in some possible implementations, the method further includes:

[0097] If no video surveillance device is detected under the currently connected first wireless access point AP, switch to the second wireless access point AP under the wireless network;

[0098] Determine whether at least one target device connected to the second AP is the video surveillance device.

[0099] The beneficial effects of other possible implementation methods of the third aspect can refer to the beneficial effects of the first aspect mentioned above, and will not be repeated here.

[0100] In a fourth aspect, a method for detecting a video surveillance device is provided, which is applied to an electronic device and includes: obtaining port information of at least one target device, wherein the electronic device and the target device are connected to the same wireless network; and determining whether the target device is a video surveillance device based on the port information.

[0101] The solution provided in this application determines whether the target device is a video surveillance device through the port information of the target device, which can save the time of electronic equipment in detecting IPC devices and improve detection efficiency.

[0102] In conjunction with the fourth aspect, in some possible implementations, determining whether the target device is a video surveillance device according to the port information includes:

[0103] If the port information is first-level port information, determining that the target device is a video surveillance device;

[0104] If the port information is not the first-level port information, it cannot be determined that the target device is a video surveillance device.

[0105] In conjunction with the fourth aspect, in some possible implementations, the method further includes:

[0106] If it cannot be determined that the target device is a video surveillance device based on the port information, determine whether the target device is a video surveillance device based on second information, where the second information includes MAC address information and the port information, or the second information includes the MAC address information, wherein the MAC address information is obtained through host discovery.

[0107] According to the solution provided by the present application, if the electronic device cannot determine that the target device is a video surveillance device based on the port information, further determination is made based on the second information, thereby improving the accuracy of detection.

[0108] In conjunction with the fourth aspect, in some possible implementations, determining whether the target device is a video surveillance device based on the second information includes:

[0109] If the MAC address information is first-level MAC address information, determining that the target device is the video surveillance device;

[0110] If the port information is second-level port information, and the MAC address information is second-level MAC address information, it is determined that the target device is the video surveillance device.

[0111] In conjunction with the fourth aspect, in some possible implementations, the method further includes:

[0112] If it cannot be determined that the target device is a video surveillance device according to the second information, obtaining fingerprint information of the target device based on a TCP port detection protocol or a UDP port detection protocol;

[0113] Determine whether the target device is the video surveillance device according to the fingerprint information.

[0114] The solution provided by the present application is that if the electronic device cannot determine that the target device is the video surveillance device based on the second information, it can further determine it based on the fingerprint information obtained by the detection protocol, which can improve the accuracy of the detection.

[0115] In conjunction with the fourth aspect, in some possible implementations, the obtaining of fingerprint information of the target device by using a TCP port-based detection protocol includes:

[0116] Determining the TCP port-based detection protocol according to the port information;

[0117] Sending a detection message to the target device based on the determined detection protocol;

[0118] receiving a response message from the target device;

[0119] Extract fingerprint information of the target device according to the response message.

[0120] In conjunction with the fourth aspect, in some possible implementations, the TCP port-based detection protocol includes one or more protocols selected from the group consisting of web / Http protocol, DNS protocol, Telnet protocol, FTP protocol, and RTSP protocol.

[0121] In conjunction with the fourth aspect, in some possible implementations, the UDP port-based detection protocol obtains the fingerprint information of the target device, including:

[0122] According to the preset detection protocol list, send the corresponding UDP detection message to the address and port corresponding to each detection protocol;

[0123] Receive a response message returned by the target device on the corresponding monitoring port;

[0124] Extract fingerprint information of the target device according to the response message.

[0125] In combination with the fourth aspect, in some possible implementations, the UDP port-based detection protocol includes one or more protocols selected from the group consisting of ONVIF protocol, MDNS protocol, SIP protocol, DNS protocol, and private protocols.

[0126] In conjunction with the fourth aspect, in some possible implementations, the fingerprint information of the target device includes one or more of the following information:

[0127] The target device includes the device type, device manufacturer information, IP address, MAC address, port status, port number, port service type, applications running on the port, device operating system, and service capabilities supported by the device.

[0128] In conjunction with the fourth aspect, in some possible implementations, the method further includes:

[0129] Acquire auxiliary information of the target device, wherein the auxiliary information includes one or more of the following information: location information, Wi-Fi SSID, or Wi-Fi name;

[0130] Determine whether the target device is a video surveillance device according to the fingerprint information and the auxiliary information.

[0131] In conjunction with the fourth aspect, in some possible implementations, the method further includes:

[0132] If no video surveillance device is detected under the currently connected first wireless access point AP, switch to the second wireless access point AP under the wireless network;

[0133] Determine whether at least one target device connected to the second AP is the video surveillance device.

[0134] The beneficial effects of other possible implementation methods of the fourth aspect can refer to the beneficial effects of the first aspect mentioned above, and will not be repeated here.

[0135] In a fifth aspect, a device is provided, which is included in an electronic device and has the function of implementing the electronic device behavior described in the above aspects and possible implementations of the above aspects. The functions can be implemented in hardware or by hardware executing corresponding software. The hardware or software includes one or more modules or units corresponding to the above functions.

[0136] In a sixth aspect, an electronic device is provided, comprising: one or more processors; a memory; one or more application programs; and one or more computer programs. The one or more computer programs are stored in the memory and include instructions. When the instructions are executed by the electronic device, the electronic device performs the method for detecting a video surveillance device described in any possible implementation of aspects 1 to 4 or any of aspects 1 to 4.

[0137] In the seventh aspect, a chip system is provided, comprising at least one processor. When program instructions are executed in the at least one processor, the function of the method for detecting video surveillance equipment in any possible implementation of the above-mentioned first to fourth aspects or the first to fourth aspects is implemented on the electronic device.

[0138] In an eighth aspect, a computer storage medium is provided, comprising computer instructions. When the computer instructions are executed on an electronic device, the electronic device executes the method for detecting a video surveillance device in any possible implementation of the first to fourth aspects or any one of the first to fourth aspects.

[0139] In the ninth aspect, a computer program product is provided. When the computer program product is run on an electronic device, the electronic device executes the method for detecting a video surveillance device in any possible design of the first to fourth aspects or the first to fourth aspects. BRIEF DESCRIPTION OF THE DRAWINGS

[0140] Figure 1 This is a schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present application.

[0141] Figure 2 This is a schematic diagram of the software structure of an electronic device provided in an embodiment of the present application.

[0142] Figure 3 This is a schematic diagram of a wireless communication system provided in an embodiment of the present application.

[0143] Figure 4 This is a schematic diagram of an augmented service set provided in an embodiment of the present application.

[0144] Figure 5 This is a schematic diagram of a set of GUIs provided in an embodiment of the present application.

[0145] Figure 6 This is a flow chart of an internal algorithm of a detection device provided in an embodiment of the present application.

[0146] Figure 7 This is a schematic diagram of a detection device provided in an embodiment of the present application interacting with a target device in an RTSP detection manner.

[0147] Figure 8 This is a schematic diagram of a detection device provided in an embodiment of the present application interacting with a target device in an ONVIF protocol detection manner.

[0148] Figure 9 This is a schematic diagram of a detection device provided by an embodiment of the present application interacting with a target device and a media server in a SIP protocol detection manner.

[0149] Figure 10 This is a schematic flowchart of another method for detecting video surveillance equipment provided in an embodiment of the present application.

[0150] Figure 11 This is a schematic block diagram of another electronic device provided in an embodiment of the present application.

[0151] Figure 12 This is a schematic block diagram of another electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0152] The terms used in the following embodiments are only for the purpose of describing specific embodiments and are not intended to limit the present application. As used in the specification of this application and the appended claims, the singular expressions "a", "an", "said", "above", "the" and "this" are intended to also include expressions such as "one or more", unless there is a clear contrary indication in the context. It should also be understood that in the following embodiments of the present application, "at least one", "one or more" refer to one, two or more. The term "and / or" is used to describe the association relationship of associated objects, indicating that three relationships can exist; for example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone, where A and B can be singular or plural. The character " / " generally indicates that the previous and subsequent associated objects are in an "or" relationship.

[0153] References to "one embodiment" or "some embodiments" in this specification mean that a particular feature, structure, or characteristic described in conjunction with that embodiment is included in one or more embodiments of the present application. Thus, phrases such as "in one embodiment," "in some embodiments," "in other embodiments," and "in yet other embodiments" appearing in various places in this specification do not necessarily refer to the same embodiment, but rather mean "one or more but not all embodiments," unless otherwise specifically emphasized. The terms "including," "comprising," "having," and variations thereof mean "including but not limited to," unless otherwise specifically emphasized.

[0154] In the following, the terms "first" and "second" are used for descriptive purposes only and should not be understood to indicate or imply relative importance or implicitly specify the quantity of the technical features indicated. Therefore, a feature specified as "first" or "second" may explicitly or implicitly include one or more of the features.

[0155] An embodiment of the present application provides a method for detecting video surveillance equipment. The method is applied to an electronic device, which obtains MAC address information / port information of a target device connected to the same wireless network, and obtains fingerprint information of the target device based on a detection protocol of a TCP port or a UDP port according to different situations, thereby determining whether the target device is a video surveillance device. The technical solution of the present application is aimed at the various types of video surveillance equipment on the market, and uses a variety of detection methods including MAC address information, port information, and detection protocols based on TCP ports or UDP ports, providing a more comprehensive detection solution, effectively improving detection accuracy and reducing missed detection rates. The scenarios to which the technical solution of the present application is applicable can be hotel lobbies, rooms and other places. The electronic device of the present application can effectively detect maliciously installed sneak camera IPCs in such places, thereby reducing the occurrence of user privacy violations. In addition, the method and electronic device provided by the present application can also be used to detect ordinary IPCs in home environments.

[0156] The method for detecting video surveillance equipment provided in the embodiments of the present application can be applied to electronic devices such as mobile phones, tablet computers, wearable devices, vehicle-mounted devices, augmented reality (AR) / virtual reality (VR) devices, laptop computers, ultra-mobile personal computers (UMPCs), netbooks, and personal digital assistants (PDAs). The embodiments of the present application do not impose any restrictions on the specific types of electronic devices.

[0157] For example, Figure 1 FIG1 shows a schematic diagram of the structure of the electronic device 100. The electronic device 100 may include a processor 110, an external memory interface 120, an internal memory 121, a universal serial bus (USB) interface 130, a charging management module 140, a power management module 141, a battery 142, an antenna 1, an antenna 2, a mobile communication module 150, a wireless communication module 160, an audio module 170, a speaker 170A, a receiver 170B, a microphone 170C, an earphone interface 170D, a sensor module 180, a compass 190, a motor 191, an indicator 192, a camera 193, a display 194, and a subscriber identification module (SIM) card interface 195.

[0158] It should be understood that the structures illustrated in the embodiments of the present application do not constitute a specific limitation on the electronic device 100. In other embodiments of the present application, the electronic device 100 may include more or fewer components than shown, or may combine or separate certain components, or arrange the components differently. The illustrated components may be implemented in hardware, software, or a combination of software and hardware.

[0159] The processor 110 may include one or more processing units, for example: the processor 110 may include an application processor (AP), a modem processor, a graphics processing unit (GPU), an image signal processor (ISP), a controller, a video codec, a digital signal processor (DSP), a baseband processor, and / or a neural-network processing unit (NPU), etc. Among them, different processing units can be independent components or integrated into one or more processors. Among them, the construction and sending of detection messages, the construction of a device fingerprint information library, the matching of the acquired device fingerprint information with the fingerprint information library to identify the IPC device, the switching of the wireless access point, etc. in the embodiment of the present application can all be completed by the processor 110.

[0160] The controller can generate operation control signals according to the instruction operation code and timing signal to complete the control of instruction fetching and execution.

[0161] In some other embodiments, the processor 110 may also be provided with a memory for storing instructions and data. For example, it may store information about certain IPC devices to form a fingerprint information library. For example, the memory in the processor 110 may be a cache memory. This memory can store instructions or data that the processor 110 has just used or is reusing. If the processor 110 needs to use the instruction or data again, it can directly call it from the memory. This avoids repeated accesses, reduces the waiting time of the processor 110, and thus improves the efficiency of the electronic device 101 in processing data or executing instructions.

