zCamDetector: Dual Camera Detection Approaches

• zCamDetector is a dual-modality camera detection system that integrates vision-based CCTV mapping and flow-based anomaly detection.
• The vision-based component leverages deep learning models on geo-tagged imagery with COCO annotations to achieve high accuracy in identifying camera instances.
• The flow-based component employs one-class classifiers on 62 network flow features to robustly detect zero-day IoT cameras in diverse traffic conditions.

Searching arXiv for the cited works and the term "zCamDetector". zCamDetector denotes two distinct camera-detection systems in the supplied literature. In one usage, it refers to a computer-vision detector for CCTV and video surveillance cameras in geo-location tagged imagery, derived from the MS COCO-compatible detectors introduced in "Towards large-scale, automated, accurate detection of CCTV camera objects using computer vision. Applications and implications for privacy, safety, and cybersecurity." (Turtiainen et al., 2020). In another, it refers to the zero-day camera detector component of zCamInspector, which identifies previously unseen IoT cameras from 62 generic flow-based features extracted by CICFlowmeter and processed by one-class classifiers (Chaudhary et al., 10 Sep 2025). The term therefore spans two different sensing modalities: image-space object detection and network-flow anomaly detection.

1. Scope and nomenclature

In the computer-vision usage, zCamDetector is a blueprint for CCTV-camera object detection on geo-location tagged images, such as street view imagery on various platforms and user images publicly posted in image sharing platforms such as Flickr. Its stated purpose is to support CCTV-aware solutions, including mapping systems that provide privacy and safety routing and navigation options, which in turn require updated information on CCTV cameras' exact geo-location, coverage area, and possibly other meta-data (Turtiainen et al., 2020).

In the network-security usage, zCamDetector is the zero-day camera detector within zCamInspector. It is designed for identifying whether a new device, especially a streaming IoT camera, has joined the network. The detector operates on flow-based features extracted in an application-agnostic (NAT-agnostic) way and is trained as a one-class anomaly detector rather than as an image detector (Chaudhary et al., 10 Sep 2025).

A concise comparison is given below.

Usage	Input	Output
Vision-based zCamDetector	Geo-tagged images or video frames	COCO JSON of CCTV camera boxes + subtype
Flow-based zCamDetector	Unidirectional flows within a 600 s window	Anomalous-camera vs. background decision

This dual usage matters because the same label is attached to systems with different observables, loss functions, metrics, and operational goals. This suggests that the term should be interpreted contextually rather than as a single standardized architecture.

2. Vision-based zCamDetector: data model and detection pipeline

The vision-based formulation is built around a CCTV-camera dataset, "DatasetAll", with 8 387 training images containing 10 419 annotated cameras, 533 validation images with 647 instances, and a withheld testing set of approximately 2 000 street-view images with approximately 2 800 instances (Turtiainen et al., 2020). Cameras were labeled with tight polygons and COCO-style bounding boxes. The annotations distinguish the subtypes "directed" and "round", but detection treats all instances as one class, "camera". Dataset0/1 used Wada’s Labelme with output converted to COCO JSON, whereas Dataset2 and the merged DatasetAll used a custom browser-extension COCO annotator to crowd-source polygons.

The detector families explored in this blueprint comprise four groups: anchor-free one-stage detectors, multi-branch scale-aware detectors, and hybrid Cascade detectors. The anchor-free one-stage group includes CenterMask2 with VoVNet-V2–Lite-39, V-57-eSE, and V-99-eSE backbones, and ATSS with ResNet-50(-dcnv2) and ResNeXt-101-(32×4d,-dcnv2). The multi-branch scale-aware group uses TridentNet with a ResNet-101 C4 backbone. The hybrid Cascade group includes ResNeSt-200 + Cascade R-CNN (FPN + SyncBN), trained in Detectron2, and DetectoRS (Recursive FPN + SAC) on ResNet-50, trained in MMDetection. Each model uses an FPN neck and per-level detection heads (Turtiainen et al., 2020).

