A knowledge graph-based video monitoring vulnerability detection method, device and medium

Abstract

This invention relates to the field of vulnerability detection technology, and in particular to a video surveillance vulnerability detection method, device, and medium based on a knowledge graph. The method includes: constructing a vulnerability knowledge graph based on vulnerability information corresponding to the operation logs of a preset monitoring device; updating the target weight matrix of a local graph neural network model on the preset monitoring device based on a model weight matrix issued by a given cloud server; inputting the vulnerability knowledge graph into the updated graph neural network model; outputting a vulnerability anomaly score corresponding to the operation logs; if the vulnerability anomaly score is greater than a preset score threshold, determining that the corresponding preset monitoring device has a video surveillance vulnerability anomaly, and simultaneously switching to a backup monitoring device on the preset monitoring device. This invention makes the local model more lightweight while also helping to improve the vulnerability detection accuracy of the local model, which is beneficial for timely discovery of high-risk vulnerabilities.

Description

Technical Field

[0001] This invention relates to the field of vulnerability detection technology, and in particular to a video surveillance vulnerability detection method, device, and medium based on knowledge graphs. Background Technology

[0002] With the rapid development of smart cities, security monitoring and other fields, the scale of video surveillance equipment deployed in roadside, public places and other areas is growing. As small servers at the network edge, these surveillance devices inevitably have various security vulnerabilities in their software systems, and there is also the possibility of attackers using these vulnerabilities to intrude, which can lead to serious consequences such as abnormal monitoring functions, leakage or tampering of video data.

[0003] Currently, there are two common detection solutions for such device vulnerabilities. First, analysis is performed centrally on cloud servers. Although this can utilize the powerful computing capabilities of the cloud to build complex detection models, it requires continuously uploading the device's local operation logs and vulnerability data to the cloud, resulting in significant data transmission delays and an inability to respond to high-risk vulnerabilities in real time. Second, isolated vulnerability analysis is performed directly on the monitoring device. Although this avoids data transmission delays, it is limited by the limited computing resources on the edge, making it difficult to deploy complex detection models, resulting in a low accuracy rate for detecting video surveillance vulnerabilities. Summary of the Invention

[0004] To address the aforementioned technical problems, this invention provides a video surveillance vulnerability detection method, device, and medium based on knowledge graphs. By associating different vulnerability types through knowledge graphs and combining them with model weights distributed from cloud servers, the local model becomes lighter and its vulnerability detection accuracy is improved, which is beneficial for timely discovery of high-risk vulnerabilities.

[0005] According to a first aspect of the present invention, a video surveillance vulnerability detection method based on knowledge graphs is provided, comprising the following steps:

[0006] Based on the operation log of any preset monitoring device in the current time period, obtain the vulnerability information corresponding to the operation log, and construct a vulnerability knowledge graph based on the vulnerability information; the vulnerability information includes vulnerability data, vulnerability type, and the degree of correlation between each pair of vulnerability types.

[0007] Receive the model weight matrix sent from the cloud server to the preset monitoring device, update the target weight matrix of the graph neural network model pre-trained locally on the preset monitoring device, and obtain the updated graph neural network model.

[0008] The vulnerability knowledge graph is input into the updated graph neural network model, and the vulnerability anomaly score corresponding to the running log is output. The vulnerability anomaly score is used to characterize the degree of impact of vulnerability information on the monitoring performance of preset monitoring devices. The given cloud server communicates with several preset monitoring devices.

[0009] If the vulnerability anomaly score exceeds the preset score threshold, it is determined that the corresponding preset monitoring device has a video monitoring vulnerability anomaly, and the local backup monitoring device of the preset monitoring device is switched at the same time.

[0010] According to a second aspect of the present invention, a non-transitory computer-readable storage medium is provided, wherein at least one instruction or at least one program is stored therein, the at least one instruction or the at least one program being loaded and executed by a processor to implement the above-described knowledge graph-based video surveillance vulnerability detection method.

[0011] According to a third aspect of the present invention, an electronic device is provided, including a processor and the aforementioned non-transitory computer-readable storage medium.