[0162] In some embodiments, the processor 110 may include one or more interfaces. The interfaces may include an inter-integrated circuit (I2C) interface, an inter-integrated circuit sound (I2S) interface, a pulse code modulation (PCM) interface, a universal asynchronous receiver / transmitter (UART) interface, a mobile industry processor interface (MIPI), a general-purpose input / output (GPIO) interface, a SIM card interface, and / or a USB interface. Among them, the USB interface 130 is an interface that complies with the USB standard specification, and specifically can be a Mini USB interface, a Micro USB interface, a USB Type C interface, etc. The USB interface 130 can be used to connect a charger to charge the electronic device 100, and can also be used to transmit data between the electronic device 100 and peripheral devices. The USB interface 130 can also be used to connect headphones to play audio through the headphones.

[0163] It is understood that the interface connection relationship between the modules illustrated in the embodiments of the present application is merely an illustrative illustration and does not constitute a structural limitation on the electronic device 100. In other embodiments of the present application, the electronic device 100 may also adopt different interface connection methods from the above embodiments, or a combination of multiple interface connection methods.

[0164] The charging management module 140 is used to receive charging input from the charger. The charger can be a wireless charger or a wired charger. The power management module 141 is used to connect the battery 142, the charging management module 140 and the processor 110. The power management module 141 receives input from the battery 142 and / or the charging management module 140, and supplies power to the processor 110, the internal memory 121, the external memory, the display 194, the camera 193 and the wireless communication module 160. The power management module 141 can also be used to monitor parameters such as battery capacity, battery cycle number, battery health status (leakage, impedance), etc. In some other embodiments, the power management module 141 can also be set in the processor 110. In other embodiments, the power management module 141 and the charging management module 140 can also be set in the same device.

[0165] The wireless communication function of the electronic device 100 can be implemented through the antenna 1, the antenna 2, the mobile communication module 150, the wireless communication module 160, the modem processor, the baseband processor, and the like.

[0166] Antenna 1 and antenna 2 are used to transmit and receive electromagnetic wave signals. Each antenna in electronic device 100 can be used to cover a single or multiple communication frequency bands. Different antennas can also be reused to improve antenna utilization.

[0167] The mobile communication module 150 can provide solutions for wireless communications including 2G / 3G / 4G / 5G applied to the electronic device 100. The mobile communication module 150 may include at least one filter, a switch, a power amplifier, a low noise amplifier (LNA), etc. The mobile communication module 150 can receive electromagnetic waves from the antenna 1, and filter, amplify, and process the received electromagnetic waves, and transmit them to the modulation and demodulation processor for demodulation. The mobile communication module 150 can also amplify the signal modulated by the modulation and demodulation processor, and convert it into electromagnetic waves for radiation through the antenna 1. In some embodiments, at least some of the functional modules of the mobile communication module 150 can be set in the processor 110. In some embodiments, at least some of the functional modules of the mobile communication module 150 can be set in the same device as at least some of the modules of the processor 110.

[0168] The wireless communication module 160 can provide wireless communication solutions including wireless local area networks (WLAN) (such as wireless fidelity (Wi-Fi) networks), Bluetooth (BT), global navigation satellite system (GNSS), frequency modulation (FM), near field communication (NFC), infrared (IR), etc., which are applied to the electronic device 100. The wireless communication module 160 can be one or more devices that integrate at least one communication processing module. The wireless communication module 160 receives electromagnetic waves via the antenna 2, frequency modulates and filters the electromagnetic wave signals, and sends the processed signals to the processor 110. The wireless communication module 160 can also receive the signal to be sent from the processor 110, frequency modulate it, amplify it, and convert it into electromagnetic waves for radiation through the antenna 2.

[0169] Electronic device 100 implements display functionality through a GPU, display screen 194, and an application processor. A GPU is a microprocessor for image processing that connects display screen 194 and the application processor. The GPU is used to perform mathematical and geometric calculations for graphics rendering. Processor 110 may include one or more GPUs that execute program instructions to generate or modify display information.

[0170] Display screen 194 is used to display images, videos, and the like. Display screen 194 includes a display panel. The display panel can be a liquid crystal display (LCD), an organic light-emitting diode (OLED), an active-matrix organic light-emitting diode (AMOLED), a flexible light-emitting diode (FLED), a MiniLED, a MicroLED, a Micro-oLed, or a quantum dot light-emitting diode (QLED). In some embodiments, electronic device 100 may include one or more display screens 194.

[0171] In some embodiments of the present application, when the display panel adopts materials such as OLED, AMOLED, FLED, etc., the above Figure 1The display screen 194 in the embodiment can be bent. Here, the display screen 194 being bendable means that the display screen can be bent to any angle at any position and can be maintained at the angle.

[0172] Display screen 194 of electronic device 100 may be a flexible screen. Currently, flexible screens are attracting much attention for their unique characteristics and enormous potential. Compared to traditional screens, flexible screens are more flexible and bendable, providing users with new interaction methods based on their bendability, thereby meeting more user demands for electronic devices.

[0173] The electronic device 100 can implement a shooting function through an ISP, a camera 193, a video codec, a GPU, a display screen 194, and an application processor.

[0174] The ISP processes data fed back by camera 193. For example, when taking a photo, the shutter is opened, and light is transmitted through the lens to the camera's photosensitive element. The light signal is converted into an electrical signal, which is then passed to the ISP for processing and converted into a visible image. The ISP can also perform algorithmic optimization on image noise, brightness, and skin tone. It can also optimize parameters such as exposure and color temperature of the captured scene. In some embodiments, the ISP can be located within camera 193.

[0175] The camera 193 is used to capture still images or videos. The object generates an optical image through the lens and projects it onto the photosensitive element. The photosensitive element can be a charge coupled device (CCD) or a complementary metal-oxide-semiconductor (CMOS) phototransistor. The photosensitive element converts the light signal into an electrical signal, and then passes the electrical signal to the ISP for conversion into a digital image signal. The ISP outputs the digital image signal to the DSP for processing. The DSP converts the digital image signal into an image signal in a standard RGB, YUV or other format. In some embodiments, the electronic device 100 may include one or more cameras 193.

[0176] The digital signal processor is used to process digital signals. In addition to processing digital image signals, it can also process other digital signals. For example, when the electronic device 100 selects a frequency point, the digital signal processor is used to perform Fourier transform on the frequency point energy.

[0177] Video codecs are used to compress or decompress digital video. Electronic device 100 may support one or more video codecs. This allows electronic device 100 to play or record videos in various encoding formats, such as Moving Picture Experts Group (MPEG) 1, MPEG2, MPEG3, and MPEG4.

[0178] The NPU is a neural network (NN) computing processor. Drawing on the structure of biological neural networks, such as the transmission patterns between neurons in the human brain, it rapidly processes input information and can continuously self-learn. The NPU can enable intelligent cognitive applications in electronic device 100, such as image recognition, face recognition, speech recognition, and text comprehension.

[0179] The external memory interface 120 can be used to connect an external memory card, such as a Micro SD card, to expand the storage capacity of the electronic device 100. The external memory card communicates with the processor 110 via the external memory interface 120 to implement data storage functions. For example, files such as music and videos can be stored on the external memory card.

[0180] The internal memory 121 can be used to store one or more computer programs, which include instructions. The processor 110 can execute the above instructions stored in the internal memory 121, so that the electronic device 101 performs the method for controlling the volume provided in some embodiments of the present application, as well as various applications and data processing. The internal memory 121 may include a program storage area and a data storage area. The program storage area may store an operating system; the program storage area may also store one or more applications (such as a gallery, contacts, etc.). The data storage area may store data created during the use of the electronic device 101 (such as photos, contacts, etc.). In addition, the internal memory 121 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more disk storage components, a flash memory component, a universal flash storage (UFS), etc. In some embodiments, the processor 110 can execute the instructions stored in the internal memory 121 and / or the instructions stored in the memory provided in the processor 110, so that the electronic device 101 performs the method for controlling the volume provided in the embodiments of the present application, as well as other applications and data processing. The electronic device 100 can implement audio functions such as music playback and recording through the audio module 170, the speaker 170A, the receiver 170B, the microphone 170C, the headphone jack 170D, and the application processor.

[0181] The sensor module 180 may include a pressure sensor 180A, a gyroscope sensor 180B, an air pressure sensor 180C, a magnetic sensor 180D, an acceleration sensor 180E, a distance sensor 180F, a proximity light sensor 180G, a fingerprint sensor 180H, a temperature sensor 180J, a touch sensor 180K, an ambient light sensor 180L, a bone conduction sensor 180M, and the like.

[0182] The fingerprint sensor 180H is used to collect fingerprints. The electronic device 100 can use the collected fingerprint characteristics to implement fingerprint unlocking, access application locks, fingerprint photography, fingerprint call answering, etc.

[0183] The temperature sensor 180J is used to detect temperature. In some embodiments, the electronic device 100 uses the temperature detected by the temperature sensor 180J to execute a temperature processing strategy.

[0184] The touch sensor 180K is also called a "touch panel." The touch sensor 180K can be disposed on the display screen 194. The touch sensor 180K and the display screen 194 form a touch screen, also called a "touch screen." The touch sensor 180K is used to detect touch operations applied thereto or in the vicinity thereof. The touch sensor can transmit the detected touch operations to the application processor to determine the type of touch event. Visual output related to the touch operations can be provided via the display screen 194. In other embodiments, the touch sensor 180K can also be disposed on the surface of the electronic device 100, in a location different from that of the display screen 194.

[0185] Figure 2 1 is a block diagram of the software structure of the electronic device 100 according to an embodiment of the present application. The layered architecture divides the software into several layers, each with clear roles and division of labor. The layers communicate with each other through software interfaces. In some embodiments, the Android system is divided into four layers: the application layer, the application framework layer, the Android runtime environment (Android runtime) and system libraries, and the kernel layer. The application layer may include a series of application packages.

[0186] like Figure 2 As shown, the application package may include applications such as camera, gallery, calendar, call, map, navigation, WLAN, Bluetooth, music, video, and short message.

[0187] The application package may also include the first application application mentioned below.

[0188] The application framework layer provides an application programming interface (API) and a programming framework for the applications in the application layer. The application framework layer includes some predefined functions.

[0189] like Figure 2 As shown, the application framework layer may include a window manager, a content provider, a view system, a phone manager, a resource manager, a notification manager, and the like.

[0190] The window manager is used to manage window programs. The window manager can obtain the size of the display screen, determine whether there is a status bar, lock the screen, take screenshots, etc.

[0191] Content providers are used to store and retrieve data and make it accessible to applications. The data may include videos, images, audio, calls made and received, browsing history and bookmarks, phone books, etc.

[0192] The view system includes visual controls, such as those for displaying text and images. The view system is used to build applications. A display interface can consist of one or more views. For example, a display interface containing a text notification icon might include a view for displaying text and a view for displaying images.

[0193] The phone manager is used to provide communication functions of the electronic device 100, such as management of call status (including answering, hanging up, etc.).

[0194] The resource manager provides various resources for applications, such as localized strings, icons, images, layout files, video files, and so on.

[0195] The Notification Manager enables applications to display notification information in the status bar. It can be used to convey informational messages. It can stay for a short time and then disappear automatically without user interaction, or it can interact with the user to proceed to the next step. In this application, the Notification Manager can notify users of messages related to video surveillance equipment detection, etc.

[0196] The notification manager can also be a notification that appears in the system's top status bar in the form of an icon or scrolling text bar, such as a notification from an application running in the background, or a notification that appears on the screen in the form of a dialog window. For example, a text message appears in the status bar, a beep sounds, a vibration of an electronic device, a flashing indicator light, etc.

[0197] The system library may include multiple functional modules, such as a surface manager, media libraries, a 3D graphics processing library (e.g., OpenGL ES), and a 2D graphics engine (e.g., SGL).

[0198] The surface manager is used to manage the display subsystem and provide fusion of 2D and 3D layers for multiple applications.

