A method and apparatus for monitoring and analyzing behavior of a network camera

Abstract

This application discloses a method and apparatus for monitoring and analyzing the behavior of network cameras. The method involves parsing the video protocol of network packets from the network camera and scoring the parsing results for security. When the score is greater than a first threshold, the network packet is allowed; when the score is between the first and second thresholds, the network packet is allowed; and when the score is less than the second threshold, the network packet is blocked. Scoring based on the first and second thresholds allows for more detailed and accurate identification of abnormal behavior from network cameras, facilitating timely detection of such behavior. Automatically allowing, alarming, or blocking in case of abnormalities improves both the security and management efficiency of the video surveillance network.

Description

Technical Field

[0001] This application relates to the field of computer information processing technology, and in particular to a method and apparatus for monitoring and analyzing the behavior of network cameras. Background Technology

[0002] With the rapid development of the Internet of Things (IoT), network cameras are increasingly penetrating various industries, including public security, transportation, education, and home security. The videos and photos they capture have become prime targets for criminals. In my country, there are thousands of court cases involving disputes over the rights to health, bodily integrity, and privacy related to "cameras." Many more people are unaware that they are being spied on, and their videos are even being categorized and sold. Therefore, ensuring the security of camera data is of paramount importance.

[0003] Current technologies for monitoring network cameras typically rely on whitelist authorization, which fails to monitor and analyze the camera's behavior, resulting in weak detection capabilities for unauthorized access. Therefore, promptly detecting abnormal behavior related to network cameras and improving the security of video surveillance networks has become a pressing issue. Summary of the Invention

[0004] To address the aforementioned issues, this application provides a method and apparatus for monitoring and analyzing the behavior of network cameras, thereby enabling timely detection of abnormal behavior of network cameras and improving the security of video surveillance networks.

[0005] This application discloses a method for monitoring and analyzing the behavior of a network camera, the method comprising:

[0006] The video protocol of network packets in the network camera is parsed;

[0007] A security score is assigned to the analysis results;

[0008] Determine whether the score obtained from the security assessment is greater than a first threshold;

[0009] If so, the network packet is allowed and a permission record is generated;

[0010] If not, then determine whether the score is greater than the second threshold; the first threshold is greater than the second threshold.

[0011] If so, the network packet is allowed to pass, and an alarm record is generated;

[0012] If not, the network packet is blocked, and a blocking record is generated.

[0013] Optionally, before performing a security score on the parsing results, the method further includes:

[0014] Determine whether the protocol format in the parsing result is valid;

[0015] If not, the network packets are blocked and an alarm is generated.

[0016] Optionally, the security scoring of the parsing results includes:

[0017] When a signaling baseline is not established, a signaling baseline is established based on the parsing result; the signaling baseline includes a terminal ID field, an initiator IP address field, a signaling category field, and a call frequency field;

[0018] Once the signaling baseline has been established, the score of the parsing result is calculated based on the signaling baseline.

[0019] Optionally, establishing a signaling baseline based on the parsing result includes: assigning weights to each field in the signaling baseline and setting a scoring method for each field.

[0020] Optionally, calculating the score of the parsing result based on the signaling baseline includes: calculating the score of the parsing result based on the weight of each field and the corresponding scoring method.

[0021] Optionally, after recording the network packet, the method further includes:

[0022] The record is stored in the network session of the network message;

[0023] When a subsequent message is identified as being from the same network session as the network message, the network message is processed according to the record.

[0024] Optionally, before parsing the video protocol of network packets in the network camera, the method further includes:

[0025] Acquire network packets from the network traffic of network cameras and monitor network connection status;

[0026] When a new connection is detected, a network session is created.

[0027] Based on the above-mentioned method for monitoring and analyzing the behavior of network cameras, this application also discloses an apparatus for monitoring and analyzing the behavior of network cameras, including: a parsing unit, a scoring unit, a first judgment unit, a release unit, a second judgment unit, an alarm release unit, and a blocking unit;

[0028] The parsing unit is used to parse the video protocol of network packets in the network camera;

[0029] The scoring unit is used to score the security of the parsing results;

[0030] The first judgment unit is used to determine whether the score obtained by the security scoring is greater than a first threshold;

[0031] The release unit is used to release the network packets and generate a release record;

[0032] The second determining unit is used to determine whether the score is greater than a second threshold; the first threshold is greater than the second threshold.

