A method and system for covert camera discovery based on multiple-instance learning

Abstract

The application discloses a hidden camera discovery method and system based on multiple example learning, sniffs and captures video flow of all WiFi signals in an environment, extracts a video flow feature vector, uses a video stream recognition model M1 to recognize WiFi messages containing video streams in the environment, obtains a corresponding source MAC address set, marks the MAC address as a possible hidden camera device, takes real-time messages corresponding to each MAC address as input, extracts message feature vectors to combine into a multiple example feature vector sequence, identifies whether uplink flow of the MAC address has burst video flow through a camera flow discovery model, triggers burst video flow through human movement, determines whether a hidden camera is shooting in the current area through the camera flow discovery model, and outputs a MAC address set of the hidden camera. The application applies a multiple example learning model to hidden camera discovery, introduces multiple example features caused by human movement leading to burst video flow, and improves the accuracy of hidden camera discovery.

Description

TECHNICAL FIELD

[0001] The present application relates to video traffic analysis technology, in particular to a multi-example learning-based hidden camera discovery method and system. BACKGROUND

[0002] Active detection of hidden cameras is an important means for users to prevent privacy leakage. One of the current detection methods is to discover devices by sensing and analyzing special physical signals emitted by camera devices, such as radio waves, infrared rays, sound waves, etc. Another method is to indirectly identify devices by analyzing the impact of camera operation on environmental factors.

[0003] From the perspective of wireless signals, the mainstream method for detecting hidden cameras currently relies on a radio frequency receiver that senses whether the received power in a specific frequency range is higher than a certain threshold. However, since the working principle of such detectors is to sense the surrounding radio frequency signals, they are easily triggered by legal radio frequency devices such as mobile phones, radios, smart televisions, and other smart devices, thereby limiting the practicality of these detectors. In addition, an alternative method has emerged that simply detects the presence of Internet of Things devices based on network traffic statistics. However, these methods only determine the presence of devices without semantic information about device information, location, or whether the device is actually monitoring the user. Moreover, if there are services such as video live streaming, video calls, video conferences, etc. running in the network environment, such simple network traffic statistics methods will have a high false positive rate, which greatly affects the actual use of users. Similarly, there is another method that correlates the WiFi traffic patterns of trusted cameras with those of other hidden cameras on the network to detect whether they are observing the same space at the same time. However, these camera-specific methods cannot be generalized across modes, and for practical applications, users need to carry a camera with them, which is extremely inconvenient for users.

[0004] For example, patent CN113038375A discloses a hidden camera sensing and positioning method and system. This technical solution first needs to determine whether the destination address matches the local machine, and then needs to connect the detection device to the WiFi where the camera is located. However, in actual scenarios, it may not be possible to determine the WiFi of the hidden camera. In addition, the camera sensing method in this technical solution does not distinguish between camera traffic and other video traffic characteristics such as video calls, video on-demand codes, etc. It also needs to call the mobile phone motion trajectory, but the motion sensing of the mobile phone has a large error in a small range of environment, making it difficult to accurately obtain the user's movement distance. SUMMARY

[0005] The purpose of the present application is to solve the problems in the prior art and provide a multi-example learning-based hidden camera discovery method and system.

[0006] Technical scheme: The application discloses a hidden camera discovery method based on multi-example learning, which comprises the following steps:

[0007] Step 1, the sniffing device starts the confusion mode, uses the air interface packet capturing method to sniff all WiFi signals in the environment, scans all channels under the 2.4g frequency band, captures the traffic in a certain time period, and extracts the video stream feature vector from the captured traffic message;

[0008] Step 2, a video stream recognition model M1 based on a decision tree is constructed, the video stream feature vector is input into the video stream recognition model M1, the WiFi message containing the video stream in the environment is recognized by the video stream recognition model M1, the corresponding source MAC address set CS1 is obtained, and the MAC addresses in the source MAC address set CS1 are marked as possible hidden camera devices;

[0009] Step 3, the real-time message corresponding to each MAC address in the source MAC address set CS1 is used as input, the sliding window method is used to extract the feature vector of the message, and the multi-example feature vector sequence Vseq is combined, and then the camera traffic discovery model M2 based on multi-example is used to identify whether the uplink traffic of the MAC address has burst video traffic;

[0010] Step 4, the user triggers the burst video traffic by moving, the system obtains the start and end time of the user movement, and simultaneously compares the output results of the camera traffic discovery model M2 in the time interval, to judge whether there is a hidden camera shooting in the current area, if it is determined that there is a hidden camera shooting, the number of hidden cameras and the MAC address of each hidden camera are output, and the MAC address set CS2 of the hidden camera is obtained.