[0199] The media library supports playback and recording of a variety of common audio and video formats, as well as static image files. The media library can support a variety of audio and video encoding formats, such as MPEG4, H.264, MP3, AAC, AMR, JPG, and PNG.

[0200] The 3D graphics processing library is used to implement 3D graphics drawing, image rendering, synthesis and layer processing.

[0201] A 2D graphics engine is a drawing engine for 2D drawings.

[0202] The kernel layer is the layer between hardware and software. The kernel layer includes at least display driver, camera driver, audio driver, and sensor driver.

[0203] The following describes the workflow of the software and hardware of the electronic device 100 in conjunction with the scenario of starting the first application.

[0204] When the touch sensor 180K receives a touch operation, the corresponding hardware interrupt is sent to the kernel layer. The kernel layer processes the touch operation into raw input events (including touch coordinates, timestamp of the touch operation, and other information). The raw input events are stored in the kernel layer. The application framework layer obtains the raw input event from the kernel layer and identifies the control corresponding to the input event. Taking the touch operation as a touch single-click operation, and the control corresponding to the single-click operation as the control of the first application icon as an example, the first application calls the interface of the application framework layer to start the first application, and then starts the Wi-Fi and other drivers by calling the kernel layer, and receives data from other electronic devices through the wireless communication module 160, such as Wi-Fi data from the target device.

[0205] In order to facilitate understanding of the solution of this application, the terms involved in this application are first explained below.

[0206] A wireless access point (AP) is the creator of a wireless network and the central node of the network. A wireless router used in a typical home or office can be considered an AP.

[0207] like Figure 3 FIG2 is a schematic diagram of a wireless communication system provided by an embodiment of the present application. A wireless communication system may generally include one or more wireless APs, one or more terminal devices, Figure 3The wireless communication system 300 includes a wireless AP 10, a terminal device 30, a terminal device 40, and a terminal device 50. In addition, the wireless communication system 300 also includes a server 20.

[0208] It should be understood that Figure 3 This is just a schematic diagram. The communication system may also include other network devices, such as core network devices, wireless relay devices and wireless backhaul devices. Figure 3 The embodiments of the present application do not limit the number of network devices and terminal devices included in the mobile communication system.

[0209] Station (STA): Each terminal device connected to a wireless AP can be called a station, for example Figure 3 The terminal device 30, the terminal device 40, the terminal device 50 or other terminal devices or user devices that can be connected to the network are shown in FIG.

[0210] Basic Service Set (BSS): The basic building block of an 802.11 local area network (LAN). STAs that can communicate wirelessly with each other form a BSS.

[0211] Extension service set (ESS): Multiple BSSs can form an extended network, called an ESS. This network can be understood as a larger virtual BSS formed by multiple BSSs using the same service set identifier (SSID). STAs within an ESS can communicate with each other.

[0212] like Figure 4 FIG. 4 is a schematic diagram of an ESS 400 provided in an embodiment of the present application. Figure 4 As shown, the ESS 400 is composed of two BSSs (BSS1 and BSS2).

[0213] SSID: This is the network identifier of an ESS. It can be understood as the Wi-Fi name that users search for using mobile phones or other networked devices. All APs in the same ESS must have the same SSID; otherwise, communication will be impossible.

[0214] Basic Service Set Identifier (BSSID): The identifier of a BSS, which is actually the media access control (MAC) address of the AP (router), used to identify the BSS managed by the AP.

[0215] An example illustrates the relationship between SSID and BSSID:

[0216] A large company has several wireless access points installed. Employees only need to know a single SSID to access the wireless network from anywhere within the company. The BSSID is essentially the MAC address of each wireless access point. While the SSID remains constant as employees move around the company, the BSSID changes constantly as they switch to different wireless access points.

[0217] If a router is installed in a home or other scenario, the router can form a wireless network.

[0218] For ease of understanding, the following examples of this application will be described with Figure 1 and Figure 2 Taking the mobile phone with the structure shown as an example, the method for detecting video surveillance equipment provided by the embodiment of the present application is specifically described in conjunction with the accompanying drawings.

[0219] Figure 5 A set of GUIs for a mobile phone is shown, where Figure 5 (a) to Figure 5 (e) in the figure shows that the mobile phone can detect whether there is an IPC device (ie, the camera in the figure) in the current space under the first application.

[0220] See also Figure 5 The GUI shown in (a) is the desktop of the mobile phone. When the mobile phone detects that the user clicks the icon 501 of the first application on the desktop, the first application can be started and the display will be as shown in FIG. Figure 5 The GUI shown in (b) can be called a detection interface.

[0221] See also Figure 5 In the GUI shown in (b), when the mobile phone detects that the user clicks the icon 502, the mobile phone can start to detect whether there is an IPC device in the current space and display the following Figure 5 The GUI shown in (c) in FIG.

[0222] See also Figure 5 The GUI shown in (c) is the interface of the mobile phone in the process of scanning. The 2% shown in the figure indicates that the detection progress of the mobile phone is 2% at this time. During the scan, the AP, Wi-Fi name, MAC address, device name and other information currently connected to the mobile phone can be displayed in real time.

[0223] If the mobile phone detection process is completed, it is detected that there is no IPC device in the current network space (which can be the local area network that the mobile phone is currently connected to), and "No camera found" may be displayed on the mobile phone interface. Figure 5The GUI shown in (d) in FIG.

[0224] If the mobile phone detection process is completed and the IPC device is detected in the current network space, the mobile phone interface will display "2 cameras found" and the detailed information of the detected video surveillance device (camera) can also be displayed, such as Figure 5 "Device 1" shown in (e): the name of the network it connects to is "A" and the MAC address information of the device is "AA:BB:CC:11:22:33", and "Device 2": the name of the network it connects to is "A" and the MAC address information of the device is "11:22:33:AA:BB:CC".

[0225] For the discovered camera, the first application suggests a detailed location. When the user clicks the device name or the corresponding control to the right of the device name, the selected camera can be further located.

[0226] It should be noted that the above process can also realize the detection of video surveillance equipment in the form of voice. For example, if the mobile phone detects that there is a video surveillance device in the current network space, it can remind the user in the form of voice playback that there is a video surveillance device in the current network space; if the mobile phone detects that there is no video surveillance device in the network space, it can remind the user in the form of voice playback that there is no video surveillance device in the current network space. The process is similar to Figure 5 The processes shown are basically the same, only the display formats are different, and for the sake of brevity, they will not be described here in detail.

[0227] In some embodiments, if the user's mobile phone is connected to the WIFI network of a hotel or guesthouse, the user can be prompted to open the first application to detect whether there is an IPC device in the current network space, and the detection result can be displayed or a voice prompt can be given to the user; or, if the user's mobile phone is connected to the WIFI network of a hotel or guesthouse, it can independently detect whether there is an IPC device in the current network space, and the detection result can be displayed or a voice prompt can be given to the user; this application does not limit how to start the first application for IPC detection.

[0228] The following is combined with Figure 6 The internal implementation process and judgment logic of the electronic device in the embodiment of the present application for determining whether an IPC device exists are introduced. In order to distinguish the function from the target device, the electronic device used to detect target devices such as IPC will be referred to as "detection device" below. Figure 6 The figure shows an internal algorithm flow chart of a detection device provided in an embodiment of the present application.

[0229] Example 1:

[0230] S710: The detection device obtains the MAC address information of the target device by using the host discovery process.

[0231] The embodiments of the present application utilize protocols within the Open System Interconnection model (OSI) for host discovery. Typically, the Address Resolution Protocol (ARP) in the data link layer or the Internet Control Message Protocol (ICMP) in the network layer is used to determine whether there are other surviving target devices (i.e., devices connected to the network and in normal working order) on the network to which it is connected. The Internet Protocol (IP) addresses of the surviving target devices are recorded. Alternatively, other protocols capable of implementing the ping function can be used to determine whether there are other surviving target devices. The ARP protocol is then used to obtain the MAC address corresponding to each target device.

[0232] S720: Match and identify the acquired MAC address information corresponding to each target device.

[0233] The detection device matches and identifies the MAC address corresponding to each acquired target device based on the MAC information database. The information in the MAC information database includes, but is not limited to, MAC identification information corresponding to WiFi vendors and their corresponding levels. The multiple MAC identification information included in the MAC information database can be classified into different levels based on different vendors, with different levels representing the probability that the corresponding device is an IPC device.

[0234] For example, the MAC addresses corresponding to manufacturers A and B can be classified as level 1, the MAC addresses corresponding to manufacturers C and D can be classified as level 2, and the MAC address corresponding to manufacturer E can be classified as level 3. The higher the level (such as level 1), the greater the probability that the device is an IPC device, and the lower the level (such as level 3), the lower the probability that the device is an IPC device. If the detection device obtains the MAC addresses of four target devices (target device 1, target device 2, target device 3, and target device 4), assuming that the MAC address of target device 1 matches the information in the specific MAC information library and is the MAC address corresponding to manufacturer A, the MAC addresses of target devices 2 and 3 are matched with the MAC addresses corresponding to manufacturer C and manufacturer D respectively, and the MAC address of target device 4 is matched with the MAC address corresponding to manufacturer E, then it can be determined that the level of target device 1 is level 1, which is very likely to be an IPC device. The detection device can notify the user that target device 1 is an IPC device, the levels of target devices 2 and 3 are level 2, and the level of target device 4 is level 3. Whether target devices 2-4 are IPC devices can wait for further confirmation.

[0235] The detection device matches the acquired MAC address with the information in the MAC information database and determines whether the target device is an IPC device. If it is determined that the target device is an IPC device, the user can be notified that an IPC device exists in the current space. If it is not determined whether the target device is an IPC device, other information (port information, information obtained by protocol detection based on TCP ports, information obtained by protocol detection based on UDP ports) can be used to further determine whether the target device is an IPC device.

[0236] S730: Obtain port information of the target device through port scanning and identify the port information.

[0237] The detection device can use Transmission Control Protocol (TCP) / User Datagram Protocol (UDP) port scanning to obtain the target device's port information. The detection device constructs a TCP probe message or UDP probe message and sends it to the target device. Then, based on the target device's response to the probe message, it determines whether the target device's port is open, thereby obtaining a list of open ports corresponding to the target device. For example, the detection device sends a TCP connection request to a certain port number of the target device. If the target device responds with an RST response, it confirms that the target device's port is closed. If it receives an acknowledgment character (ACK) response, the port is open.

[0238] The port list can be a fixed number of ports based on common protocol types, for example, the number of ports can be set based on TCP or UDP; or the port list can be a dynamic port list that is updated based on each / all previous detection results. The port list can be updated and scanned in the following ways:

[0239] 1) You can decide whether to adjust the port list based on the results of previous (preset number of) tests

[0240] The detection device can retain the service port numbers of the IPC devices that are frequently used or open each time it detects, and delete the remaining port numbers to update the port list; alternatively, the detection device can update the port list based on the number of detections, the detection duration, and the number of detected IPCs. For example, if the detection duration exceeds a certain threshold or the number of target devices to be detected exceeds a certain threshold, the port list will be refreshed, such as by deleting less frequently used ports.

[0241] 2) Adjust port scanning strategy

[0242] The detection device can prioritize the ports in the port list, such as high priority and low priority (which can be defined based on expert experience or dynamically adjusted based on previous detection results), scan the high priority ports at least once, and scan the low priority ports once or randomly sample them.

[0243] After obtaining the port information of the target device, the detection device matches the port information of the target device with the port information in the port information library to further identify whether the target device is an IPC device. The port information in the port information library includes but is not limited to port numbers related to video transmission. Similarly, the multiple port information in the port information library can also be divided into different levels according to the port number, and different levels represent the probability that the corresponding device is an IPC device. For example, the port can be divided into level 1, level 2, level 3, etc. according to a port number or a combination of multiple port numbers. The higher the level (such as level 1), the greater the probability that the device is an IPC device, and the lower the level (such as level 3), the smaller the probability that the device is an IPC device.

[0244] Assume that the port information in the port information database includes three types of port information: X, Y, and Z. Among them, the port information of type X is divided into level 1 port information, for example, the port information of type X includes the port number X1; the port information of type Y is divided into level 2 port information, for example, the port information of type Y includes the port numbers or combinations of port numbers such as Y1, Y2+Y3, Y2+Y4+Y5; and the port information of type Z is divided into level 3 ports, for example, the port information of type Z includes the port numbers or combinations of port numbers such as Z1, Z2+Z5.