[0033] The alarm release unit is used to release the network packets and generate alarm records;

[0034] The blocking unit is used to block the network packets and generate a blocking record.

[0035] Optionally, the device further includes:

[0036] A legality determination unit is used to determine whether the protocol format in the parsing result is legal;

[0037] If not, the network packets are blocked and an alarm is generated.

[0038] Optionally, the scoring unit includes:

[0039] The baseline establishment subunit is used to establish a signaling baseline based on the parsing result when a signaling baseline has not been established; the signaling baseline includes a terminal ID field, an initiator IP address field, a signaling category field, and a call frequency field;

[0040] The score calculation subunit is used to calculate the score of the parsing result based on the signaling baseline when the signaling baseline has been established.

[0041] Optionally, the baseline establishment subunit is used to: assign weights to each field in the signaling baseline and set the scoring method for each field.

[0042] Optionally, the score calculation subunit is used to: calculate the score of the parsing result based on the weight of each field and the corresponding scoring method.

[0043] Optionally, the device further includes:

[0044] Storage unit, used to store the record into the network session of the network packet;

[0045] A fast processing unit is used to process the network packet according to the record when it is identified that the subsequent packet is the same as the network session of the network packet.

[0046] Optionally, the device further includes:

[0047] The monitoring unit is used to acquire network packets in the network traffic of the network camera and monitor the network connection status;

[0048] The session acquisition unit is used to create a network session when a new connection is detected.

[0049] This application discloses a method and apparatus for monitoring and analyzing the behavior of network cameras. The method involves parsing the video protocol of network packets from the network camera and scoring the parsing results for security. When the score is greater than a first threshold, the network packet is allowed and a permission record is generated. When the score is between the first and second thresholds, the network packet is allowed and an alarm record is generated. When the score is less than the second threshold, the network packet is blocked and a blocking record is generated. By scoring security based on the first and second thresholds, abnormal behavior of network cameras can be identified more precisely and accurately, facilitating timely detection of such behavior. Automatically allowing, alarming, or blocking in case of abnormalities improves both the security and management efficiency of the video surveillance network. Attached Figure Description

[0050] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of this application. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0051] Figure 1 This is a flowchart illustrating a method for monitoring and analyzing the behavior of a network camera disclosed in an embodiment of this application;

[0052] Figure 2a This is a flowchart illustrating another method for monitoring and analyzing the behavior of a network camera disclosed in an embodiment of this application;

[0053] Figure 2b This is a schematic diagram of the signaling baseline composition disclosed in the embodiments of this application;

[0054] Figure 2c This is a schematic diagram illustrating the scoring method for the terminal ID field disclosed in an embodiment of this application;

[0055] Figure 2d This is a schematic diagram illustrating the scoring method for the initiator's IP address field disclosed in an embodiment of this application;

[0056] Figure 2e This is a schematic diagram illustrating the signaling field scoring method disclosed in the embodiments of this application;

[0057] Figure 2f This is a schematic diagram illustrating the scoring method for the time range field disclosed in an embodiment of this application;

[0058] Figure 2g This is a schematic diagram illustrating the scoring method for the call frequency field disclosed in an embodiment of this application;

[0059] Figure 3 This is a schematic diagram of the hardware composition structure for network camera behavior monitoring and analysis disclosed in an embodiment of this application;

[0060] Figure 4 This is a schematic diagram of the structure of a device for monitoring and analyzing the behavior of a network camera disclosed in an embodiment of this application. Detailed Implementation

[0061] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0062] Example 1: This application discloses a method for monitoring and analyzing the behavior of network cameras.

[0063] For details, please refer to Figure 1 The method for monitoring and analyzing the behavior of a network camera disclosed in this embodiment includes the following steps:

[0064] Step 101: Parse the video protocol of the network packets in the network camera.

[0065] In the method described in this embodiment, as an optional approach, network packets from the network traffic of the network camera are first acquired via serial or bypass mirroring to continuously monitor the network connection status. When a new connection is detected, the network session related to the establishment of the new connection is acquired from the network packets. The network packets include data such as source IP (Internet Protocol) address, destination IP address, source port, destination port, and protocol number.