[0011] Further, when the video stream feature vector is extracted in step 1, the WiFi traffic characteristics of the camera are used to take 5 seconds as the collection time window, the collected data is divided into multiple sequences, and the video traffic features of each MAC address in each sequence are extracted, and the video traffic features specifically include the following:

[0012] The send_num feature refers to the total number of messages sent by a MAC address in 5 seconds, which represents the frequency of sending messages by the device;

[0013] The recv_num feature refers to the total number of messages received by a MAC address in 5 seconds, which represents the frequency of receiving messages by the device;

[0014] The data_type feature refers to counting the frame types of all messages sent by the MAC address within 5 seconds and taking the average value, indicating the tendency of the device to send messages of different data types.

[0015] The data_subtype feature refers to counting the frame subtypes of all messages sent by the MAC address within 5 seconds and taking the average value, indicating the fine-grained data type of the device sending messages, including whether it is a QoS message.

[0016] The send_length_mean feature refers to the average length of all messages sent by the MAC address within 5 seconds, indicating the amount of information contained in each data sent by the device.

[0017] The send_length_var feature refers to the length variance of all messages sent by the MAC address within 5 seconds, indicating the variation amplitude of the data sent by the device.

[0018] The recv_length_mean feature refers to the average length of all messages received by the MAC address within 5 seconds, indicating the amount of information received by the device.

[0019] The recv_length_var feature refers to the length variance of all messages received by the MAC address within 5 seconds, indicating the variation amplitude of the data received by the device.

[0020] Further, step 2 identifies the message containing video stream information through the video stream recognition model M1 according to the message features corresponding to each MAC address extracted, and preliminarily identifies the source MAC address of this type of message as the camera address, i.e. obtains the MAC address set CS1 of suspected cameras; the construction method of the video stream recognition model M1 is:

[0021] Step A, construct a training set, i.e. collect camera and non-camera traffic, and label the categories based on known MAC addresses and actual device types;

[0022] Step B, train the classification model, i.e. import the training set into the initialized decision tree classification model, and calculate the information gain based on the deviation between the model prediction result and the actual result, and then optimize the decision tree model, finally construct the optimal decision tree classification model;

[0023] Step C, optimize the model, i.e. post-pruning optimization of the optimal decision tree classification model obtained in step B, to ensure that the training result will not appear overfitting, etc.

[0024] Further, each MAC address in the source MAC address set CS1 in step 3 represents a device sending video data, and the wireless sniffed packets are classified according to the MAC address, and the feature vector V of the packets within 5s of each MAC address is extracted, 10s-20s of packets are extracted each time (the specific time is according to user interaction operation), different overlap degrees are set, and the feature vector sequence Vseq corresponding to each MAC address of different lengths can be obtained, and then the feature vector sequence Vseq is taken as the input of the camera traffic discovery model M2, and the output result represents whether there is burst video traffic in the packets corresponding to the MAC address within the last 10-20s.

[0025] Further, the construction method of the multi-instance-based camera traffic discovery model M2 is:

[0026] Step A, collect training data, take the camera traffic without mobile behavior in the whole process as negative example packet data, and take the camera traffic with mobile behavior in the process as positive example packet, and the specific method is:

[0027] First, collect the static picture data of the camera in an environment ensuring no people using the wireless traffic sniffing method, and in this process, all the collected traffic does not contain mobile traffic characteristics, so it can be used for generating negative example packet data; then, collect the dynamic picture data of the camera by keeping the mobile state in and out of the camera picture, and in this process, the collected traffic contains positive and negative examples; based on the idea of multi-instance learning, a long time sequence is taken to generate positive example packets to ensure that in this sequence, in addition to an uncertain number of negative examples, there are also some positive example data, so it can be labeled as a positive example packet in the multi-instance learning scene;

[0028] Step B, design the model architecture

[0029] Based on the input wireless traffic data, the multi-instance packet is constructed, and the subsequent classification network is composed of three fully connected layers, one pooling layer and one activation layer; the fully connected layer extracts the feature representation vector at the example level, and then the pooling layer learns the feature representation at the whole example packet level, and the activation layer calculates the classification result based on the obtained example packet level representation vector, thereby realizing the packet classification problem of hidden camera positioning; the purpose of the fully connected layer and the pooling layer in the application is to learn a feature representation vector representing the whole example packet, and finally the classification result is calculated by the activation layer. This model is a deep multi-instance learning model following the embedding space paradigm;

[0030] The model is described by the following formula:

[0031]

[0032] wherein, represents the feature vector extracted from the i-th layer, i is the example package number, j is the example number, y i represents the classification result of the i-th example package, L is the maximum number of layers of the model, H l is the i-th layer of the model full connection layer, M L is the last calculation layer of the model, including a MIL pooling layer and a final activation layer.