[0012] The present invention has at least the following beneficial effects:

[0013] This invention provides a knowledge graph-based video surveillance vulnerability detection method. First, a vulnerability knowledge graph is constructed based on vulnerability information corresponding to the operation logs of a preset monitoring device. Associating different vulnerability types through the knowledge graph helps improve the vulnerability detection accuracy of the local model. Then, the target weight matrix of the local graph neural network model on the preset monitoring device is updated based on a model weight matrix issued by a given cloud server, ensuring vulnerability detection accuracy while making the local model more lightweight. Finally, the vulnerability knowledge graph is input into the updated graph neural network model, outputting a vulnerability anomaly score corresponding to the operation logs. If the vulnerability anomaly score is greater than a preset score threshold, it is determined that the corresponding preset monitoring device has a video surveillance vulnerability anomaly, and a backup monitoring device is simultaneously switched to the local preset monitoring device. By analyzing the vulnerability knowledge graph locally on the preset monitoring device, the delay in data transmission over the network is avoided, which is beneficial for timely detection of high-risk vulnerabilities and timely switching of monitoring devices, ensuring the integrity of the surveillance video. Attached Figure Description

[0014] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0015] Figure 1A flowchart of a knowledge graph-based video surveillance vulnerability detection method provided in an embodiment of the present invention. Detailed Implementation

[0016] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0017] This invention provides a knowledge graph-based method for detecting video surveillance vulnerabilities, such as... Figure 1 As shown, the method includes the following steps:

[0018] S1. Based on the operation logs of any preset monitoring device during the current time period, obtain the vulnerability information corresponding to the operation logs, and construct a vulnerability knowledge graph based on the vulnerability information; the vulnerability information includes vulnerability data, vulnerability types, and the degree of correlation between each pair of vulnerability types. In specific implementations, the log sources corresponding to the operation logs include system logs, application logs, security logs, specific component logs, etc.; it can be understood that the vulnerability data is the program field where the vulnerability occurs.

[0019] Specifically, the vulnerability type is any one of the following: system privilege escalation vulnerability, remote code execution vulnerability, sensitive information disclosure vulnerability, denial-of-service attack vulnerability, and video stream data tampering or theft vulnerability.

[0020] Further, the vulnerability type can be obtained through the following steps:

[0021] S101 performs data cleaning and feature extraction on the operation logs of the preset monitoring equipment in the current time period, transforming the unstructured operation logs into structured log data.

[0022] S102, based on a predefined vulnerability feature rule base, extract several key behavioral features from structured log data; the vulnerability feature rule base contains a predefined mapping relationship between behavioral features and vulnerability types. For example, by detecting the successful or failed execution of commands such as sudo, su, and passwd, determine whether a system privilege escalation vulnerability exists; by detecting abnormal outbound / inbound connections or a large number of identical requests within a short period of time, determine whether a denial-of-service attack vulnerability exists; and by detecting abnormal writing of video configuration files, determine whether a video stream data tampering vulnerability exists.

[0023] S103, the extracted key behavioral features are matched with each preset behavioral feature in the vulnerability feature rule base to obtain at least one vulnerability type. For example, matching can be performed by calculating the semantic similarity between the key behavioral features and the preset behavioral features.

[0024] In one implementation, constructing a vulnerability knowledge graph based on vulnerability information includes the following steps:

[0025] S110: Iterate through the historical vulnerability information of each preset monitoring device and count the frequency of each of the two vulnerability types occurring together on the same preset monitoring device within a preset time window.

[0026] S130, based on the frequency, calculate the correlation degree between each pair of vulnerability types, and filter out each pair of vulnerability types whose correlation degree is greater than a preset correlation degree threshold; this can be understood as: the frequency at which two vulnerability types co-occur on the same preset monitoring device within a preset time window is taken as the correlation degree between the two vulnerability types. Considering that two unrelated vulnerability types may also occasionally co-occur, two vulnerability types with a high correlation degree are considered to be mutually related.

[0027] S150 constructs a vulnerability knowledge graph by treating all vulnerability types as entities, the relationships between vulnerability types as edges, and the degree of association between each pair of selected vulnerability types as the weight of the corresponding edge. This can be understood as: no edge weight needs to be assigned to the edges between two unrelated vulnerability types.

[0028] In another implementation, the degree of correlation between each pair of vulnerability types is also obtained through the following steps:

[0029] S120, For any preset monitoring device, construct a reference sequence and m comparison sequences corresponding to the preset monitoring device; wherein, the reference sequence is obtained by combining the given anomaly scores of the preset monitoring device at each preset time point according to the time sequence; it can be understood that: the given anomaly score is the vulnerability anomaly score obtained in advance.