[0066] In the method described in this embodiment, further identification and parsing of the protocols in the network packets are required to obtain video signaling. As an optional method, video protocols can be identified by adding content recognition plugins. These content recognition plugins can be prioritized; once one plugin is successfully identified, subsequent plugins will not run. As another optional method, since video protocols in video surveillance networks do not necessarily use default ports, network packet data analysis based on the characteristics of different protocols is also necessary during protocol identification.

[0067] Optionally, the protocols may include, for example: SIP (Session Initialization Protocol), RTSP (Real Time Streaming Protocol), HTTP (Hypertext Transfer Protocol), GB / T 28181 (Technical Requirements for Information Transmission, Exchange and Control of Security Video Surveillance Network System), GB / T 35114 (Technical Requirements for Information Security of Public Security Video Surveillance Network System), GA / T1400 (Public Security Video Image Information Application System), RTCP (RTP Control Protocol), TELNET (Remote Terminal Protocol), etc.

[0068] In the method described in this embodiment, after identifying the video protocol, messages such as SIP requests and RTSP requests are parsed according to relevant standard documents to extract information such as video signaling and terminal device ID. The video signaling includes login authentication, negotiation, session establishment, playback, stop, download, recording, replay, and PTZ control.

[0069] In the method described in this embodiment, as an optional approach, the format of the video signaling is checked. If a format error is detected, an alarm record is generated and network packets containing the video signaling are blocked. This facilitates the identification of actions that modify the video protocol format to bypass subsequent security scoring and other steps.

[0070] Step 102: Perform a security score on the parsing results.

[0071] In the method described in this embodiment, as an optional method, it can be first determined whether the signaling baseline has been established. If it has not been established, the signaling baseline is established based on the parsing result. If the signaling baseline has been established, the score of the parsing result is calculated based on the signaling baseline.

[0072] The signaling baseline is indexed by the terminal IP address, and the baseline content includes data such as terminal ID field, terminal IP field, initiator IP address field, caller IP field, signaling category field, time range field, and call frequency field.

[0073] In the method described in this embodiment, each field in the signaling baseline is assigned a weight and a scoring method to calculate the score of the parsing result. The default weight assignment values ​​are shown in Table 1. If not all fields are included in the scoring scope, the weight values ​​of each field need to be adjusted to ensure that the sum of the weights of the fields included in the score calculation is 100. As an optional method, the data in Table 1 can be adjusted according to requirements.

[0074] Table 1 Default field weight assignment values

[0075] Serial Number Fields Weight 1 Terminal ID 50 2 Initiator IP address 20 3 Signaling 15 4 Execution time 10 5 call frequency 5

[0076] In the method described in this embodiment, the process of establishing a signaling baseline is usually performed automatically, but it can also be set manually.

[0077] In the method described in this embodiment, the signaling baseline also predefines a first threshold (alarm line) and a second threshold (blocking line) for matching the scores of the parsing results. The first threshold can be 80, and the second threshold can be 55. In practice, the process of establishing a signaling baseline is usually automated, but the first threshold, second threshold, weights, and other data can also be manually set as needed, supporting users to customize their own network camera behavior monitoring and analysis methods, thus improving flexibility.

[0078] Step 103: Determine whether the security score obtained is greater than the first threshold. If yes, proceed to step 104. If no, proceed to step 105.

[0079] In the method described in this embodiment, when the score is greater than the first threshold, it indicates that the network packet can be determined as safe; when the score is not greater than the first threshold, it indicates that the network packet is a packet that needs to be alerted and further determined.

[0080] Step 104: Allow the network packet and generate a release record.

[0081] Step 105: Determine whether the score is greater than the second threshold. If yes, proceed to step 106. If no, proceed to step 107.

[0082] Wherein, the first threshold is greater than the second threshold. In the method described in this embodiment, when the score is greater than the second threshold, it indicates that the network packet is determined to require an alarm but can be allowed to pass; when the score is not greater than the second threshold, it indicates that the network packet is insecure and needs to be blocked.

[0083] Step 106: Allow the network packets to pass and generate an alarm record.

[0084] In the method described in this embodiment, an alarm record is generated if the score is between the first threshold and the second threshold. As an optional method, the user can manually verify the alarm record to check or adjust the weight values ​​of the fields. This allows users to continuously improve and optimize the method described in this embodiment, enabling them to take more accurate measures the next time a network packet is received, thus improving the accuracy of determining abnormal behavior of network cameras to a certain extent.