[0033] The application also discloses a multi-instance learning hidden camera discovery method system, which comprises a wireless sniffing module, a MAC address filtering module, a burst video stream analysis module and a comparison and judgment module.

[0034] The wireless sniffing module is started in a mixed mode to perform air interface packet capturing on WiFi signals in a region.

[0035] The MAC address filtering module extracts a feature vector from the sniffed packet, uses a video stream recognition model M1 based on a decision tree method to recognize the sniffed WiFi packet, and obtains a device MAC address set CS1 of the video stream.

[0036] The burst video stream analysis module takes the MAC address set CS1 obtained through preliminary filtering as a basis, classifies each packet containing a MAC source address, extracts a multi-instance feature vector, uses a camera traffic discovery model to judge whether a burst video stream appears in a recent period of time, and judges whether the MAC address set CS1 is a hidden camera.

[0037] The sequence comparison module compares the human body movement time period obtained through user interaction with the result of whether a burst video stream appears in the packet of the MAC source address in the time period, and can obtain the device MAC address of the hidden camera.

[0038] Beneficial effects: the multi-instance learning model is used for hidden camera discovery, the multi-instance feature caused by human body movement leading to burst video traffic is introduced, and the accuracy of hidden camera discovery is improved. BRIEF DESCRIPTION OF DRAWINGS

[0039] Figure 1 is a method flowchart of the application;

[0040] Figure 2is the architecture diagram of the camera flow discovery model M2 in the application. DETAILED DESCRIPTION

[0041] The technical solutions of the application will be described in detail below, but the protection scope of the application is not limited to the embodiments.

[0042] As shown in the figure, the multi-instance learning-based hidden camera discovery method of the application comprises the following steps: Figure 1

[0043] Step 1: The sniffing device starts the confusion mode, uses the air interface packet capturing method to sniff all WiFi signals in the environment, scans all channels under the 2.4g frequency band, captures the flow in a certain time period, and extracts the video stream feature vector from the captured flow message;

[0044] Step 2: The video stream recognition model M1 based on the decision tree is constructed, the video stream feature vector is input into the video stream recognition model M1, the WiFi message containing the video stream in the environment is recognized by the video stream recognition model M1, the corresponding source MAC address set CS1 is obtained, and the MAC addresses in the source MAC address set CS1 are marked as possible hidden camera devices;

[0045] Step 3: The real-time message corresponding to each MAC address in the source MAC address set CS1 is used as input, the sliding window method is used to extract the feature vector of the message with a window of 5 seconds, and the multi-instance feature vector sequence Vseq is combined, and then the multi-instance-based camera flow discovery model M2 is used to identify whether the uplink flow of the MAC address has burst video flow;

[0046] Step 4: The user triggers the burst video flow by moving manually, the system obtains the start and end time of the user's movement, and simultaneously compares the output results of the camera flow discovery model M2 in the time interval to determine whether there is a hidden camera in the current area, if it is determined that there is a hidden camera, the number of hidden cameras and the MAC address of each hidden camera are output, and the MAC address set CS2 of the hidden camera is obtained.

[0047] Since the influence of human motion is cross-mode, especially when the camera captures human motion, the application considers the flow statistical characteristics of the camera and the influence of human motion on the flow, and classifies the flow changes caused by the user's movement in the camera shooting range as a multi-instance model. In addition, the existing video encoding mode is a general format, and such flow change mode is also general, so the application has strong applicability. The application can distinguish camera flow from other video flow by analyzing multiple instances of video fluctuations without accessing WiFi, and does not need to rely on the accurate user movement distance.​

[0048] The embodiment first opens the confusion mode when acquiring the WiFi signal in the acquisition area, uses the wireless network card to perform air interface packet capturing, and collects data of all channels through the traversal method in the first wireless traffic sniffing process. Then, the MAC address of each channel is filtered, and in the subsequent processing and analysis process, only the channels and MAC addresses with hidden cameras are analyzed to reduce the computing resource overhead.