The detection pipeline is explicit. Input preprocessing reads the image, applies random horizontal flip, resizes the short side to 640–800 px with maximum long side 1333, and normalizes by ImageNet mean/std. The backbone feeds the FPN. In anchor-free FCOS-style variants, per-level convolutional heads output a camera-presence score $p(x,y)$, regression offsets $t(x,y) = (\Delta l,\Delta t,\Delta r,\Delta b)$, and a centerness score $c(x,y)$. In Cascade R-CNN variants, the pipeline uses RPN anchors, ROIAlign, and three sequential heads, each with classification and box regression. Post-processing multiplies $p \times c$ for FCOS, thresholds at 0.05, applies per-class NMS at $\mathrm{IoU}=0.5$, keeps top-$K$ detections such as 100, and emits COCO JSON with (image_id, category_id=1, bbox=[x,y,w,h], score).

Training augmentations include random multi-scale resizing with short side in $[640,800]$ px and long side $\le 1333$, random horizontal flip, and optional auto-adjust operations for contrast, exposure, equalize, and hue/saturation. The reported train/validation split is approximately 94%/6%, with the test set held entirely out.

The loss functions follow conventional detector structure. For anchor-free FCOS, classification may use binary cross-entropy,

$L_{\mathrm{cls}} = -(y \log p + (1-y)\log(1-p)),$

or Focal Loss,

$$L_{\mathrm{cls}}(p,y)= -\alpha y(1-p)^\gamma \log p-(1-\alpha)(1-y)p^\gamma \log(1-p).$$

Centerness uses binary cross-entropy on centerness targets. Localization uses Smooth L1,

$t(x,y) = (\Delta l,\Delta t,\Delta r,\Delta b)$0

with

$t(x,y) = (\Delta l,\Delta t,\Delta r,\Delta b)$1

For Cascade R-CNN, the RPN uses cross-entropy plus Smooth L1 for anchor refinement.

3. Vision-based zCamDetector: evaluation, accuracy, and compute profile

The vision detector is evaluated with AP@IoU=0.50, AP@[0.50:0.95] with step 0.05, AR@[maxDet=100], AP_M for objects of size $t(x,y) = (\Delta l,\Delta t,\Delta r,\Delta b)$2–$t(x,y) = (\Delta l,\Delta t,\Delta r,\Delta b)$3 px, AP_L for objects larger than $t(x,y) = (\Delta l,\Delta t,\Delta r,\Delta b)$4 px, and $t(x,y) = (\Delta l,\Delta t,\Delta r,\Delta b)$5, where

$t(x,y) = (\Delta l,\Delta t,\Delta r,\Delta b)$6

An example AP definition is also provided:

$t(x,y) = (\Delta l,\Delta t,\Delta r,\Delta b)$7

over IoU thresholds $t(x,y) = (\Delta l,\Delta t,\Delta r,\Delta b)$8 (Turtiainen et al., 2020).

On the held-out test set at 800 px short side, ResNeSt-200 achieves AP50 of 92.0%, AP50:95 of 71.4%, AP_M of 91.5%, AP_L of 96.0%, AR100 of 94.5%, and F1@50 of 93.2%. DetectoRS achieves AP50 of 91.5%, AP50:95 of 68.9%, AP_M of 91.1%, AP_L of 93.9%, AR100 of 93.1%, and F1@50 of 92.3%. On the validation set at the same short side, ResNeSt-200 reaches AP50 of 97.3%, AP50:95 of 80.1%, AP_M of 96.8%, AP_L of 98.7%, AR100 of 98.4%, and F1@50 of 97.8%; DetectoRS reaches AP50 of 98.7%, AP50:95 of 83.4%, AP_M of 99.2%, AP_L of 98.8%, AR100 of 99.5%, and F1@50 of 98.5%. The associated paper abstract reports that the best detectors were built using 8 387 images manually reviewed and annotated to contain 10 419 CCTV camera instances, and achieve an accuracy of up to 98.7% (Turtiainen et al., 2020).

Inference timings were measured on NVIDIA Tesla V100 GPUs with 32 GB memory. ResNeSt-200 runs at 0.171 s per image, approximately 5.8 FPS, while DetectoRS with ResNet-50 runs at 0.130 s per image, approximately 7.7 FPS. Training was performed on nodes with 4×V100 or 4×P100 GPUs and 384 GB RAM. The documented trade-off is that Cascade models give higher [email protected]:0.95 but run approximately 20–30% slower than single-stage models, while lower-capacity backbones run approximately 2× faster at approximately 5–7 FPS but lose approximately 1–2% AP50.

