Research On Intrusion Detection Technique For Video Surveillance Network

With the continuous popularization of video surveillance applications and the increasing development of the Internet,video surveillance equipment without security guarantees has given criminals many opportunities.In recent years,hacker attacks on network cameras have continued to be exposed.With the expansion of the scale of video surveillance networks,the security problems in the video surveillance network not only threaten the privacy and asset security of individuals,but the Io T botnet formed by large-scale video surveillance equipment also directly poses a devastating blow to Internet security.Therefore,it is particularly urgent and important to study an intrusion detection technology suitable for video surveillance network.Based on the above background,this dissertation analyzes and summarizes the possible attack scenarios in the video surveillance network,and studies different intrusion detection methods for different attack scenarios.The main results of this dissertation are as follows:(1)In recent years,RTSP(real time stream protocol)vulnerability related security issues have been exposed in video surveillance network.Based on the analysis and summary of attack characteristics of RTSP,such as malformed message attack,malicious command operation and abnormal interaction behavior of RTSP,an intrusion detection method for RTSP based on two-level filters is proposed.In this method,two levels of filters are used to realize intrusion detection of RTSP: the first level filter realizes the detection of malicious messages of RTSP,and the second level filter realizes the detection of abnormal interaction behavior of RTSP based on SVDD(Support Vector Domain Description).The detection of RTSP malicious message adopts the idea of intrusion detection based on specification,and realizes the detection of RTSP malicious message attack at the level of a single packet by defining secure syntax rules.Because some RTSP messages conform to the standard syntax rules,but the whole interaction behavior is abnormal,the goal of the second level filter is to detect the abnormal interaction behavior of RTSP at the session level,and the detected objects are all RTSP messages that are judged to be well structured by the first level filter.Generally,abnormal scenes are difficult to cover completely.Therefore,the second-level filter adopts the idea of intrusion detection based on anomalies,based on the SVDD single classification algorithm.A single-classification model is trained on the RTSP interaction data set,and all interactions that are judged as "not normal" by the single-classification model are considered abnormal.In this dissertation,the proposed two-level filters are tested and evaluated by experiments,and the RTSP intrusion detection method based on two-level filters is compared with the relevant work,showing the advantages of the proposed two-level filters.(2)In order to detect botnet attacks in video surveillance networks,an integrated machine learning model that can effectively detect botnet attacks has been proposed.The model is based on Differential Evolution(Differential Evolution,DE)algorithm and the extreme gradient boost(XGBoost)classifier to construct the optimization model DE-XGBoost.The DE-XGBoost model is based on the differential evolution algorithm to solve the hyperparameter optimization problem of the XGBoost model,and improves the detection performance of the model.Because of the continuous expansion of the video surveillance network,the amount of data is also increasing.In order to apply DE-XGBoost to online detection,this dissertation also reduces the dimensionality of the input features of the DE-XGBoost model based on the Fisher-score algorithm,by minimizing the intra-class distance and maximize the distance between classes to determine the most important features and discard irrelevant features.Finally,relevant experiments were conducted on the open botnet dataset using Hold-Out and 10-Fold techniques.The 10-Fold test result evaluation shows that,when the DE-XGBoost model uses only three stream attribute features,compared with recent related studies that also use three features on the N-Ba Io T dataset for three classifications,the classification accuracy obtained by DE-XGBoost is the highest,reaching99.96%,demonstrating the advantages of DE-XGBoost in classification performance.(3)Based on the above research,this dissertation implements a real-time intrusion detection system suitable for video surveillance networks.In order to test the system in the real video surveillance network environment,this dissertation also deploys the system to raspberry pi device,uses bypass deployment to monitor network traffic,and uses the the public attack tools attack the laboratory camera.Finally,it shows the test results of the system,verify the integrity and availability of the system function.