[0049] In step 1 of the embodiment, when the video stream feature vector is extracted, 5 seconds are taken as the collection time window based on the WiFi traffic characteristics of the camera, the collected data is divided into multiple sequences, and the video traffic features of each MAC address in each sequence are extracted, including the following video traffic features:

[0050] The send_num feature refers to the total number of messages sent by a MAC address within 5 seconds, indicating the frequency of sending messages by the device.

[0051] The recv_num feature refers to the total number of messages received by a MAC address within 5 seconds, indicating the frequency of receiving messages by the device.

[0052] The data_type feature refers to the frame type of all messages sent by the MAC address within 5 seconds, and the average value is taken, indicating the tendency of the device to send messages of different data types.

[0053] The data_subtype feature refers to the frame subtype of all messages sent by the MAC address within 5 seconds, and the average value is taken, indicating the fine-grained data type of the device sending messages, including whether it is a QoS message.

[0054] The send_length_mean feature refers to the average length of all messages sent by the MAC address within 5 seconds, indicating the information size contained in each data sent by the device.

[0055] The send_length_var feature refers to the length variance of all messages sent by the MAC address within 5 seconds, indicating the variation amplitude of the data sent by the device.

[0056] The recv_length_mean feature refers to the average length of all messages received by the MAC address within 5 seconds, indicating the information size of the data received by the device.

[0057] The recv_length_var feature refers to the length variance of all messages received by the MAC address within 5 seconds, indicating the variation amplitude of the data received by the device.

[0058] Step 2 of the embodiment identifies the packets containing video stream information through the video stream identification model M1 according to the packet features corresponding to each MAC address extracted, and preliminarily identifies the source MAC address of the packets as the camera address, that is, obtains the MAC address set CS1 of suspected cameras;

[0059] The construction method of the video stream identification model M1 is as follows:

[0060] Step A, construct a training set, that is, collect camera and non-camera traffic, and mark the categories thereof based on known MAC addresses and actual device types;

[0061] Step B, train the classification model, that is, import the training set into the initialized decision tree classification model, and calculate the information gain based on the deviation between the model prediction result and the actual result, and then optimize the decision tree model, and finally construct the optimal decision tree classification model;

[0062] Step C, optimize the model, that is, perform post-pruning optimization on the optimal decision tree classification model obtained in step B to ensure that the training result will not appear overfitting and the like.

[0063] In step 3 of the embodiment, each MAC address in the source MAC address set CS1 represents a device sending video data, and the packets sniffed by wireless sniffing are classified according to MAC addresses, and the feature vector V of the packets within 5s for each MAC address is extracted, 10s-20s of packets are extracted each time, and different overlap degrees are set, that is, the feature vector sequence Vseq of different lengths corresponding to each MAC address is obtained, and then the feature vector sequence Vseq is taken as the input of the camera traffic discovery model M2, and the output result indicates whether there is burst video traffic in the packets corresponding to the MAC address within the last 10-20s.

[0064] The construction method of the camera traffic discovery model M2 based on multiple examples of the embodiment is as follows:

[0065] Step A, collect training data, and take the camera traffic without mobile behavior as negative example packet data, and take the camera traffic with mobile behavior as positive example packet, and the specific method is as follows:

[0066] First, collect the static picture data of the camera in an environment ensuring no people using the wireless traffic sniffing method, and in this process, all the collected traffic does not contain mobile traffic features, so it is used for generating negative example packet data;

[0067] Subsequently, the dynamic picture data of the camera is collected by constantly entering and exiting the camera picture while keeping a moving state within and outside the camera monitoring range. In this process, the collected traffic contains positive and negative examples representing movement and stillness. A long time sequence is taken to generate a positive example package to ensure that there are some positive example data in the sequence except for an uncertain number of negative examples, which are marked as positive example packages.

[0068] Step B, designing a model architecture

[0069] Based on the input wireless traffic data, a multi-example package is constructed. The subsequent classification network consists of three fully connected layers, a pooling layer and an activation layer. The fully connected layer extracts an example-level feature representation vector. Then, the pooling layer learns the feature representation at the whole example package level. Finally, the activation layer calculates the classification result based on the obtained example package-level representation vector, thereby realizing the package classification problem of hidden camera positioning.

[0070] The model is described by the following formula:

[0071]

[0072] wherein, represents the feature vector extracted by the lth layer, i is the example package number, j is the example number therein, y i represents the classification result of the ith example package, L is the maximum number of layers of the model, H l is the lth fully connected layer of the model, M L is the last calculation layer of the model, which includes a MIL pooling layer and a final activation layer.