These figures place the vision-based zCamDetector in a regime where bounding-box accuracy and deployment speed are jointly optimized rather than treated separately. A plausible implication is that the blueprint is aimed not only at offline dataset evaluation but also at image-ingestion pipelines that must process street-level imagery at scale.

4. Flow-based zCamDetector: feature space, one-class learning, and protocol

Within zCamInspector, the flow-based zCamDetector uses 62 non-constant, generic flow-based features extracted by CICFlowmeter in an application-agnostic (NAT-agnostic) way (Chaudhary et al., 10 Sep 2025). A flow is defined as a unidirectional sequence of packets sharing the same 6-tuple (SrcIP, DstIP, SrcPort, DstPort, Protocol, FlowID) within a 600 s window. The feature set includes Flow Duration; Total Forward and Backward Packets; Total Forward and Backward Bytes; Forward and Backward Packet Length statistics; Flow Bytes/sec and Flow Packets/sec; Flow IAT statistics; Forward and Backward IAT totals and statistics; Initial Forward and Backward Window Bytes for TCP; ACK, FIN, SYN, RST, PSH, and URG flag counts; Forward and Backward Header Length totals; and other engineered features such as flow_iat_tot and active/idle mean and std.

The detector supports four one-class classification methods. One-Class SVM minimizes

$t(x,y) = (\Delta l,\Delta t,\Delta r,\Delta b)$9

subject to

$c(x,y)$0

with $c(x,y)$1 controlling the fraction of allowed outliers. SGD-OCSVM reformulates OCSVM with hinge loss for SGD updates:

$c(x,y)$2

Isolation Forest builds an ensemble of random binary trees and scores a sample $c(x,y)$3 by

$c(x,y)$4

where shorter expected path lengths imply greater anomaly. DeepSVDD learns a deep map $c(x,y)$5 so that training samples lie within a minimum-volume hypersphere of center $c(x,y)$6 and radius $c(x,y)$7:

$c(x,y)$8

The data are organized into three sets. Set I (BITSPHC) contains lab-collected flows from 6 commercial IoT cameras, approximately 15 GB and 119 k flows. Set II (UNSW) is an open dataset with 5 different cameras, approximately 1.5 GB and 40 k flows. Set III (Others) contains non-camera traffic, namely audio/video conferencing, video streaming, and benign apps, approximately 22.6 GB and 80 k flows. Zero-day detection is evaluated in three scenarios: all cameras zero-day, all but one zero-day, and only one zero-day. For each model and scenario, the protocol extracts the top 10 features via an Extra-Trees feature-importance ranking to speed up training, uses a hold-out strategy within Set III for hyperparameter tuning with a 10% test split, and finally computes detection rates on the true zero-day test set.

This design differs fundamentally from the vision detector: it does not localize cameras in images but instead identifies distinctive flow patterns of streaming cameras against background traffic. The supplied description therefore places zCamDetector at the interface between anomaly detection, traffic analysis, and device identification.

5. Flow-based zCamDetector: empirical performance and hyperparameters

For the scenario in which all cameras are treated as zero-day and training uses Set III only while testing uses Set I∪II, the reported accuracies are as follows (Chaudhary et al., 10 Sep 2025).

Model	Training Acc.	Test Acc.
OCSVM $c(x,y)$9	93.20%	93.20%
SGD-OCSVM $p \times c$0	96.55%	96.55%
IsolationForest $p \times c$1	78.65%	78.65%
DeepSVDD	92.16%	92.16%

In this scenario, accuracy is defined as the fraction of test flows correctly labeled anomalous camera versus background Others. The broader article abstract reports that for zero-day detection, accuracies reached 93.20% for OCSVM, 96.55% for SGDOCSVM, 78.65% for IF, and 92.16% for DeepSVDD, and that when all devices were treated as zero-day, DeepSVDD performed best with mean training/testing accuracies of 96.03%/74.51% (Chaudhary et al., 10 Sep 2025).