[0245] Continuing with the example of the detection device obtaining the MAC addresses of target devices 1-4 in S720, if the port number of target device 2 is X1, and after matching this port number with the port information in the port information library and determining that target device 2 includes level 1 port information, it can be determined that target device 2 is an IPC device, and the detection device can notify the user that target device 2 is an IPC device. If the port numbers of target devices 3 and 4 are Y1 and Y2+Y3, respectively, and after matching with the port information in the port information library and determining that both target devices 3 and 4 include level 2 port information, whether target devices 3 and 4 are IPC devices can be further identified in subsequent step S740 based on the MAC address information, or further identified through protocol detection in subsequent steps S750 or S760.

[0246] In some embodiments, after obtaining the port information, the port openness of the corresponding target device can be determined. Furthermore, version detection can be used to determine the specific application and version information running on the open port; or operating system (OS) detection can be used to detect the type of operating system running on the target device and the type of the target device. This information can then be used as one or more types of device fingerprint information, combined with previously obtained device fingerprint information such as MAC and port information, to determine whether the corresponding device is an IPC device.

[0247] S740: Identify the IPC device using the port information and the MAC address information.

[0248] In some embodiments, the MAC address information and the port information may be combined to identify whether the target device is an IPC device. If the port information cannot be used to determine whether the target device is an IPC device, the port information and the MAC address may be further used to determine whether the target device is an IPC device.

[0249] Still taking the example of the detection device obtaining the MAC addresses of target devices 1-4 in S720, in the above step S730, target device 3 and target device 4 both include level 2 port information. Since the probability of devices belonging to this level being IPC devices is relatively high, target device 3 and target device 4 are likely to be IPC devices. Further, the MAC address information of the target devices can be combined to make a judgment. In the above step S720, the MAC address information of target device 3 is matched to a level 2 MAC address in the specific MAC information library, and the MAC address information of target device 4 is matched to a level 3 MAC address. Since the MAC address information and port information of target device 2 are both level 2, it can be determined that target device 3 is an IPC device, and the detection device can notify the user that target device 3 is an IPC device.

[0250] Through the above steps S710 to S740, the detection device identifies that target device 1, target device 2 and target device 3 are all IPC devices. Regarding target device 4, it can be further identified based on the information obtained by the TCP port-based detection protocol and / or the UDP port-based detection protocol in step S750 or S760.

[0251] S750 obtains device fingerprint information based on the TCP port detection protocol and matches it with the constructed device fingerprint information database to further identify the IPC device.

[0252] Among them, the TCP port-based detection protocol may include one or more of the Web protocol / hypertext transfer protocol (Http), domain name system (DNS) protocol, Telnet protocol, file transfer protocol (FTP), and real-time streaming protocol (RTSP).

[0253] Specifically, for each target device, its corresponding open port list can be obtained according to the above step S730. If the open port list includes the first port corresponding to the Telnet protocol (such as port 23), the Telnet detection method is used, that is, a Telnet detection request is sent to the first port of the target device, and the response message returned is waited for. If the open port list includes the second port corresponding to the FTP protocol (such as port 21), the FTP detection method is used, that is, an FTP detection request is sent to the second port of the target device, and the response message returned is waited for. If the open port list includes the third port corresponding to the RTSP protocol (such as port 554), the RTSP detection method is used, that is, an RTSP detection request is sent to the third port of the target device. SP detection request, and wait for the return response message; if the open port list includes the fourth port corresponding to the DNS protocol (such as port 53), the DNS detection method is used (it is also possible not to determine whether the fourth port exists, but to use this method directly), that is, a DNS reverse query request is sent to the router AP or other DNS server of the network to which the detection device is connected, and the return response message is waited for; if the open port list includes the fifth port corresponding to the Http protocol (such as port 80, port 81, port 8000, etc.) or the list includes other ports, the Web / Http detection method is used, that is, an HTTP detection request (such as GET or POST) is sent to the first port of the target device, and the return response message is waited for.

[0254] If the detection device receives a response message based on the various TCP-based protocol detection methods described above, it processes the corresponding response message according to the corresponding fingerprint extraction method to determine whether there is valid fingerprint information that can match the fingerprint library. A fingerprint library can be set for each detection method, a fingerprint library can be set for multiple detection methods, or a fingerprint library can be set for all detection methods. If valid fingerprint information exists, the target device is confirmed to be an IPC device. Otherwise, further judgment is required through other methods (such as subsequent step S760).

[0255] For example, the method of obtaining device fingerprint information by RTSP detection is used as an example for description. Please see below for details.

[0256] RTSP is a text-based application layer protocol. Generally, RTSP itself is not used to transmit streaming media data, but rather to control streaming media (such as play, pause, etc.). The request messages provided by this protocol include methods such as available method query (OPTIONS), media initialization / session description (DESCRIBE), session creation (SETUP), playback (PLAY), recording (RECORD), update session description (ANNOUNCE), redirect server (REDIRECT), and obtain parameter information (GET_PARAMETER).

[0257] Among them, the above-mentioned OPTIONS, DESCRIBE, SETUP, ANNOUNCE, REDIRECT and GET_PARAMETER can represent the following meanings:

[0258] OPTIONS: Either end can send this message to obtain a list of methods supported by the other end.

[0259] DESCRIBE: Sent by the client, it can be used to obtain the media description information specified by the URL, such as IP, media type + port + transport protocol, etc., which can generally be described using the SDP protocol.

[0260] SETUP: Sent by the client, it can be used to negotiate the transmission method (such as real-time transport protocol (RTP), unicast, port), establish an RTSP session (and also change the transmission parameters of the media stream being played).

[0261] ANNOUNCE: Optional. If sent by the server, it can be used to update the session description in real time. If sent by the client, it can be used to submit the media description information specified by the URL to the server.

[0262] REDIRECT: Sent by the server, this command can be used to tell the client to connect to another server location. The command carries the URL of the new destination. If the client wants to continue sending or receiving media streams, it can disconnect from the original server (teardown) and then establish a connection with the new server (setup).

[0263] GET_PARAMETER: Optional, can be sent by either end, and can be used to obtain the media stream parameter value specified by the URL (requires a session ID and may require authentication). The command without a body can be used to test whether the peer end is alive.

[0264] This embodiment primarily utilizes the REDIRECT and SETUP methods defined in the RTSP protocol. The detection device acts as a protocol-defined server, sending corresponding detection messages to other devices connected to the AP (which can be the target device determined in the previous step). Upon receiving the corresponding response message, the device fingerprint information is extracted, and then the target device is determined to be an IPC device based on the constructed device fingerprint library. Furthermore, the detection device can determine whether there are other undetected APs in the network. If so, the detection is continued after switching from the current AP to the next AP.

[0265] Specifically, the detection device obtains the target device fingerprint information by RTSP detection. Figure 7 The interaction diagram between the detection device and the target device is described in detail. Figure 7 The process may include steps S910-S918.

[0266] S910: Obtain the URLs of other devices under the current AP, and respectively construct REDIRECT requests for reconnecting to other servers.

[0267] The other devices described in this step can be target devices obtained through the host discovery process described in step S710 above, or can be target devices obtained through the port scanning process described in step S730 above with specific ports (such as 554) open.

[0268] The URL in this step can be obtained based on the device's IP address, open ports, and the RTSP service address naming rules of mainstream IPC manufacturers, or according to the device discovery process of the Open Network Video Interface Forum (ONVIF) protocol, the media capability / media stream URL acquisition process, etc. The embodiments of this application do not limit the method for obtaining the above URL.

[0269] S911. The detection device sends a REDIRECT request to the target device.

[0270] As described above, the REDIRECT request can be used to tell the target device to connect to another server location. The command can carry the URL of the new target. If the target device wants to continue sending or receiving media streams, it can disconnect from the original server and then establish a connection with the new server.

[0271] S912: The target device sends a message to the detection device, where the message indicates that the target device is disconnected from the original server.

[0272] The message may be a TEARDOWN message, which includes information such as the original server URL and the original session identifier.

[0273] S913: The detection device sends a response message to the target device.

[0274] The response message may be 200 OK, which is used to indicate that the target device has received a message that it is disconnected from the original server.

[0275] S914: The target device sends a message to the detection device, where the message instructs the target device to connect to the new server.

[0276] The message may be a SETUP message, which includes the new server URL, the type of transmission protocol for transmitting the media stream, the sending method, the sending port, and other information.

[0277] S915: The detection device sends a response message to the target device.

[0278] The response message may be 200ok, which may include the new session identifier and information such as the transmission protocol type, sending method, and sending port for transmitting the media stream negotiated by both parties, indicating that the target device has received the message that it is connected to the new server.

[0279] Optionally, the detection device may further obtain streaming media information of the target device, such as address port, media type, transmission protocol, etc., by the method described in steps S916-S917 or steps S918-S919.

[0280] S916: The detection device sends a GET_PARAMETER message to the target device.

[0281] As described above, the GET_PARAMETER message can be used to obtain the media stream parameter value specified by the URL of the target device (a session ID and possibly authentication are required).

[0282] S917: The target device sends a response message to the detection device.

[0283] The response message may be 200 ok, which may include streaming media information of the target device, etc.

[0284] S918: The target device sends an ANNOUNCE message to the detection device.

[0285] As described above, the ANNOUNCE message can enable the target device to submit the media description information specified by the URL to the detection device when sending.

[0286] S919: The detection device sends a response message to the target device.

[0287] The response message may be 200 OK, which indicates that the streaming media information of the target device has been received.

[0288] It should be noted that the purpose of the above steps S916 and S917, S918 and S919 is to obtain the streaming media information of the target device. Therefore, steps S916-S917 and steps S918-S919 can exist at the same time or separately. That is, the detection device can obtain the streaming media information of the target device through steps S916-S917, or obtain the streaming media information of the target device through steps S918-S919, or obtain the streaming media information of the target device through steps S916-S917 and steps S918-S919. This application does not limit this.

[0289] S920: The detection device obtains other auxiliary information.

[0290] The auxiliary information may be global positioning system (GPS) location information, WIFI SSID, or name (such as xxx hotel) of the detected target device.

[0291] S921. The detection device extracts device fingerprint information based on the acquired information, matches the fingerprint information, and determines whether the target device is a video surveillance device.

[0292] In this manner, the extracted device fingerprint information may include: the type of target device, transmission protocol type, sending method, IP address, supported media types, etc.

[0293] In specific implementation, matching can be performed based on the following methods.

[0294] (1) Matching based on keywords

[0295] Specifically, the device fingerprint information library may include but is not limited to: device type information, which may be, for example, keywords such as IPC, IPCam (also known as IP network camera), camera, network video transmitter (Network Video Transmitter), or other information that characterizes the device type; MAC information, which may be a MAC (first half of the field) list, a MAC manufacturer list, etc.; IP information, which may be an IP list, a related location or a network area, etc.; port information, which may be a port number list, a corresponding port service type list; transmission protocol type information, media type information, etc.

[0296] Assuming that the device type information of the target device detected through the above steps includes keyword information such as camera, it can be confirmed that the target device is an IPC device; or, if the MAC address of the target device detected through the above steps corresponds to a specific manufacturer, it can be confirmed that the detected target device is an IPC device; or, if the port information of the target device detected through the above steps includes a specific port (such as port 554), it can be confirmed that the detected target device is an IPC device; or, if the protocol type of the target device detected through the above steps is a video-related protocol, such as ONVIF protocol or GB / T 28181 / session initiation protocol (SIP), or the supported transmission protocol is a streaming media-specific transmission protocol, such as RTP, etc., it can be confirmed that the detected target device is an IPC device.

[0297] (2) Matching based on similarity calculation

[0298] The similarity calculation method may include but is not limited to one or more of the following methods: cosine similarity, Pearson correlation coefficient, Jaccard correlation coefficient, mutual information / information gain, etc.