[0085] Step 107: Block the network packet and generate a blocking record.

[0086] In the method described in this embodiment, as an optional approach, the records of allowing, alarming, or blocking network packets are stored in the network session of that network packet. When a subsequent packet is received and identified as having the same network session as the original network packet, the network packet is processed according to the record. This eliminates the need to perform the parsing and determination steps described above on packets with the same network session as the original network packet, thus improving processing efficiency.

[0087] The method described in this embodiment identifies protocols based on their characteristics, resulting in more accurate identification and the ability to recognize a wider range of video protocols, thus enabling the parsing of more video signaling. By extracting more signaling information from video traffic, a richer baseline is established, allowing for more granular monitoring. Compared to existing technologies that rely solely on whitelists to assess network camera security, the method described in this embodiment establishes a baseline with more elements, providing more detailed monitoring and timely identification of anomalies such as unauthorized callers, unauthorized signaling, and access outside of working hours. Furthermore, the method described in this embodiment supports protocol format checks to identify erroneous or missing fields.

[0088] Example 2: This application discloses another method for monitoring and analyzing the behavior of network cameras. Please refer to [link / reference]. Figure 2a The method described in this embodiment provides a detailed introduction to the specific steps of security scoring.

[0089] Step 201: Extract the content of the signaling baseline based on the parsing results.

[0090] In the method described in this embodiment, the signaling baseline is composed as follows: Figure 2bAs shown, the baseline is indexed by the terminal IP address and includes fields such as terminal ID, caller IP address, signaling, time range, and frequency. A first threshold and a second threshold are also predefined to facilitate subsequent assessment of network packet security. These first and second thresholds can be manually adjusted or use default values, thus satisfying some of the user's personalized needs.

[0091] Step 202: Assign weights and scoring methods to the fields in the signaling baseline.

[0092] In the method described in this embodiment, as an optional method, the scoring method for the terminal ID field is as follows: Figure 2c As shown, when the terminal ID in the baseline is the same as the terminal ID in the network packet, 100 points are awarded; otherwise, 0 points are awarded.

[0093] The scoring method for the initiator's IP field is as follows: Figure 2d As shown, when the originator IP address in the network packet is in the originator IP address list of the baseline, it is considered a match to the baseline, scoring 100 points. When the originator IP address in the network packet is not in the same subnet as any IP address in the originator IP address list of the baseline, it is considered a significant difference from the baseline. In this case, if the originator IP address list of the baseline contains 5 or fewer IP addresses, it indicates that the originator IP addresses in the baseline are too few, and the confidence level is relatively low (not very authoritative), therefore scoring 60 points. When the originator IP address list of the baseline contains more than 5 IP addresses, the originator IP addresses in the baseline are considered numerous, with high confidence (authoritative), scoring 40 points. When the originator IP address in the network packet is in the same subnet as an IP address in the originator IP address list of the baseline, it is considered similar to the baseline. At this point, if the list of originator IP addresses in the baseline contains 5 or fewer IP addresses, it indicates that the number of originator IP addresses in the baseline is too small, suggesting that the originator IP addresses in the network packets are likely to be similar to a small amount of data, with a low probability, scoring 80 points. If the list of originator IP addresses in the baseline contains more than 5 IP addresses, it indicates that the number of originator IP addresses in the baseline is large, suggesting that the originator IP addresses in the network packets are likely to be similar to a large amount of data, with a high probability, scoring 60 points.

[0094] The scoring method for signaling fields is as follows: Figure 2e As shown, 100 points are awarded when the signaling type in the network packet is in the signaling type list in the baseline. 40 points are awarded when the signaling type in the network packet is unrelated to the signaling types in the baseline. 80 points are awarded when the signaling type in the network packet is related to a type in the signaling type list in the baseline.

[0095] The scoring method for the time range field is as follows: Figure 2f As shown, when the execution time in the network packet is in the execution time list in the baseline, it is scored as 100 points. When the execution time in the network packet is not in the execution time list in the baseline, the difference in minutes between the execution time in the network packet and the execution time list in the baseline is calculated, and the score is 100 - difference in minutes / 3.