[0030] Specifically, m represents the total number of vulnerability types, and the j-th comparison sequence is obtained by combining the occurrences of the j-th vulnerability type at each preset time point according to the time sequence. For example, when it occurs, it is recorded as 1, and when it does not occur, it is recorded as 0.

[0031] S140, dimensionless processing is performed on the reference sequence and each comparison sequence, and the correlation coefficient between each processed comparison sequence and the processed reference sequence is calculated at each preset time point.

[0032] Specifically, the correlation coefficient between each processed comparison sequence and the processed reference sequence meets the following conditions:

[0033] , where ξ j (t) represents the correlation coefficient between the processed j-th comparison sequence and the processed reference sequence at the t-th preset time point, Δ j (t) represents the difference between the given anomaly score at the t-th preset time point and the value of the j-th comparison sequence at the t-th preset time point, ΔD. max The global maximum difference, ΔD min ρ represents the global minimum difference, and ρ is the preset resolution coefficient. In specific implementations, ρ can be taken as 0.5.

[0034] S160, for each vulnerability type, the average of the correlation coefficients of the vulnerability type itself at all preset time points is taken as the degree of correlation between the vulnerability type itself and the given anomaly score.

[0035] S180, calculate the correlation between each pair of vulnerability types based on the correlation between each pair of vulnerability types and the given anomaly score.

[0036] Specifically, the correlation between any two vulnerability types meets the following conditions:

[0037] E ab r represents the degree of correlation between vulnerability type a and vulnerability type b. a r represents the degree of correlation between the a-th vulnerability type and a given anomaly score. b This represents the degree of correlation between the b-th vulnerability type and a given anomaly score.

[0038] By using the above-mentioned method of calculating correlation, effective analysis can be initiated based on limited historical data from monitoring equipment. The calculation process is relatively simple and suitable for efficient processing on resource-constrained monitoring equipment. Furthermore, by setting reference sequences, the overall correlation between each vulnerability type and the final system vulnerability anomaly can be directly discovered, making the calculation results more accurate.

[0039] As described above, by determining the vulnerability type and the degree of correlation between different vulnerability types, the overall situation of vulnerabilities can be analyzed from two dimensions: the vulnerability itself and related vulnerabilities. Furthermore, by constructing a knowledge graph, isolated vulnerabilities can be organized through their inherent connections, providing a structured input for the graph neural network model. This enables the model to use graph structure information for reasoning, which helps improve the detection accuracy of video surveillance vulnerability anomalies.

[0040] S2 receives the model weight matrix sent from the given cloud server to the preset monitoring device, updates the target weight matrix of the graph neural network model pre-trained locally on the preset monitoring device, and obtains the updated graph neural network model.

[0041] Specifically, the step of distributing the model weight matrix to the given cloud server includes:

[0042] S201, based on a pre-acquired vulnerability sample set corresponding to several preset monitoring devices, a graph neural network model in a given cloud server is trained to generate a graph neural network model with L layers, where L > 1; each vulnerability sample in the vulnerability sample set includes a vulnerability knowledge graph sample and a vulnerability anomaly score corresponding to the vulnerability knowledge graph sample. Those skilled in the art are familiar with the specific training process of the graph neural network model based on the knowledge graph, and it will not be described in detail here.

[0043] Furthermore, the calculation steps for the vulnerability anomaly score corresponding to the vulnerability knowledge graph sample are as follows:

[0044] S2011, based on the historical vulnerability information corresponding to each preset monitoring device, obtains several preset operating indicators corresponding to each historical vulnerability information for each preset monitoring device through the cloud server; it can be understood that: the several preset operating indicators corresponding to the historical vulnerability information can be several preset operating indicators statistically obtained within the historical time period after extending the time period corresponding to the historical vulnerability information by a preset time step.

[0045] Specifically, the preset operating indicators include video stream frame rate, video bitrate, network packet loss rate, image black screen probability, and AI analysis function failure rate; which can be understood as: the AI ​​analysis function failure rate is the ratio of AI task failure or timeout; for example, AI tasks can be face recognition, vehicle detection, etc.