[0299] Taking cosine similarity as an example, we can evaluate the similarity between two vectors by calculating the cosine of the angle between them. Cosine similarity plots the vectors into a vector space based on their coordinate values.

[0300] The similarity between two vectors can be determined based on the cosine of the angle between them. When the cosine of the angle between two vectors is 1, it means that the two vectors have the same direction and are highly similar; when the cosine of the angle between two vectors is 0, it means that the two vectors are independent; when the cosine of the angle between two vectors is -1, it means that the two vectors have opposite directions and are extremely similar or can be considered completely dissimilar.

[0301] The cosine value between two vectors can be calculated using formula (1):

[0302]

[0303] The device fingerprint information of the target device mentioned above can be used as a component of A. For example, the type information of the detected target device can be A1, the MAC information of the detected target device can be A2, etc. The device fingerprint information library mentioned above can be used as a component of B. For example, the device type information can be B1, the MAC information can be B2, etc.

[0304] (3) Matching based on distance calculation

[0305] The distance calculation method may include but is not limited to one or more of the following methods: Euclidean distance, Mahalanobis distance, Manhattan distance, Chebyshev distance, Hamming distance, etc.

[0306] Let's take Euclidean distance as an example. Euclidean distance (also known as the Euclidean metric or Euclidean distance) is a commonly used distance definition, referring to the actual distance between two points in n-dimensional space. In two-dimensional and three-dimensional space, the Euclidean distance is the actual distance between two points.

[0307] The Euclidean distance (hereinafter denoted as ρ) can be calculated based on the following formula (2):

[0308]

[0309] Among them, the device fingerprint information of the target device mentioned above can be used as a component of x, for example, the type information of the detected target device can be x1, the MAC information of the detected target device can be x2,... and so on; the device fingerprint information library mentioned above can be used as a component of y, for example, the device type information can be y1, the MAC information can be y2,... and so on.

[0310] Specifically, an n-dimensional coordinate system can be created first. The coordinates of the target device and the detection device can be drawn in this n-dimensional coordinate system, and their Euclidean distance can be calculated using the above formula (2). The calculated Euclidean distance is used to determine whether the detected target device is an IPC device.

[0311] (4) Matching based on the weighted superposition of multiple features

[0312] Weights can be assigned to different features. For example, the weight of keyword matching is w1, the weight of MAC matching is w2, the weight of IP matching is w3, the weight of port matching is w4, and so on.

[0313] Specifically, each feature of the target device can be matched, and then the matching degree of each feature can be multiplied by the corresponding weight and added together. If the resulting value is greater than or equal to a preset threshold, the target device can be considered an IPC device and a corresponding risk warning will be given (such as text, image, or voice prompts through the user interface). Otherwise, it can be considered not to be an IPC device. Of course, certain weight limits can also be set, such as certain keywords, certain MAC information, and certain port information can have a weight of 100%.

[0314] For example, assuming the preset threshold is 100, the authentication value of the target device is obtained by weighted summing up the multiple features of the target device. If the authentication value is greater than or equal to 100, the target device can be considered to be an IPC device, and the user is prompted that there are risky devices around; if the authentication value is less than the preset threshold 100, the target device can be considered not to be an IPC device.

[0315] (5) Matching based on the constructed algorithm model

[0316] Specifically, a test sample can be constructed using device fingerprint information, and then inference judgment can be performed on the sample using machine learning (ML) and / or deep learning (DL) algorithm models. The ML algorithm model or DL ​​algorithm model can be trained based on a large number of positive and negative sample sets.

[0317] For example, the heartbeat data of the IPC device interacting with the server in the connected but non-live broadcast state is used as a positive sample for feature extraction (such as heartbeat cycle / frequency, heartbeat duration, number of heartbeats in a specific period, target address, and other features), and the data of the IPC device interacting with the outside in other states or non-IPC devices is used as a negative sample for feature extraction, and then algorithm training is performed; for another example, the data of the IPC device interacting with the server in the connected and live broadcast state is used as a positive sample for feature extraction, and the data of the IPC device interacting with the outside in other states or non-IPC devices is used as a negative sample for feature extraction, and then algorithm training is performed.

[0318] S922: The detection device displays the judgment result to the user. If the current network also uses other APs, the BSSID is switched to connect to other APs.

[0319] After performing fingerprint matching in the above manner to determine whether the target device is an IPC device, the judgment result can be displayed to the user. For example, as mentioned above, if the detected target device is an IPC device, a risk warning can be given to the user, as mentioned above. Figure 5 The text displayed in (e) is "2 cameras found"; if the target device detected is not an IPC device, the user can also be prompted that the current surrounding environment is risk-free, as described above Figure 5 The text displayed in (d) is "No camera found".

[0320] In addition, when the detection device switches BSSID to connect to other APs, it can obtain the corresponding SSID, BSSID list, signal strength and other information under the network through system services (such as Android system's WIFI management). The detection device can sort the BSSID according to signal strength, SSID and other information.

[0321] It should be noted that in this step, whether to switch the BSSID can also be determined based on the detection results of the above steps S910-S921. For example, if the above steps do not detect the IPC device, the BSSID can be switched to continue detection, otherwise no switch is performed.

[0322] In some embodiments, the detection device can also obtain target information based on the acquisition method list process defined by RSTP, that is, sending an OPTIONS command, mainly to determine whether the target device on the other end responds to which methods / commands it supports, thereby determining whether it is an IPC device; or, obtain target information based on the parameter acquisition process defined by RTSP, that is, sending a GET_PARAMETER command to test whether the target device on the other end is alive, thereby determining whether it is an IPC device.

[0323] S760 obtains device fingerprint information based on the UDP port detection protocol and matches it with the constructed device fingerprint information database to further identify the IPC device.

[0324] It should be noted that the execution of step S760 is not a prerequisite for the execution of steps S720-S750. S760 can be executed directly after S710, that is, the UDP port detection protocol is used to obtain device fingerprint information after the host discovery process; or, after the MAC address information is identified in S720, the UDP port detection protocol in S760 is executed to obtain device fingerprint information (see Example 2 for details); and the execution order of step S750 and the above-mentioned step S760 is also no particular order. In some embodiments, step S730 can be executed first, and step S750 is executed after the port information of the target device is obtained and the identification is completed. After the device fingerprint information is obtained based on the TCP port detection protocol, step S760 is executed, and the device fingerprint information is obtained using the UDP port detection protocol; in other embodiments, step S730 can be executed first, and step S760 is executed after the port information of the target device is obtained and the identification is completed, and then step S750 is executed.

[0325] Among them, the detection protocols based on UDP ports include but are not limited to ONVIF protocol, multicast domain name system (MDNS) protocol (including MDNS of the Physical Security Interoperability Alliance (PSIA) protocol), session initiation protocol (SIP) (including SIP of GB / T 28181 protocol), domain name system (DNS) protocol, and private protocols.

[0326] Specifically, according to the preset multicast detection protocol list (such as ONVIF detection protocol, MDNS detection protocol, SIP detection protocol, COAP detection protocol, private SDK detection protocol, etc.), a corresponding UDP detection message is sent to the multicast address and port corresponding to each multicast detection protocol (such as the multicast address corresponding to ONVIF is 239:255:255:250, the port is 3702, the multicast address corresponding to MDNS is 224.0.0.251, the port is 5353, etc.), and the corresponding listening port is used to wait for the response message returned by the target device to extract the device fingerprint information of the target device; and / or, according to the preset broadcast detection protocol list (such as private SDK detection protocol), a corresponding UDP detection message is sent to the broadcast address and port corresponding to each broadcast detection protocol (such as the broadcast address corresponding to private SDK protocol 1 is IP1, the port is P1, the broadcast address corresponding to private SDK protocol 2 is IP2, the port is P2, etc.), and the corresponding listening port is used to wait for the response message returned by the target device to extract the device fingerprint information of the target device.

[0327] If a response message returned by the target device is received on the listening port corresponding to each multicast or broadcast detection protocol, the corresponding response message is processed (device fingerprint information is extracted) according to the device fingerprint extraction method corresponding to the multicast or broadcast detection protocol, and matching is performed according to the corresponding matching method, for example, according to a preset fingerprint library (a fingerprint library can be set for each detection method, a fingerprint library can be set for multiple detection methods, or a fingerprint library can be set for all detection methods) and corresponding matching rules (such as matching specific keywords, specific MAC information, specific ports, etc.). If there is matching valid fingerprint information, it is confirmed that the target device sending the response message is an IPC device; otherwise, it is not an IPC device.

[0328] It should be noted that if the detection device receives a response message from a target device other than the target device discovered in step S710 above, and then extracts device fingerprint information based on the response message and successfully matches it as an IPC device, step S710 can be executed again. In other words, step S710 can be further executed for the newly discovered other target device to obtain the MAC address information of the other target device to help further locate the other target device. Of course, the MAC address information can also be used as the identification operation in step S720 above. This is not limited here.

[0329] S770, merge the detection results.

[0330] This step can combine the results of the identification and detection in steps S710 to S760. For example, in step S720, target device 1 is identified as an IPC device based on the MAC address information, in step S730, target device 2 is identified as an IPC device based on the port information, in step S740, target device 3 is identified as an IPC device based on the MAC information and port information, and in step S750, target device 4 is determined to be an IPC device based on the device fingerprint information obtained based on the TCP port detection protocol or in step S760, target device 4 is determined to be an IPC device. Based on the above judgment results, the identified IPC devices are combined into one category.

[0331] In some embodiments, after identifying target device 1, target device 2, and target device 3 as IPC devices based on the above steps S710-S740, in order to ensure the accuracy of identification, it is also possible to continue to determine whether target device 1, target device 2, target device 3, and target device 4 are IPC devices according to step S750 or step S760, and merge the identification results.

[0332] It should be noted that in the embodiment of the present application, after excluding the identified IPC devices, steps S730, S750, or S760 may perform corresponding detection and judgment on the remaining target devices whose identity has not yet been determined. Of course, it is also possible to not exclude the identified IPC devices and instead perform corresponding detection and judgment on all target devices discovered in step S710.

[0333] The detection device may obtain device fingerprint information according to at least two of the multiple detection protocols described in S750 and S760 above.

[0334] Example 1:

[0335] Device fingerprint information 1 can be obtained according to the RTSP protocol, and device fingerprint information 2 can be obtained according to the ONVIF protocol or the SIP protocol. Then, device fingerprint information 1 and device fingerprint information 2 are merged and deduplicated to generate new device fingerprint information. Then, the new device fingerprint information is matched to determine whether an IPC device exists.

[0336] Specifically, the detection device can first perform the above Figure 7 Steps S910-S919 in the above example are used to obtain the target device's fingerprint information 1, and then Figure 8 Steps S1010-S1016 in the above example are used to obtain the target device's device fingerprint information 2, or alternatively, the target device's fingerprint information 2 may be obtained by executing Figure 9 Steps S1110-S1113 in the above embodiment are used to obtain the device fingerprint information 2 of the target device. The above device fingerprint information 1 or 2 may be composed of multiple or multiple types of fingerprint information.

[0337] After obtaining device fingerprint information 1 and device fingerprint information 2 in different ways, the information can be merged and deduplicated to generate new device fingerprint information, and then the new device fingerprint information can be matched to determine whether the target device is an IPC device.

[0338] Assume that device fingerprint information 1 includes the target device's IP and MAC address information and its corresponding manufacturer, the corresponding port information and its status (open, closed, or filtered, etc.), the corresponding service type, the application running on the port and its version, the target device's operating system, and the target device type; and device fingerprint information 2 includes the target device's IP address, device type, device service range, and MAC address information, as well as the target device's profile and streaming capabilities. The detection device can then remove the IP address, device type, and MAC address from device fingerprint information 2, merge the remaining information, and then match the new device fingerprint information to determine whether the target device is an IPC device.

[0339] By obtaining the device fingerprint information of the target device through different detection protocols, and merging and deduplicating the device fingerprint information of the target device obtained separately to obtain new device fingerprint information, the correctness of the information can be further guaranteed and the accuracy of IPC device detection can be improved.

[0340] Example 2:

[0341] The detection device can combine the session initialization process based on the GB / T 28181 protocol with the redirection server process of the RTSP protocol to obtain device fingerprint information; then match the device fingerprint information to determine whether an IPC device exists.