[0096] The scoring method for call frequency is as follows: Figure 2g As shown, when the call frequency in the network message is within the allowed call frequency range in the baseline, it scores 100 points; otherwise, it scores 0 points.

[0097] Step 203: Calculate the score according to the weights and scoring method.

[0098] In the method described in this embodiment, as an optional method, the number of fields to be judged in a certain baseline entry is n, and the score and weight of each field are S. i With W i The matching score is calculated as follows:

[0099]

[0100] For example: When all fields (terminal ID, initiator IP address, signaling field, time range, and call frequency) are included in the scoring range, the terminal ID field scores 100 points, the initiator IP address field scores 60 points, the signaling field scores 100 points, the time range field scores 100 points, and the call frequency field scores 0 points. Then, according to the default weights (Table 1) and Formula 1, the total score is calculated as follows: 100x0.5 + 60x0.2 + 100x0.15 + 100x0.1 + 0x0.05 = 87 points.

[0101] The method described in this embodiment can establish rich baselines based on the analysis results. By assigning weights to fields and using preset scoring methods, a score is obtained for each field, and a security score is derived through a formula. This allows for more granular monitoring of network camera behavior. Furthermore, the weights and scoring methods can be manually adjusted during baseline establishment to better suit user needs and improve the flexibility of camera behavior judgment.

[0102] Based on the method for monitoring and analyzing network camera behavior disclosed in the above embodiments, this embodiment correspondingly discloses the hardware components for monitoring and analyzing network camera behavior. Please refer to... Figure 3 The device for monitoring and analyzing the behavior of network cameras includes:

[0103] CPU (Arithmetic Unit) is used to execute the code required to implement the methods described in this embodiment.

[0104] Main memory is a volatile storage medium used to store the code and data required in the methods described in this embodiment, and is the basis for the CPU to perform operations;

[0105] I / O (input / output devices) include network adapters, extended memory, etc.

[0106] The CPU includes: ACC (Accumulator Register), used to store operands, calculation results, etc.; MQ (Multiplier-Quotient Register), used for multiplication and division operations; ALU (Algorithm Logic Unit), used to implement logical and arithmetic operations; and X (General Purpose Register).

[0107] The main memory includes: a memory register (MAR) for storing computation data and code; an address register (MAR) for specifying the memory location to be read or written; and a data register (MDR) for buffering the data being read or written.

[0108] Based on the method for monitoring and analyzing network camera behavior disclosed in the above embodiments, this embodiment correspondingly discloses an apparatus for monitoring and analyzing network camera behavior. Please refer to... Figure 4 The device for monitoring and analyzing the behavior of network cameras includes: a parsing unit 401, a scoring unit 402, a first judgment unit 403, a release unit 404, a second judgment unit 405, an alarm release unit 406, and a blocking unit 407.

[0109] The parsing unit 401 is used to parse the video protocol of network packets in the network camera;

[0110] The scoring unit 402 is used to score the security of the parsing results.

[0111] The first judgment unit 403 is used to determine whether the score obtained by the security scoring is greater than a first threshold.

[0112] The release unit 404 is used to release the network packet and generate a release record;

[0113] The second judgment unit 405 is used to determine whether the score is greater than a second threshold; the first threshold is greater than the second threshold.

[0114] The alarm release unit 406 is used to release the network packets and generate alarm records;

[0115] The blocking unit 407 is used to block the network packets and generate a blocking record.

[0116] Optionally, the device further includes:

[0117] A legality determination unit is used to determine whether the protocol format in the parsing result is legal;

[0118] If not, the network packets are blocked and an alarm is generated.

[0119] Optionally, the scoring unit 402 includes:

[0120] The baseline establishment subunit is used to establish a signaling baseline based on the parsing result when a signaling baseline has not been established; the signaling baseline includes a terminal ID field, an initiator IP address field, a signaling category field, and a call frequency field;

[0121] The score calculation subunit is used to calculate the score of the parsing result based on the signaling baseline when the signaling baseline has been established.

[0122] Optionally, the baseline establishment subunit is used to: assign weights to each field in the signaling baseline and set the scoring method for each field.

[0123] Optionally, the score calculation subunit is used to: calculate the score of the parsing result based on the weight of each field and the corresponding scoring method.