[0046] S2012, for any historical vulnerability information corresponding to several preset operating indicators, calculate the degree of abnormality corresponding to each preset operating indicator based on several preset key thresholds corresponding to each preset operating indicator and the threshold range in which the value of each preset operating indicator falls; the preset key thresholds are any one of preset excellent values ​​and preset critical values. For example, the preset excellent value and preset critical value corresponding to the video stream frame rate are set to 25fps and 10fps, respectively.

[0047] To facilitate understanding of the calculation process, taking video stream frame rate as an example, the degree of anomaly corresponding to the video stream frame rate meets the following conditions:

[0048] Where C represents the degree of abnormality corresponding to the video stream frame rate, x represents the value of the video stream frame rate, G0 represents the preset good value corresponding to the video stream frame rate, and P0 represents the preset critical value corresponding to the video stream frame rate.

[0049] S2013, based on the degree of anomaly corresponding to each preset operational indicator and the preset indicator weight corresponding to each preset operational indicator, calculate the vulnerability anomaly score corresponding to the historical vulnerability information itself; wherein, the vulnerability anomaly score meets the following conditions:

[0050] Where F represents the vulnerability anomaly score, and S... i For the i-th preset operating indicator, W i For S i The corresponding preset indicator weights, where n is the number of preset operating indicators, W1 to W n The sum is 1.

[0051] Preferably, W1 > W2 > W3 > W4 > W5, where W1 to W5 are respectively the probability of image black screen, video stream frame rate, AI analysis function failure rate, network packet loss rate, and video bitrate.

[0052] The above-mentioned method, by pre-setting multiple operational indicators related to video anomalies, makes the calculated vulnerability anomaly score closer to the potential real failure situation of video surveillance. This score is used as the real label when training the graph neural network model, so that the trained model can assess the potential risks caused by the current vulnerability, taking into account the synergistic effect between different vulnerability types. For example, when the calculated vulnerability anomaly score is high, even if there are not many real failures of the monitoring equipment, it can still achieve early warning based on the timely detection of potential risks.

[0053] S202, For any preset monitoring device, obtain the number of layers K of the graph neural network model in the preset monitoring device; where 1≤K<L.

[0054] S203, Select the model weight matrices corresponding to the first K layers of the graph neural network model in the cloud server and send them to the preset monitoring device to replace the target weight matrices of the K layers of the graph neural network model in the preset monitoring device. This can be understood as: updating the target weight matrix of each layer of the graph neural network model in the preset monitoring device one by one according to the same number of layers.

[0055] As mentioned above, cloud servers, with their abundant memory resources, can deploy more layered and powerful graph neural network models. They can also integrate vulnerability information from several pre-set monitoring devices and learn from more sample data, making the weight matrix of the updated graph neural network model more accurate and reliable. In contrast, pre-set monitoring devices have limited local resources and only need to update their own weight matrix based on the model weights trained on the cloud server. This makes the deployed graph neural network model more lightweight, ensuring the accuracy of vulnerability detection while reducing the consumption of storage and computing resources on the monitoring devices.

[0056] S3, input the vulnerability knowledge graph into the updated graph neural network model, and output the vulnerability anomaly score corresponding to the running log; the vulnerability anomaly score is used to characterize the degree of impact of vulnerability information on the monitoring performance of the preset monitoring equipment.

[0057] Specifically, the given cloud server communicates with several preset monitoring devices; this can be understood as follows: after updating its own graph neural network model, the given cloud server distributes the updated weights to each preset monitoring device.

[0058] As described above, a knowledge graph is built locally on the pre-set monitoring device, and the vulnerability anomaly score is obtained directly through the deployed graph neural network model. The analysis process is completed locally, avoiding the delay of data transmission over the network. This is beneficial for immediately triggering the local defense mechanism and switching to the backup monitoring device when a high-risk vulnerability is discovered. In contrast, the cloud server has to process the vulnerability information of several monitoring devices in sequence, resulting in lower processing efficiency. Furthermore, even if the monitoring device loses connection with the remote end, it still has independent analysis and decision-making capabilities, ensuring the normal operation of vulnerability detection for a single monitoring device.