[0342] For example, the detection device can obtain the device fingerprint information of the target device based on the combination of the session initialization process of the GB / T 28181 protocol and the redirection server process of the RTSP protocol. Figure 9 Steps S1110-S1115 in the above procedure obtain the device fingerprint information 1 of the target device, and then execute Figure 7 Steps S910-S919 in the process are performed so that the target device is disconnected from the original server and reconnected to the new server, and then the device fingerprint information 2 of the target device is obtained. Then, the obtained device fingerprint information is merged and matched to determine whether the target device is an IPC device.

[0343] By combining the session initialization process based on the GB / T 28181 protocol with the redirection server process of the RTSP protocol to obtain the device fingerprint information of the target device, the correctness of the obtained fingerprint information can be further guaranteed, thereby improving the accuracy of IPC device detection.

[0344] In addition, the embodiments of the present application do not limit the execution order of steps S710-S740. For example, step S710 can be executed first to complete the host discovery and obtain other online / surviving target devices in this network, and then a port scan can be performed to obtain a list of open ports for each target device. Then, steps S720 and S740 can be executed in sequence, or steps S740 and S720 can be executed in sequence, or steps S720 or S740 can be skipped directly and then subsequent steps S750 or S760 can be executed.

[0345] In an embodiment of the present application, considering that in some scenarios the IPC device may not be arranged in the room where the user of the detection device is located, for example, the IPC is arranged in the next room or corridor, etc., then such scenarios may not cause trouble or risk to the user's privacy, so the risks of the detected IPC devices can be further filtered to achieve a more refined assessment. For example, channel state information (CSI) data and received signal strength indicator (RSSI) data can be obtained for each detected IPC device, and then the obtained CSI and RSSI data can be used to determine whether to filter out the IPC device (for example, if the amount of CSI data is less than a certain threshold or the RSSI strength value is lower than a certain threshold, the IPC device is discarded). The above CSI and RSSI data can be used to a certain extent to characterize the distance between the detection mobile phone and the IPC device, or whether there are obstacles such as walls between the two, or whether the APs to which the two are connected belong to different channels, etc.

[0346] The solution provided in this application integrates host discovery, port scanning, TCP port-based detection protocols, UDP port-based detection protocols, and corresponding device fingerprint extraction and matching methods to identify IPC devices. Compared to existing solutions that use optical, thermal, and electromagnetic wave detection equipment to detect IPC devices, the solution of this embodiment can effectively help users detect maliciously installed hidden camera IPCs in places such as hotels while reducing costs, improving the accuracy of IPC device detection, and thus reducing the incidence of user privacy violations.

[0347] Example 2:

[0348] In Example 2 of the present application, based on the UDP port detection protocol, the detection device can act as a client or server defined by the protocol, using multicast or broadcast methods to publish messages to target devices on the same wireless network using a fixed multicast or broadcast address and port. Therefore, the detection device does not need to use detection methods such as host discovery, port scanning, or TCP port-based detection protocols. It can directly obtain the device fingerprint information of the target device based on the UDP port detection protocol and determine whether the target device is a video surveillance device.

[0349] It is understandable that before obtaining the fingerprint information of the target device based on the UDP port detection protocol to judge the target device, the MAC address information of the target device can also be obtained first. Please refer to the description of S710-S720 for details. If the MAC address information cannot be used to determine that the target device is a video surveillance device, the fingerprint information obtained by the UDP port detection protocol can be further used to judge the target device. This solution can further improve the detection accuracy.

[0350] The UDP port-based detection protocol includes, but is not limited to, one or more of the ONVIF detection protocol, the PSIA / MDNS protocol, the GB / T28181 protocol, the DNS protocol, and a private protocol.

[0351] The following takes ONVIF protocol as an example, combined with Figure 8 The interaction process between the detection device and the target device shown in the figure provides a detailed description of obtaining device fingerprint information based on the ONVIF protocol.

[0352] ONVIF (Open Network Video Interface Forum) is an international forum for developing open network interface standards for network video products. The forum develops industry-wide ONVIF standards based on open and transparent principles. These standards define a common protocol for exchanging information between network video devices, including device discovery, live video, audio, metadata, and control information.

[0353] The embodiment of this application mainly utilizes the device discovery process (WS-Discovery), service capability acquisition process (GetServiceCapabilities, optional step), and media stream URI acquisition process (GetStreamUri, optional step) defined by the ONVIF protocol. The detection device sends corresponding detection messages to other devices under the AP (which can be the target device determined based on the previous steps). After receiving the corresponding response message, the device fingerprint information is extracted, and then the target device is judged based on the constructed device fingerprint information to determine whether there is an IPC device. In addition, it can also determine whether there are other APs under the network that have not been detected. If so, the above detection is continued after switching from the current AP to the next AP.

[0354] The above-mentioned device discovery process (WS-discovery) is that the client uses multicast to publish Probe messages, which include Types, service Scopes and Xaddrs (device management service address), etc. After the target device (IPC) confirms the match, it responds to the Probe Match message using unicast, which includes Types, Scopes and Xaddrs. The above-mentioned acquisition of service capabilities (GetServiceCapabilities) is to obtain the functions and services supported by the target device, which may include: Profile capabilities, such as the total number of supported static and dynamic media profiles, whether screenshots / rotations / video source mode switching / OSD configuration / mask configuration are supported, etc.; media stream (Streaming) capabilities, such as whether the RTSP media stream protocol is supported, whether UDP multicast is supported, whether RTP / RTSP / TCP transmission is supported, etc. The above-mentioned acquisition of media stream URL process (GetStreamUri) is to use the target device IP address to obtain its media stream URL (this URL can be used in the above-mentioned Figure 7 The RTSP protocol detection method shown can also be used as a device fingerprint, etc.).

[0355] Figure 8 The process includes steps S1010-S1060.

[0356] S1010: The detection device constructs a detection message and sends it out in a multicast manner under the current AP.

[0357] The detection device may construct a probe message, which may include the target device type, service range, and management service address of the target device, etc. The probe message may be a Probe request message defined in the device discovery process of the ONVIF protocol.

[0358] Multicast, also known as groupcast, can be a "one-to-many" method, meaning the detection device uses multicast to send the above-mentioned detection message to a specific multicast address and port, thereby sending the detection message to all target devices in the network at once. The multicast address and port can be 239.255.255.250:3702.

[0359] S1011. The target device receives a detection message.

[0360] In step S1010, the detection device sends a probe message via multicast, and multiple devices may receive the probe message. If some of the devices support the device discovery mechanism of the ONVIF protocol (that is, they can parse the above-mentioned Probe message), they will respond to the probe message. Then these devices are the target devices in this application.

[0361] S1012: The target device sends a response message to the detection device.

[0362] The response message may include the target device's IP address, device type, device service range, and MAC address information, etc. The response message may be a Probe Match message defined in the device discovery process of the ONVIF protocol.

[0363] It should be noted that in the embodiment of the present application, the target device may send a response message to the detection device via unicast or multicast, without limitation.

[0364] The unicast mode may be a "one-to-one" mode, that is, one device may send a message to another target device at a time.

[0365] Based on this, the detection device can obtain the fingerprint device information of the target device, and then match the fingerprint device information with the fingerprint library to determine whether the detected target device is an IPC device.

[0366] Optionally, in order to further improve the accuracy of the judgment, the detection device can obtain the service capability information and media stream information of the target device through the above-mentioned service capability acquisition process and media stream URL acquisition process, which can be achieved through steps S1013-S1016.

[0367] S1013: The detection device sends a service capability acquisition request message to the target device.

[0368] The obtain service capability request message may include information such as the IP address of the target device, and the request message may be a GetServiceCapability Request defined in the obtain service capability process of the ONVIF protocol.

[0369] S1014: The target device sends service capability related information to the detection device.

[0370] For example, the service capability related information may include profile capabilities, that is, whether the target device supports screenshot, rotation, video mode switching, object sequence diagram (OSD) configuration, mask configuration, etc. This information can be obtained through the GetServiceCapability Response defined in the ONVIF protocol's Get Service Capability process.

[0371] S1015: The detection device sends a request message for obtaining a media stream URL to the target device.

[0372] The Get Media Stream URL request message may include information such as the IP address of the target device, etc. The request message may be a GetStreamUri Request defined in the Get Media Stream URL procedure of the ONVIF protocol.

[0373] S1016: The target device sends media stream related information to the detection device.

[0374] For example, the media stream related information may include streaming capabilities, that is, whether the target device supports the RTSP media streaming protocol, whether it supports UDP multicast, whether it supports RTP or RTSP or TCP transmission, etc. This information can be obtained through the GetStreamUri Response defined in the ONVIF protocol's Get Media Stream URL process.

[0375] S1017. The detection device obtains other auxiliary information.

[0376] The auxiliary information may be the GPS location information, WIFI SSID or name (such as xxx hotel) of the detected target device.

[0377] S1018. The detection device extracts device fingerprint information based on the acquired information, matches the fingerprint information, and determines whether the target device is a video surveillance device.

[0378] S1019. The detection device displays the judgment result to the user. If the current network also uses other APs, the BSSID is switched to connect to other APs.

[0379] For instructions on steps S1017-S1019, please refer to Figure 7 The description of steps S920-S922 in FIG. 1 is omitted here for brevity.

[0380] The following takes the transmission channel negotiation protocol GB / T 28181 as an example, combined with Figure 9 The interaction process between the detection device, the media server, and the target device shown in the figure provides a detailed description of obtaining device fingerprint information based on the GB / T 28181 protocol.

[0381] GB / T 28181 protocol includes the SIP signaling control protocol and the RTP / RTCP protocol. The SIP protocol defines various SIP signaling protocols, such as Invite, ACK, BAY, OPTIONS, and Message. The format description protocols for SIP signaling include the Session Description Protocol (SDP), the Monitoring and Alarming Network System Control Description Protocol (MANSCDP), and the Monitoring and Alarming Network System Real-time Streaming Protocol (MANSRTSP).

[0382] SIP can be used to establish sessions between devices and transmit system control commands. Among them, session negotiation and media negotiation in session establishment between devices can use SDP as the format protocol of SIP signaling; IPC device control, device information query and status information reporting can use MANSCDP as the format protocol of SIP signaling; play, pause or disconnect in playback can use MAN SRTSP as the format protocol of SIP signaling.

[0383] The session initialization (Invite) process is the first step in real-time on-demand, playback, and download services. It mainly involves the SIP server establishing a session between the media server and the media sender (IPC) and negotiating the media transmission method, so that the IPC can transmit media stream data to the media server. It then establishes a session between the media server and the media receiver (user device, such as a mobile phone or other electronic device) and negotiates the media transmission method, so that the media server can transmit media stream data to the receiver.

[0384] This embodiment primarily utilizes the session initialization process defined in the SIP signaling protocol in GB / T 28181. The detection device sends corresponding probe messages to other devices connected to the AP. Upon receiving the corresponding response messages, the device fingerprint is extracted. Based on the constructed device fingerprint, the detection device determines whether an IPC device exists in the target device. Furthermore, the detection device can determine whether there are other undetected APs in the network. If so, the detection is continued by switching from the current AP to the next AP.

[0385] Specifically, the following Figure 9 For detailed description, the Figure 9 The process may include steps S1110-S1116.

[0386] S1110. The detection device obtains the IP, port, media format, etc. of the media server.

[0387] The detection device can initiate a session initialization request (such as an Invite request) to the media server. After receiving the session initialization request, the media server can send a 200 success response message to the detection device. The message can include the SDP message body of the media server, such as the media server IP, port, and media format. Alternatively, the detection device can also construct an invite message to be sent to the target device based on the maintained media server list, which can include the media server IP, port, and media format.

[0388] S1111. The detection device initiates a session initialization process to the target device.

[0389] The detection device can initiate a session initiation request to the target device to obtain the SDP message body of the target device, which may include the IP, port, media format, synchronization source (SSRC) and media parameters of the target device.

[0390] S1112. The target device sends a response message to the detection device.