[0073] The above-mentioned multi-example learning hidden camera discovery method system includes a wireless sniffing module, a MAC address filtering module, a burst video stream analysis module and a comparison judgment module.

[0074] The wireless sniffing module is opened in a mixed mode to perform air interface packet capture on the WiFi signals in the region. In order to ensure that all possible hidden cameras are discovered as much as possible, all channels under the 2.4G frequency band need to be frequency-hopped and collected.

[0075] The MAC address filtering module first extracts a feature vector from the sniffed packet, uses a video stream recognition model M1 based on a decision tree method to recognize the sniffed WiFi packet, and obtains a device MAC address set CS1 sending the video stream.

[0076] The burst video stream analysis module takes the MAC address set CS1 obtained by preliminary filtering as a basis, classifies each packet containing a MAC source address, extracts a multi-example feature vector, uses a camera traffic discovery model, and judges whether a burst video stream appears in the recent period of time.

[0077] The sequence alignment module compares the human movement time period obtained through user interaction with the result of whether the message of a certain MAC source address in the time period appears a burst video stream, obtains the device MAC address judged as a hidden camera, and finally obtains the number of hidden cameras in the area and the corresponding MAC address.

[0078] The embodiment also discloses a hidden camera discovery device based on multi-instance learning, which comprises a WiFi adapter, a memory and a processor, wherein:

[0079] The WiFi adapter is used for receiving or sending WiFi signals and can open a mixed mode air interface to capture WiFi messages.

[0080] The memory is used for storing a computer program capable of running on the processor.

[0081] The processor is used for executing the steps of the above-mentioned low-light face enhancement method based on a CNN encoder when the computer program is running.

[0082] The application also discloses a storage medium, wherein the storage medium stores a computer program, and the computer program is executed by at least one processor to realize the steps of the above-mentioned hidden camera discovery method based on multi-instance learning.

Claims

1. A method for covert camera discovery based on multiple-instance learning, characterized in that, Comprising the following steps: Step 1, the sniffing device starts the confusion mode, uses the air interface packet capturing method to sniff all WiFi signals in the environment, scans all channels under the 2.4g frequency band, captures the traffic in a certain time period, and extracts the video stream feature vector from the captured traffic message; Step 2, based on the video stream recognition model M1 constructed by the decision tree, input the video stream feature vector into the video stream recognition model M1, identify the WiFi message containing the video stream in the environment through the video stream recognition model M1, obtain the corresponding source MAC address set CS1, and mark the MAC address in the source MAC address set CS1 as a possible hidden camera device; The construction method of the video stream recognition model M1 is: Step A, construct a training set, that is, collect camera and non-camera traffic, and mark the categories based on known MAC addresses and actual device types; Step B, train the classification model, that is, import the training set into the initialized decision tree classification model, and calculate the information gain based on the deviation between the model prediction result and the actual result, and then optimize the decision tree model, and finally construct the optimal decision tree classification model; Step C, optimize the model, that is, optimize the optimal decision tree classification model obtained in step B by post-pruning; Step 3, use the sliding window method to extract the packet feature vector with 5 seconds as a window, and combine it into a multi-instance feature vector sequence Vseq, and then identify whether the uplink traffic of the MAC address has burst video traffic through the multi-instance camera traffic discovery model M2 based on the multi-instance feature vector sequence Vseq; The construction method of the multi-instance camera traffic discovery model M2 is: Step A, collect training data, and take the camera traffic without mobile behavior as negative example packet data, and take the camera traffic with mobile behavior as positive example packet; Step B, design the model architecture Based on the input wireless traffic data, construct a multi-instance packet, and the subsequent classification network consists of three fully connected layers, a pooling layer and an activation layer; The fully connected layer extracts the feature representation vector at the instance level, and then learns the feature representation at the whole instance packet level based on the pooling layer, and finally the activation layer calculates the classification result based on the obtained instance packet level representation vector, thereby realizing the packet classification problem of hidden camera positioning; The model is described by the following formula: （1） wherein, represents the i-th layer extracted feature vector, i is the example bag number, j is the example number within it, represents the classification result of the i-th example bag, L is the maximum number of layers of the model, is the i-th layer full connection layer, is the last calculation layer of the model, which includes an MIL pooling layer and a final activation layer; Step 4, the user triggers burst video traffic by moving artificially, the system obtains the start and end time of the user's movement, and at the same time compares the output results of the camera traffic discovery model M2 in the time interval, to judge whether there is a hidden camera in the current area, if it is determined that there is a hidden camera, output the number of hidden cameras and the MAC address of each hidden camera, and obtain the MAC address set CS2 of the hidden camera. 2.The multi-instance learning based covert camera discovery method of claim 1, wherein, The video stream feature vector is extracted in step 1, and the WiFi traffic characteristics of the camera are used to set 5 seconds as the collection time window, and the collected data is divided into multiple sequences, and the video traffic features of each MAC address in each sequence are extracted, which specifically include the following video traffic features: The send_num feature refers to the total number of messages sent by a MAC address within 5 seconds, indicating the frequency of sending messages by the camera. The recv_num feature refers to the total number of messages received by a MAC address within 5 seconds, indicating the frequency of receiving messages by the camera. The data_type feature refers to the frame type of all messages sent by the MAC address within 5 seconds, and the average value is taken, indicating the tendency of the camera to send messages of different data types. The data_subtype feature refers to the frame subtype of all messages sent by the MAC address within 5 seconds, and the average value is taken, indicating the fine-grained data type of the camera sending messages, including whether it is a QoS message. The send_length_mean feature refers to the average length of all messages sent by the MAC address within 5 seconds, indicating the amount of information contained in each data sent by the camera. The send_length_var feature refers to the length variance of all messages sent by the MAC address within 5 seconds, indicating the variation amplitude of the camera sending data. The recv_length_mean feature refers to the average length of all messages received by the MAC address within 5 seconds, indicating the amount of information received by the camera. The recv_length_var feature refers to the length variance of all messages received by the MAC address within 5 seconds, indicating the variation amplitude of the camera receiving data. 3.The method of claim 1, wherein, In step 2, according to the message features corresponding to each MAC address extracted, the video stream recognition model M1 is used to recognize the message containing video stream information, and the source MAC address of the message is preliminarily identified as the camera address, that is, the MAC address set CS1 of the suspected camera is obtained. 4.The method of claim 1, wherein, In step 3, each MAC address in the source MAC address set CS1 represents a device sending video data, and the messages sniffed by wireless sniffing are classified according to MAC addresses, and the feature vector V of the messages within 5s for each MAC address is extracted, 10s-20s of messages are extracted each time, and different overlap degrees are set, that is, the feature vector sequence Vseq corresponding to each MAC address is obtained, and the feature vector sequence Vseq is used as the input of the camera traffic discovery model M2, and the output result indicates whether there is burst video traffic in the message corresponding to the MAC address within the last 10-20s.