[0059] S4. If the vulnerability anomaly score is greater than the preset score threshold, it is determined that the corresponding preset monitoring device has a video monitoring vulnerability anomaly, and the local backup monitoring device of the preset monitoring device is switched at the same time. This can be understood as: if the vulnerability anomaly score is not greater than the preset score threshold, it is considered that the vulnerability anomaly is small and does not affect video monitoring.

[0060] Furthermore, step S4 also includes the following steps:

[0061] S401: When it is determined that the corresponding preset monitoring device has a video monitoring vulnerability, the identifier of the preset monitoring device with the video monitoring vulnerability is sent to the given cloud server, so that the cloud server sends a patch package to the corresponding preset monitoring device.

[0062] S402: When the preset monitoring device has been updated based on the patch package, switch back to the preset monitoring device and shut down the backup monitoring device. At the same time, store the monitoring video of the backup monitoring device to the local of the preset monitoring device in chronological order.

[0063] As described above, by pre-setting monitoring equipment to perform vulnerability and anomaly detection locally, it is possible to switch to backup monitoring equipment in a timely manner when video monitoring vulnerabilities or anomalies occur, preventing the omission of video monitoring. Furthermore, the monitoring videos are stored after being linked with the monitoring videos from previous times according to the time sequence, which can ensure the integrity of the monitoring videos.

[0064] Embodiments of the present invention also provide a non-transitory computer-readable storage medium, which can be disposed in an electronic device to store at least one instruction or at least one program related to implementing a method in the method embodiments. The at least one instruction or the at least one program is loaded and executed by the processor to implement the knowledge graph-based video surveillance vulnerability detection method provided in the above embodiments.

[0065] Embodiments of the present invention also provide an electronic device, including a processor and the aforementioned non-transitory computer-readable storage medium.

[0066] While specific embodiments of the invention have been described in detail by way of example, those skilled in the art should understand that the examples are for illustrative purposes only and not intended to limit the scope of the invention. It should also be understood that various modifications can be made to the embodiments without departing from the scope and spirit of the invention. The scope of the invention is defined by the appended claims.

Claims

1. A video surveillance vulnerability detection method based on knowledge graphs, characterized in that, The method includes the following steps: Based on the operation log of any preset monitoring device in the current time period, obtain the vulnerability information corresponding to the operation log, and construct a vulnerability knowledge graph based on the vulnerability information; the vulnerability information includes vulnerability data, vulnerability type, and the degree of correlation between each pair of vulnerability types; The process involves receiving a model weight matrix from a given cloud server and sending it to a preset monitoring device. This matrix is ​​then used to update the target weight matrix of a pre-trained graph neural network model on the preset monitoring device, resulting in an updated graph neural network model. Specifically, the step of sending the model weight matrix from the given cloud server includes: training the graph neural network model on the given cloud server based on a pre-acquired vulnerability sample set corresponding to several preset monitoring devices, generating a graph neural network model with L layers, where L > 1; each vulnerability sample in the vulnerability sample set includes a vulnerability knowledge graph sample and a vulnerability anomaly score corresponding to the vulnerability knowledge graph sample; for any preset monitoring device, obtaining the number of layers K of the graph neural network model on the preset monitoring device, where 1 ≤ K < L; and sending the model weight matrices corresponding to the first K layers of the graph neural network model on the cloud server to the preset monitoring device to replace the target weight matrix of the K layers of the graph neural network model on the preset monitoring device. The vulnerability knowledge graph is input into the updated graph neural network model, and the vulnerability anomaly score corresponding to the running log is output; the vulnerability anomaly score is used to characterize the degree of impact of vulnerability information on the monitoring performance of preset monitoring devices; the given cloud server communicates with several preset monitoring devices; If the vulnerability anomaly score exceeds the preset score threshold, it is determined that the corresponding preset monitoring device has a video monitoring vulnerability anomaly, and the local backup monitoring device of the preset monitoring device is switched at the same time.

2. The video surveillance vulnerability detection method based on knowledge graphs according to claim 1, characterized in that, To obtain the vulnerability type, follow these steps: Data cleaning and feature extraction are performed on the operation logs of the preset monitoring equipment in the current time period to transform unstructured operation logs into structured log data; Based on a predefined vulnerability feature rule base, several key behavioral features are extracted from structured log data; the vulnerability feature rule base contains a predefined mapping relationship between behavioral features and vulnerability types. The extracted key behavioral features are matched with each preset behavioral feature in the vulnerability feature rule base to obtain at least one vulnerability type.