[0391] After the detection device initiates the session initialization process, the target device may respond to it. The target device may send a response message to the detection device. The message may include information such as the target device's IP, port, media format, SSRC, and media parameters.

[0392] S1113. The detection device sends an ACK to the target device.

[0393] The ACK may indicate that the detecting device has received the final response of the target device to the session initialization request.

[0394] S1114. The detection device obtains other auxiliary information.

[0395] S1115. The detection device extracts device fingerprint information based on the acquired information, matches the fingerprint information, and determines whether the target device is a video surveillance device.

[0396] S1116. The detection device displays the judgment result to the user. If there are other APs in the current network, the BSSID is switched to connect to other APs.

[0397] For instructions on steps S1114-S1116, please refer to Figure 7 The description of steps S920-S922 in FIG. 1 is omitted here for brevity.

[0398] The technical solution provided in Example 2 of this application obtains the device fingerprint information of the target device through a UDP port-based detection protocol, and matches the obtained device fingerprint information with a preset fingerprint information database to determine whether the detected target device is an IPC device. This technical solution can effectively improve the detection efficiency of IPC devices while reducing costs.

[0399] The following describes a process of a method for detecting video surveillance equipment provided by this application.

[0400] See Figure 10 , Figure 10 A schematic flow chart of a method 1200 for detecting a video surveillance device is shown. The devices involved in the flow chart of the method include an electronic device 100 and a video surveillance device. The video surveillance device can be the above-mentioned Figure 5 The camera shown in .

[0401] like Figure 10 As shown, the method 1200 may include:

[0402] S1210: Acquire media access control (MAC) address information of at least one target device, where the electronic device and the target device are connected to the same wireless network.

[0403] In the embodiment of the present application, the MAC address information of at least one target device can be obtained by utilizing the host discovery process. For details, please refer to the content of the above step S710.

[0404] S1212: Obtain port information of the target device.

[0405] In the embodiment of the present application, port scanning can be used to obtain the port information of the target device. For details, please refer to the content of the above step S730.

[0406] S1214: Determine whether the target device is a video surveillance device according to the MAC address information.

[0407] In this step, the MAC address information is used to determine whether the target device is a video surveillance device. The MAC address information of the target device can be matched with the information in the MAC information database to identify the video surveillance device. For details, please refer to the description of step S720 above and will not be repeated here.

[0408] S1216. If it cannot be determined that the target device is the video surveillance device based on the MAC address information, determine whether the target device is the video surveillance device based on the first information, wherein the first information includes the MAC address information and the port information, or the first information includes the port information.

[0409] In this embodiment of the present application, if the MAC address information cannot be used to determine whether the target device is a video surveillance device, the first information (MAC address information and port information, or port information) can be used to further determine whether the target device is a video surveillance device. For details, please refer to the above step S740 and will not be repeated here.

[0410] It should be noted that in the embodiments of the present application, the serial numbers of the above steps do not represent the order of execution. In some embodiments, they can be executed in the order of S1210, S1214, S1212, and S1216 without limitation.

[0411] S1218: If it cannot be determined that the target device is the video surveillance device according to the first information, obtain fingerprint information of the target device based on a TCP port detection protocol or a UDP port detection protocol.

[0412] The fingerprint information in the embodiment of the present application may be the device fingerprint information in step S750 and / or step S760, and the device fingerprint information may include one or more of the following information of the target device: device type of the target device, device manufacturer information, port status, port number, application running on the port, port service type, running operating system, whether video mode switching or OSD configuration is supported, supported transmission protocol type, media format, sending method, service range, IP address, and MAC address.

[0413] The TCP port-based detection protocol may be the protocol involved in step S750 , such as one or more of Web protocol / Http, DNS protocol, Telnet protocol, FTP, and RTSP.

[0414] The UDP port-based detection protocol may be one or more of the protocols involved in step S760: ONVIF detection protocol, MDNS protocol, SIP, DNS protocol, and private protocol.

[0415] S1220: Determine whether the target device is the video surveillance device according to the device fingerprint information.

[0416] In this step, whether the target device is a video surveillance device is determined based on the fingerprint information. Whether the target device is the video surveillance device can be determined based on the fingerprint information according to a matching rule.

[0417] The matching rules may include keyword matching, similarity calculation, distance calculation, preset model, and feature vector matching. The specific matching process can refer to the content of step S921 above, and will not be repeated here for the sake of brevity.

[0418] S1222: Acquire auxiliary information of the target device, where the auxiliary information includes one or more of the following information: location information, Wi-Fi SSID, or Wi-Fi name.

[0419] S1224: Determine whether the target device is a video surveillance device according to the fingerprint information and the auxiliary information.

[0420] In the embodiment of the present application, the determination of whether the target device is a video surveillance device based on the fingerprint information and the auxiliary information can refer to the above Figure 7 Alternatively, you can refer to the steps S920-S921 above. Figure 8 Steps S1017-S1018, or refer to the above Figure 9 The contents of steps S1114-S1115 in .

[0421] S1226: If no video surveillance device is detected under the currently connected first wireless access point AP, switch to a second wireless access point AP under the wireless network.

[0422] S1228: Determine whether at least one target device connected to the second AP is the video surveillance device.

[0423] The solution provided by the present application determines whether the target device is a video surveillance device by obtaining the MAC address information / port information of the target device connected to the same wireless network, and obtaining the fingerprint information of the target device based on the detection protocol of the TCP port or UDP port according to different situations. The technical solution of the present application is aimed at the various types of video surveillance devices on the market, and uses a variety of detection methods including MAC address information, port information, and detection protocols based on TCP ports or UDP ports, providing a more comprehensive detection solution, effectively improving the detection accuracy and reducing the missed detection rate. The scenarios to which the technical solution of the present application is applicable can be hotel lobbies, rooms and other places. The use of the electronic equipment of the present application can effectively detect maliciously installed sneak shots IPCs in such places, thereby reducing the occurrence of user privacy violations.

[0424] In addition, in some embodiments, some of the above steps may also be performed. For example, the UDP port-based detection protocol in step S1218 may be executed to obtain fingerprint information of at least one target device, and then step S1220 may be executed to determine whether the target device is a video surveillance device based on the fingerprint information.

[0425] Alternatively, step S1210 can be executed first to obtain the media access control MAC address information of at least one target device, and then step S1214 can be executed to determine whether the target device is a video surveillance device based on the MAC address information. If it cannot be determined that the target device is a video surveillance device based on the MAC address information, step S1218 can be executed to obtain fingerprint information of at least one target device based on the UDP port detection protocol, and step S1220 can be executed to determine whether the target device is a video surveillance device based on the fingerprint information.

[0426] Alternatively, S1218 can be executed directly after executing steps S1210, S1212, and S1214. If the target device cannot be determined to be a video surveillance device based on the MAC address information, the fingerprint information of the target device can be obtained based on the TCP port detection protocol, thus omitting the logic of determining based on the port information. It is even possible to directly execute the TCP port detection protocol in S1218 to obtain the fingerprint information of the target device after executing step S1212.

[0427] Alternatively, steps S1222-S1224 or S1226-S1228 may be omitted.

[0428] In addition, in some embodiments, some of the above steps may be swapped. For example, step S1212 may be executed to obtain port information of at least one target device, and then similarly to S1214, whether the target device is a video surveillance device is determined based on the port information. Then, step S1210 may be executed to obtain the MAC address information of the target device. Similarly to S1216, when it is impossible to determine whether the target device is a video surveillance device based on the port information, whether the target device is a video surveillance device is determined in combination with the MAC information. Finally, step S1218 and subsequent steps may be executed.

[0429] The solution provided by this application obtains the device fingerprint information of the target device through a UDP port-based detection protocol and matches the acquired device fingerprint information with a preset fingerprint information database to determine whether the detected target device is an IPC device. This technical solution can effectively improve the efficiency of IPC device detection while reducing costs.

[0430] It is understandable that, in order to implement the above functions, the electronic device (such as the first electronic device mentioned above) includes hardware and / or software modules corresponding to the execution of each function. In combination with the algorithm steps of each example described in the embodiments disclosed herein, the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application in combination with the embodiments, but such implementation should not be considered to be beyond the scope of this application.

[0431] In this embodiment, the electronic device can be divided into functional modules according to the above-mentioned method example. For example, each functional module can be divided according to each function, or two or more functions can be integrated into a single processing module. The above-mentioned integrated modules can be implemented in the form of hardware. It should be noted that the module division in this embodiment is illustrative and is only a logical functional division. In actual implementation, other division methods may be used.

[0432] In the case of dividing each functional module into corresponding functional modules, Figure 11 A possible schematic diagram of the electronic device 1120 involved in the above embodiment is shown. Figure 11 As shown, the electronic device 1120 may include: an acquiring unit 1121 , a determining unit 1122 and a switching unit 1123 .

[0433] The acquisition unit 1121 may be used to support the electronic device 1120 in executing the above steps S1210 , S1212 , S1218 , S1222 , etc., and / or other processes for the technology described herein.

[0434] The determining unit 1122 may be configured to support the electronic device 1120 in executing the aforementioned steps S1214 , S1216 , S1220 , S1224 , S1228 , etc., and / or other processes for the technology described herein.

[0435] The switching unit 1123 may be configured to support the electronic device 1120 in executing the above-mentioned step S1226 and / or other processes of the technology described herein.

[0436] It should be noted that all relevant contents of each step involved in the above method embodiment can be referred to the functional description of the corresponding functional module and will not be repeated here.

[0437] The electronic device provided in this embodiment is used to execute the above positioning method, and thus can achieve the same effect as the above implementation method.

[0438] When integrated units are used, the electronic device may include a processing module, a storage module, and a communication module. The processing module may be used to control and manage the operation of the electronic device. For example, it may be used to support the electronic device in executing the steps performed by the aforementioned units. The storage module may be used to support the electronic device in executing and storing program code and data. The communication module may be used to support communication between the electronic device and other devices.

[0439] The processing module may be a processor or a controller. It may implement or execute the various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of this application. The processor may also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of digital signal processing (DSP) and a microprocessor, and so on. The storage module may be a memory. The communication module may specifically be a device that interacts with other electronic devices, such as a radio frequency circuit, a Bluetooth chip, or a Wi-Fi chip.

[0440] In one embodiment, when the processing module is a processor and the storage module is a memory, the electronic device involved in this embodiment may be a Figure 1 Device with the structure shown.

[0441] Figure 12 Another possible schematic diagram of the electronic device 1230 involved in the above embodiment is shown. Figure 12 As shown, the electronic device 1230 may include a communication unit 1231 , an input unit 1232 , a processing unit 1233 , an output unit 1234 , a peripheral interface 1235 , a storage unit 1236 , and a power supply 1237 .

[0442] The communication unit 1231 is used to establish a communication channel, allowing the electronic device 1230 to connect to a remote server through the communication channel and download media data from the remote server. The communication unit 1231 may include communication modules such as a WLAN module, a Bluetooth module, an NFC module, a baseband module, and corresponding radio frequency (RF) circuits for performing wireless local area network communication, Bluetooth communication, NFC communication, infrared communication, and / or cellular communication system communication, such as wideband code division multiple access (W-CDMA) and / or high-speed downlink packet access (HSDPA). The communication unit 1231 is used to control the communication of various components in the electronic device and can support direct memory access.

[0443] The input unit 1232 can be used to enable user interaction with the electronic device and / or input information into the electronic device. In a specific embodiment of the present invention, the input unit can be a touch panel, or other human-computer interaction interface, such as physical input keys, a microphone, or other external information acquisition device, such as a camera.

[0444] The processing unit 1233 is the control center of the electronic device. It can use various interfaces and lines to connect various parts of the entire electronic device, and perform various functions of the electronic device and / or process data by running or executing software programs and / or modules stored in the storage unit, and calling data stored in the storage unit.