5. The method of claim 1 or 4, wherein, The specific method of step A for constructing the multi-instance-based camera traffic discovery model M2 is as follows: First, use the wireless traffic sniffing method to collect the static picture data of the camera in an environment where no one is present, and in this process, all the collected traffic does not contain mobile traffic features, so it is used to generate negative example packet data. Subsequently, the dynamic picture data of the camera is collected by constantly entering and exiting the camera picture through keeping the moving state within and outside the camera monitoring range. In this process, the collected traffic contains positive and negative examples representing movement and stillness. A long time sequence is taken to generate a positive example package to ensure that there are some positive example data in the sequence except for an uncertain number of negative examples, which are marked as positive example packages.

6. A system for implementing the covert camera discovery method of multiple-instance learning according to any one of claims 1 to 5, characterized in that, The wireless sniffing module, the MAC address filtering module, the burst video stream analysis module and the comparison judgment module are included. The wireless sniffing module opens the mixed mode to perform air interface packet capturing on the WiFi signals in the region. In order to ensure that all possible hidden cameras are found, all channels in the 2.4G frequency band need to be frequency hopping collected. The MAC address filtering module extracts the feature vector from the sniffed message first, uses the video stream recognition model M1 based on the decision tree method to recognize the sniffed WiFi message, and obtains the MAC address set CS1 of the device sending the video stream. The burst video stream analysis module takes the MAC address set CS1 obtained through preliminary filtering as the basis, classifies each message containing the MAC source address, extracts the multi-example feature vector, uses the camera traffic discovery model to judge whether there is a burst video stream in the recent period of time, and compares the human body movement time period obtained through user interaction with the result of whether the message of a certain MAC source address in the time period appears a burst video stream. The comparison judgment module compares the human body movement time period obtained through user interaction with the result of whether the message of a certain MAC source address in the time period appears a burst video stream, obtains the device MAC address judged as a hidden camera, and finally obtains the number of hidden cameras in the region and the corresponding MAC address.

Images