[0124] Optionally, the device further includes:

[0125] Storage unit, used to store the record into the network session of the network packet;

[0126] A fast processing unit is used to process the network packet according to the record when it is identified that the subsequent packet is the same as the network session of the network packet.

[0127] Optionally, the device further includes:

[0128] The monitoring unit is used to acquire network packets in the network traffic of the network camera and monitor the network connection status;

[0129] The session acquisition unit is used to create a network session when a new connection is detected.

[0130] The embodiments in this specification are described in a progressive manner. For the apparatus disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the description is relatively simple; relevant details can be found in the method section.

[0131] It should also be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0132] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein can be implemented directly by hardware, a software module executed by a processor, or a combination of both. The software module can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.

[0133] The features described in the embodiments of this specification can be substituted for or combined with each other, so that those skilled in the art can implement or use this application.

[0134] The above description of the disclosed embodiments enables those skilled in the art to make or use this application. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of this application. Therefore, this application is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for monitoring and analyzing the behavior of network cameras, characterized in that, include: The video protocols of network packets in the network camera are parsed; there are multiple video protocols. The security score is applied to the analysis results; The parsing results contain various signaling information corresponding to multiple video protocols; Determine whether the score obtained from the security assessment is greater than a first threshold; If so, the network packet is allowed and a permission record is generated; If not, then determine whether the score is greater than the second threshold; the first threshold is greater than the second threshold. If so, the network packet is allowed to pass, and an alarm record is generated; If not, the network packet is blocked, and a blocking record is generated; The security scoring of the parsing results includes: When a signaling baseline is not established, a signaling baseline is established based on various signaling information in the parsing result; the signaling baseline is indexed by the terminal IP address and includes a terminal ID field, an initiator IP address field, a caller IP field, a signaling category field, a time range field, and a call frequency field; the first threshold and the second threshold are predefined in the signaling baseline; Once the signaling baseline has been established, the score of the parsing result is calculated based on the signaling baseline.

2. The method according to claim 1, characterized in that, Before performing a security score on the parsing results, the method further includes: Determine whether the protocol format in the parsing result is valid; If not, the network packets are blocked and an alarm is generated.

3. The method according to claim 1, characterized in that, The step of establishing a signaling baseline based on the parsing results includes: assigning weights to each field in the signaling baseline and setting a scoring method for each field.

4. The method according to claim 3, characterized in that, The step of calculating the score of the parsing result based on the signaling baseline includes: calculating the score of the parsing result based on the weight of each field and the corresponding scoring method.

5. The method according to claim 1, characterized in that, After recording the network packets, the method further includes: The record is stored in the network session of the network message; When a subsequent message is identified as being from the same network session as the network message, the network message is processed according to the record.

6. The method according to any one of claims 1-5, characterized in that, Before parsing the video protocol of network packets in the network camera, the method further includes: Acquire network packets from the network traffic of network cameras and monitor network connection status; When a new connection is detected, a network session is created.

7. A device for monitoring and analyzing the behavior of network cameras, characterized in that, include: The system includes a parsing unit, a scoring unit, a first judgment unit, a release unit, a second judgment unit, an alarm release unit, and a blocking unit. The parsing unit is used to parse the video protocols of network packets in the network camera; the video protocols are multiple. The scoring unit is used to score the security of the parsing results; The parsing results contain various signaling information corresponding to multiple video protocols; The first judgment unit is used to determine whether the score obtained by the security scoring is greater than a first threshold; The release unit is used to release the network packets and generate a release record; The second judgment unit is used to determine whether the score is greater than the second threshold. The first threshold is greater than the second threshold; The alarm release unit is used to release the network packets and generate alarm records; The blocking unit is used to block the network packets and generate a blocking record; The scoring unit includes: The baseline establishment subunit is used to establish a signaling baseline based on various signaling information in the parsing result when the signaling baseline has not been established. The signaling baseline is indexed by the terminal IP address and includes a terminal ID field, an initiator IP address field, a caller IP field, a signaling category field, a time range field, and a call frequency field. The first threshold and the second threshold are predefined in the signaling baseline. The score calculation subunit is used to calculate the score of the parsing result based on the signaling baseline when the signaling baseline has been established.

8. The apparatus according to claim 7, characterized in that, The device further includes: A legality determination unit is used to determine whether the protocol format in the parsing result is legal; If not, the network packets are blocked and an alarm is generated.

Images