[0445] The output unit 1234 includes but is not limited to an image output unit and a sound output unit. The image output unit is used to output text, pictures and / or videos. In a specific embodiment of the present invention, the touch panel used by the above-mentioned input unit 1232 can also serve as the display panel of the output unit 1234. For example, when the touch panel detects a touch or proximity gesture operation on it, it is transmitted to the processing unit to determine the type of touch event, and then the processing unit provides corresponding visual output on the display panel according to the type of touch event. Although in Figure 12 In the embodiment, the input unit 1232 and the output unit 1234 are two independent components to implement the input and output functions of the electronic device. However, in some embodiments, the touch panel and the display panel can be integrated to implement the input and output functions of the electronic device. For example, the image output unit can display various graphical user interfaces as virtual control components, including but not limited to windows, scroll bars, icons, and clipboards, for user operation via touch.

[0446] In the above embodiment, the information displaying whether there is a video surveillance device in the current environment can be implemented by the output unit 1234.

[0447] The storage unit 1236 may be used to store software programs and modules. The processing unit executes various functional applications of the electronic device and realizes data processing by running the software programs and modules stored in the storage unit.

[0448] This embodiment also provides a computer storage medium, which stores computer instructions. When the computer instructions are executed on an electronic device, the electronic device executes the above-mentioned related method steps to implement the method for detecting video surveillance equipment in the above embodiment.

[0449] This embodiment further provides a computer program product. When the computer program product is run on a computer, the computer is caused to execute the above-mentioned related steps to implement the method for detecting video surveillance equipment in the above-mentioned embodiment.

[0450] In addition, an embodiment of the present application also provides a device, which can specifically be a chip, component or module, and the device may include a connected processor and memory; wherein the memory is used to store computer-executable instructions, and when the device is running, the processor can execute the computer-executable instructions stored in the memory to enable the chip to execute the method for detecting video surveillance equipment in the above-mentioned method embodiments.

[0451] Among them, the electronic device, computer storage medium, computer program product or chip provided in this embodiment is used to execute the corresponding method provided above. Therefore, the beneficial effects that can be achieved can refer to the beneficial effects in the corresponding method provided above, and will not be repeated here.

[0452] Through the description of the above implementation methods, technical personnel in the relevant field can understand that for the convenience and simplicity of description, only the division of the above-mentioned functional modules is used as an example. In actual applications, the above-mentioned functions can be distributed and completed by different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above.

[0453] In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are merely schematic. For example, the division of modules or units is only a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another device, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0454] Units described as separate components may or may not be physically separate, and components shown as units may be one physical unit or multiple physical units, that is, they may be located in one place or distributed in multiple places. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0455] In addition, the functional units in the various embodiments of the present application may be integrated into a single processing unit, or each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0456] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a readable storage medium. Based on this understanding, the technical solution of the embodiment of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for enabling a device (which can be a single-chip microcomputer, chip, etc.) or a processor to execute all or part of the steps of the various embodiments of the present application. The aforementioned storage medium includes various media that can store program codes, such as a USB flash drive, a mobile hard disk, a ROM, a RAM, a magnetic disk, or an optical disk.

[0457] The above content is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of the present application. Therefore, the scope of protection of the present application should be based on the scope of protection of the claims.

Claims

1. A method for detecting a video surveillance device, the method being applied to an electronic device, characterized in that: include: Acquire media access control (MAC) address information of at least one target device, wherein the electronic device and the target device are connected to the same wireless network; Obtaining port information of the target device; Determine whether the target device is a video surveillance device according to the MAC address information; If it cannot be determined that the target device is the video surveillance device according to the MAC address information, determining whether the target device is the video surveillance device according to first information, wherein the first information includes the MAC address information and the port information, or the first information includes the port information; If it cannot be determined that the target device is the video surveillance device according to the first information, acquiring the fingerprint information of the target device based on a detection protocol of a transmission control protocol TCP port or a detection protocol of a user datagram protocol UDP port; Determining whether the target device is the video surveillance device according to the fingerprint information; The fingerprint information of the target device includes one or more of the following information: The device type, device manufacturer information, IP address, MAC address, port status, port number, port service type, application running on the port, device operating system, and service capabilities supported by the device of the target device; If no video surveillance device is detected under the currently connected first wireless access point AP, switch to the second wireless access point AP under the wireless network; Determine whether at least one target device connected to the second AP is a video surveillance device.

2. The method according to claim 1, characterized in that The determining whether the target device is a video surveillance device according to the MAC address information includes: If the MAC address information is first-level MAC address information, determining that the target device is the video surveillance device; If the MAC address information is not the first-level MAC address information, it is impossible to determine that the target device is the video surveillance device.

3. The method according to claim 2, characterized in that Determining whether the target device is the video surveillance device according to the first information includes: If the port information is first-level port information, determining that the target device is the video surveillance device; If the port information is second-level port information, and the MAC address information is second-level MAC address information, it is determined that the target device is the video surveillance device.

4. The method according to claim 1, characterized in that: The TCP port-based detection protocol obtains fingerprint information of the target device, including: Determine the TCP port-based detection protocol according to the port information; Based on the determined detection protocol, sending a detection message to the target device; receiving a response message from the target device; Extract fingerprint information of the target device according to the response message.

5. The method according to claim 4, characterized in that The TCP port-based detection protocol includes one or more protocols of web protocol / hypertext transfer protocol Http, domain name system DNS protocol, Telnet protocol, text transfer protocol FTP, and real-time streaming protocol RTSP.

6. The method according to claim 1, characterized in that The UDP port-based detection protocol obtains the fingerprint information of the target device, including: According to the preset detection protocol list, send a corresponding UDP detection message to the address and port corresponding to each detection protocol; Receiving a response message returned by the target device on the corresponding monitoring port; Extract fingerprint information of the target device according to the response message.

7. The method according to claim 6, characterized in that The UDP port-based detection protocol includes one or more protocols of the Open Network Video Interface Forum ONVIF protocol, the Multicast Domain Name System MDNS protocol, the Session Initiation Protocol SIP, the Domain Name System DNS protocol, and a private protocol.

8. The method according to any one of claims 1 to 7, characterized in that The method further comprises: Acquire auxiliary information of the target device, wherein the auxiliary information includes one or more of the following information: location information, wireless fidelity service set identifier Wi-Fi SSID or Wi-Fi name; Determine whether the target device is a video surveillance device according to the fingerprint information and the auxiliary information.

9. A method for detecting a video surveillance device, the method being applied to an electronic device, characterized in that: include: Acquire media access control (MAC) address information of at least one target device, wherein the electronic device and the target device are connected to the same wireless network; Determine whether the target device is a video surveillance device according to the MAC address information; The determining whether the target device is a video surveillance device according to the MAC address information includes: If the MAC address information is first-level MAC address information, determining that the target device is the video surveillance device; If the MAC address information is not the first-level MAC address information, it is impossible to determine that the target device is the video surveillance device; The method further comprises: If it is not possible to determine that the target device is the video surveillance device according to the MAC address information, determine whether the target device is the video surveillance device according to first information, wherein the first information includes the MAC address information and port information, or the first information includes the port information, and the port information is obtained according to the state of the port; If it cannot be determined that the target device is the video surveillance device according to the first information, acquiring the fingerprint information of the target device based on a detection protocol of a transmission control protocol TCP port or a detection protocol of a user datagram protocol UDP port; Determining whether the target device is the video surveillance device according to the fingerprint information; The fingerprint information of the target device includes one or more of the following information: The device type, device manufacturer information, IP address, MAC address, port status, port number, port service type, application running on the port, device operating system, and service capabilities supported by the device of the target device; If no video surveillance device is detected under the currently connected first wireless access point AP, switch to the second wireless access point AP under the wireless network; Determine whether at least one target device connected to the second AP is the video surveillance device.

10. The method according to claim 9, characterized in that Determining whether the target device is the video surveillance device according to the first information includes: If the port information is first-level port information, determining that the target device is the video surveillance device; If the port information is second-level port information, and the MAC address information is second-level MAC address information, it is determined that the target device is the video surveillance device.

11. The method according to claim 9, characterized in that The method further comprises: If the target device cannot be determined as the video surveillance device according to the MAC address information, the fingerprint information of the target device is obtained based on a TCP port detection protocol or a UDP port detection protocol; Determine whether the target device is the video surveillance device according to the fingerprint information.

12. The method according to claim 11, characterized in that The TCP port-based detection protocol obtains fingerprint information of the target device, including: Determine the TCP port-based detection protocol according to the port information; Based on the determined detection protocol, sending a detection message to the target device; receiving a response message from the target device; Extract fingerprint information of the target device according to the response message.

13. The method according to claim 12, characterized in that The TCP port-based detection protocol includes one or more protocols of the web protocol / hypertext transfer protocol Http, domain name system DNS protocol, Telnet protocol, text transfer protocol FTP protocol, and real-time streaming protocol RTSP protocol.

14. The method according to claim 11, characterized in that The UDP port-based detection protocol obtains the fingerprint information of the target device, including: According to the preset detection protocol list, send a corresponding UDP detection message to the address and port corresponding to each detection protocol; Receiving a response message returned by the target device on the corresponding monitoring port; The fingerprint information of the target device is extracted according to the response message.

15. The method according to claim 14, characterized in that The UDP port-based detection protocol includes one or more protocols of the Open Network Video Interface Forum ONVIF protocol, the Multicast Domain Name System MDNS protocol, the Session Initiation Protocol SIP protocol, the Domain Name System DNS protocol, and a private protocol.

16. The method according to any one of claims 9 to 15, characterized in that The method further comprises: Acquire auxiliary information of the target device, wherein the auxiliary information includes one or more of the following information: location information, a wireless fidelity service set identifier (Wi-Fi SSID) or a Wi-Fi name; Determine whether the target device is a video surveillance device according to the fingerprint information and the auxiliary information.

17. A method for detecting a video surveillance device, the method being applied to an electronic device, characterized in that: include: Acquire fingerprint information of at least one target device based on a detection protocol of a User Datagram Protocol (UDP) port, wherein the electronic device and the target device are connected to the same wireless network; Determining whether the target device is a video surveillance device according to the fingerprint information; Before acquiring device fingerprint information of at least one target device based on the UDP port detection protocol, the method further includes: Obtaining media access control MAC address information of the target device; If the MAC address information is first-level MAC address information, determining that the target device is a video surveillance device; If the MAC address information is not the first-level MAC address information, it is impossible to determine that the target device is a video surveillance device; If it cannot be determined that the target device is a video surveillance device based on the MAC address information, obtaining device fingerprint information of the target device based on the detection protocol of the UDP port; The fingerprint information of the target device includes one or more of the following information: The device type, device manufacturer information, IP address, MAC address, port status, port number, port service type, application running on the port, device operating system, and service capabilities supported by the device of the target device; If no video surveillance device is detected under the currently connected first wireless access point AP, switch to the second wireless access point AP under the wireless network; Determine whether at least one target device connected to the second AP is the video surveillance device.

18. The method according to claim 17, characterized in that The UDP port-based detection protocol obtains fingerprint information of at least one target device, including: According to the preset detection protocol list, send a corresponding UDP detection message to the address and port corresponding to each detection protocol; Receiving a response message returned by the target device on the corresponding monitoring port; Extract fingerprint information of the target device according to the response message.

19. The method according to claim 18, characterized in that The UDP port-based detection protocol includes one or more of the following protocols: Open Network Video Interface Forum ONVIF protocol, Multicast Domain Name System MDNS protocol, Session Initiation Protocol SIP, Domain Name System DNS protocol, and private protocols.

20. The method according to any one of claims 17 to 19, characterized in that The method further comprises: Acquire auxiliary information of the target device, wherein the auxiliary information includes one or more of the following information: location information, wireless fidelity service set identifier Wi-Fi SSID or Wi-Fi name; Determine whether the target device is a video surveillance device according to the fingerprint information and the auxiliary information.

21. An electronic device, characterized in that: include: one or more processors; one or more memories; The one or more memories store one or more computer programs, and the one or more computer programs include instructions, which, when executed by the one or more processors, enable the electronic device to perform the method as claimed in any one of claims 1 to 20.

22. A chip system, characterized in that: The chip system includes at least one processor, and when program instructions are executed in the at least one processor, the function of the method according to any one of claims 1 to 20 is implemented on the electronic device.

23. A computer storage medium, characterized in that The method comprises computer instructions, which, when executed on an electronic device, cause the electronic device to execute the method as claimed in any one of claims 1 to 20.

Images