In the "all but one" zero-day scenario, mean test accuracies over 11 leave-one-out experiments vary by model: OCSVM gives 50–85% with standard deviation up to ±12%, SGD-OCSVM gives 35–96% with standard deviation up to ±16%, IsolationForest gives 15–90% with standard deviation up to ±1.0%, and DeepSVDD gives 52–99% with standard deviation as low as ±0.2%. DeepSVDD is the only model that exceeds 90% detection accuracy in 7/11 camera-leave-out tests. In the "only one" zero-day scenario, DeepSVDD still exceeds 80% detection in 9/11 cases, whereas OCSVM and IF often drop below 50%.

For DeepSVDD in scenario A, the reported ROC values are $p \times c$2 and $p \times c$3. At a 95th-percentile threshold, DeepSVDD yields approximately 5% FPR on Others and approximately 87–95% TPR on camera flows.

The documented hyperparameters are specific. OCSVM uses $p \times c$4 and $p \times c$5 with an RBF kernel. SGD-OCSVM uses $p \times c$6, initial learning rate $p \times c$7, and a hinge-loss objective. IsolationForest uses n_estimators=100, contamination=0.10, and max_features="auto". DeepSVDD uses the network FC(10→512)–ReLU–FC(512→512)–ReLU–FC(512→8), learning rate $p \times c$8 with Adam, 150 epochs, and a threshold set at the 95th percentile of training distances. Hyperparameters were chosen by 5-fold cross-validation on the training split of Set III for one-class models.

The robustness discussion states that zCamDetector degrades gracefully when only a subset of cameras has been seen, that DeepSVDD maintains greater than 80% TPR on most held-out devices, and that the one-class models can reliably isolate the distinct flow patterns of streaming cameras even in the presence of high-volume non-IoT-camera audio/video conferencing traffic such as Meet, Teams, and Zoom and video-sharing traffic such as YouTube and Prime. Among the one-class methods, DeepSVDD is described as least sensitive to the choice of known device(s), with very small standard deviation across repeated leave-one-out trials.

6. Applications, limitations, and future directions

The vision-based formulation is motivated by privacy, safety, and cybersecurity. The supplied paper argues that a first important step towards CCTV-aware solutions must be a mapping system, for example Google Maps or OpenStreetMap, that provides both privacy and safety routing and navigation options. The blueprint summarizes an operational pipeline in which geo-tagged street imagery from Google Street View, Mapillary, or drone footage is ingested, processed by a lightweight anchor-free or Cascade model, converted to COCO-JSON of geo-referenced CCTV camera boxes and subtype, post-processed with NMS and a confidence filter greater than 0.5, and then fused into live CCTV coverage maps that drive privacy-first or safety-first routing and feed consumer smartphone or wearable privacy-alert apps (Turtiainen et al., 2020).

Its limitations are enumerated in detail. Small object instances smaller than $p \times c$9 px are under-represented in street-view, approximately 22% of the data, and suffer from lower recall; the proposed responses are more small-object mining and the use of SNIP/SNIPER or transformer-based heads. False positives occur on lamp posts, light fixtures, and hybrid streetlight-camera combos; suggested mitigations are hard negative lamp annotations, a two-class lamp-versus-camera classifier, and sensor fusion such as depth and WiFi. Occlusions, night imagery, and reflections on domes lead to lower confidence; suggested remedies are advanced augmentation including day/night and glare simulation, IR imaging, and domain adaptation. PTZ and hidden cameras behind glass are described as hard to detect, motivating video-based temporal cues and multi-view geo-registration. Adversarial camouflage, including universal camouflage patches, motivates adversarially robust training, detector ensembles, and physical-world defenses.

The flow-based formulation is positioned as a first line of defense in smart-home or enterprise environments where new camera models may appear without prior signatures. Its principal limitation is variability across leave-one-out zero-day scenarios: OCSVM and IsolationForest can be tuned via contamination or $\mathrm{IoU}=0.5$0 to trade off false positives versus false negatives, but they do not generalize as well across diverse camera models, whereas DeepSVDD remains the most stable option (Chaudhary et al., 10 Sep 2025).

A common misconception would be to treat zCamDetector as a single detector with a single benchmark. In the supplied sources, it instead names two technically different systems. This suggests that reported quantities such as "accuracy", "detection", and "robustness" are not directly comparable across the two usages: one refers to object-detection quality on images and video frames, while the other refers to anomaly-detection performance on network flows.