3. The video surveillance vulnerability detection method based on knowledge graphs according to claim 1, characterized in that, The process of constructing a vulnerability knowledge graph based on vulnerability information includes the following steps: Iterate through the historical vulnerability information of each preset monitoring device and count the frequency of each two vulnerability types occurring together on the same preset monitoring device within a preset time window. Based on the frequency, calculate the degree of correlation between each pair of vulnerability types, and filter out each pair of vulnerability types whose degree of correlation is greater than a preset degree of correlation threshold; A vulnerability knowledge graph is constructed by treating all vulnerability types as entities, the relationships between vulnerability types as edges, and the degree of association between any two selected vulnerability types as the weight of the corresponding edge.

4. The video surveillance vulnerability detection method based on knowledge graphs according to claim 1, characterized in that, The degree of correlation between each pair of vulnerability types was also determined through the following steps: For any preset monitoring device, construct a reference sequence and m comparison sequences corresponding to the preset monitoring device; wherein, the reference sequence is obtained by combining the given anomaly scores of the preset monitoring device at each preset time point according to the time sequence; m is the total number of vulnerability types, and the i-th comparison sequence is obtained by combining the occurrence of the i-th vulnerability type at each preset time point according to the time sequence. The reference sequence and each comparison sequence are dimensionless, and the correlation coefficient between each processed comparison sequence and the processed reference sequence is calculated at each preset time point. For each vulnerability type, the average of the correlation coefficients of the vulnerability type itself at all preset time points is taken as the degree of correlation between the vulnerability type itself and the given anomaly score. The correlation between each pair of vulnerability types is calculated based on the degree of correlation between each pair of vulnerability types and the given anomaly score.

5. The video surveillance vulnerability detection method based on knowledge graphs according to claim 1, characterized in that, The calculation steps for the vulnerability anomaly score corresponding to the vulnerability knowledge graph sample are as follows: Based on the historical vulnerability information corresponding to each preset monitoring device, several preset operating indicators corresponding to each historical vulnerability information are obtained through the cloud server; the several preset operating indicators include video stream frame rate, video bit rate, network packet loss rate, image black screen probability and AI analysis function failure rate. For any historical vulnerability information, several preset operational indicators are used. Based on several preset key thresholds corresponding to each preset operational indicator and the threshold range in which the value of each preset operational indicator is located, the degree of abnormality corresponding to each preset operational indicator is calculated. The preset key threshold is either a preset excellent value or a preset critical value; Based on the degree of anomaly corresponding to each preset operational indicator and the preset indicator weight corresponding to each preset operational indicator, the vulnerability anomaly score corresponding to the historical vulnerability information itself is calculated; wherein, the vulnerability anomaly score meets the following conditions: Where F represents the vulnerability anomaly score, and S... i For the i-th preset operating indicator, W i For S i The corresponding preset indicator weights, where n is the number of preset operating indicators, W1 to W n The sum is 1.

6. The video surveillance vulnerability detection method based on knowledge graphs according to claim 1, characterized in that, The vulnerability type is any one of the following: system privilege escalation vulnerability, remote code execution vulnerability, sensitive information disclosure vulnerability, denial-of-service attack vulnerability, and video stream data tampering or theft vulnerability.

7. The video surveillance vulnerability detection method based on knowledge graphs according to claim 1, characterized in that, The method further includes the following steps: When it is determined that the corresponding preset monitoring device has a video monitoring vulnerability, the identifier of the preset monitoring device with the video monitoring vulnerability will be sent to the given cloud server, so that the cloud server will send a patch package to the corresponding preset monitoring device. When the preset monitoring device is updated based on the patch package, switch back to the preset monitoring device and shut down the backup monitoring device. At the same time, store the monitoring video of the backup monitoring device to the local of the preset monitoring device in chronological order.

8. A non-transitory computer-readable storage medium, wherein the storage medium stores at least one instruction or at least one program segment, characterized in that, The at least one instruction or the at least one program segment is loaded and executed by the processor to implement the knowledge graph-based video surveillance vulnerability detection method as described in any one of claims 1-7.

9. An electronic device, characterized in that, Includes a processor and the non-transitory computer-readable storage medium as described in claim 8.

Images