zCamInspector: Flow-Based IoT Camera Detection

• zCamInspector is a flow-based system that identifies known IoT cameras via supervised classifiers and detects zero-day devices using one-class classifiers.
• It extracts 62 protocol-agnostic flow features from network traffic, eliminating dependence on IP addresses, ports, or payload decryption.
• Empirical evaluations demonstrate high accuracy, with XGB achieving over 99% for known-camera identification and robust performance in novelty detection.

zCamInspector is a flow-based system for identifying known IoT cameras with supervised classifiers and detecting previously unseen, or zero-day, IoT cameras with one-class classifiers. In the formulation reported for "Flow-Based Detection and Identification of Zero-Day IoT Cameras," the system combines a supervised identification module, zCamClassifier, with an anomaly-detection module, zCamDetector, and operates on 62 flow-based features extracted from approximately 40GB of traffic across three datasets. Its stated design objective is to detect streaming IoT cameras without relying on IP addresses, transport ports, or payload decryption, thereby remaining agnostic to NAT and compatible with encrypted traffic (Chaudhary et al., 10 Sep 2025).

1. Problem setting and operational scope

zCamInspector addresses a network-security problem specific to consumer and covert IoT cameras. The reported motivation is that many IoT devices lack mechanisms for administrators to monitor and control them, while traditional rule-based approaches struggle because of device diversity, encryption, and cloud usage patterns. The system therefore treats camera discovery as a traffic-classification problem at the flow level rather than as a signature-matching problem tied to endpoints or packet contents (Chaudhary et al., 10 Sep 2025).

The architecture separates two related but distinct tasks. The first is known-camera identification, in which flows from previously observed device classes are assigned to specific IoT camera models. The second is zero-day camera detection, in which previously unseen camera flows are treated as outliers relative to non-camera traffic. This separation is central to the system’s design: zCamClassifier supports multiclass recognition of known devices, whereas zCamDetector addresses novelty detection under incomplete prior knowledge.

A common misconception is to treat these tasks as interchangeable. The reported experiments do not support that equivalence. Known-camera identification is framed as a supervised problem with labeled camera classes, while zero-day detection is framed as one-class or outlier detection against a background class. The difference is consequential for both model choice and reported performance.

2. System architecture and processing pipeline

The input to zCamInspector is a set of raw packet captures, typically obtained through port-mirroring on routers or switches. These captures are converted into flows, and the pipeline explicitly discards any dependency on IP addresses or port numbers. Each flow is then processed with CICFlowmeter to extract 62 generic flow-based features. After preprocessing, redundant or constant features are dropped, and ExtraTree is used to prioritize feature importance, often reducing the representation to the top 10 features for efficient modeling (Chaudhary et al., 10 Sep 2025).

The architecture is modular. One branch performs supervised identification; the other performs zero-day detection. Both branches consume the same flow-derived representation, but they differ in learning objective and evaluation setting.

Component	Function	Reported output
Flow extraction	Converts PCAPs into endpoint-agnostic flows	Flow records
Feature extraction	Uses CICFlowmeter on each flow	62 flow-based features
Feature selection	Drops redundant/constant features; ranks with ExtraTree	Full set or top 10 features
zCamClassifier	Supervised identification of known cameras	Specific camera-model label
zCamDetector	One-class detection of unseen cameras	Inlier/outlier decision

This pipeline places zCamInspector in the family of behavioral traffic-analysis systems. Its distinguishing feature within that family is the explicit coupling of supervised device recognition with one-class zero-day detection inside a single framework.

3. Datasets and flow-level representation

The reported experimental corpus consists of three datasets totaling approximately 40GB of PCAPs. Set I (BITSPHC) contains six commercial IoT cameras and more than 14GB of lab-collected traffic. Set II (UNSW) contains five open-source IoT cameras and approximately 1.5GB of traffic. Set III contains four video conferencing applications, two video-sharing applications, and various non-video applications, for approximately 22GB; it serves as the background non-IoT-camera class and as one-class training data in zero-day experiments (Chaudhary et al., 10 Sep 2025).

The feature space is intentionally generic and protocol-agnostic. The reported features include Flow Duration, packet counts and rates in forward and backward directions, byte counts, header lengths, flag counts such as ACK Flag Cnt, inter-arrival-time statistics including Bwd IAT Tot, window sizes, packet-length statistics, and other TCP metadata. Because these features do not depend on payload inspection, they are intended to capture behavioral signatures rather than application semantics.

Among the features identified as highly discriminative across datasets are Init Bwd Win Byts, ACK Flag Cnt, Flow Duration, and Bwd IAT Tot. The emphasis on these features suggests that persistent traffic regularities associated with streaming behavior can survive endpoint obfuscation and encryption. A plausible implication is that the system relies less on vendor-specific protocol artifacts than on transport-level and flow-level regularities induced by camera operation.

The dataset construction also matters methodologically. Set III includes conferencing and video-sharing applications, not merely unrelated background traffic. This makes the classification problem more stringent, because zCamInspector must distinguish IoT camera traffic from other high-bandwidth, video-related behaviors rather than from only obviously dissimilar classes.

4. Learning modules and mathematical formulation

For zCamClassifier, the reported supervised models are Decision Tree (DT), Extra Trees (ET), Random Forest (RF), k-Nearest Neighbor (KNN), Extreme Gradient Boosting (XGB), Gaussian Naive Bayes (GNB), and Linear Kernel SVM (LKSVM). Experiments were conducted with both the full 62-feature representation and the top 10 features produced by feature ranking. XGB is reported as the best-performing supervised model across the principal settings (Chaudhary et al., 10 Sep 2025).

For zCamDetector, the reported one-class models are One-Class SVM (OCSVM), SGD One-Class SVM (SGDOCSVM), Isolation Forest (IF), and Deep Support Vector Data Description (DeepSVDD). The paper provides the following objective functions for these models:

$$\min_{w, \rho, \xi} \frac{1}{2}\|w\|^2 + \frac{1}{\nu n} \sum_{i=1}^n \xi_i - \rho$$

subject to

$$(w \cdot \phi(x_i)) \geq \rho - \xi_i, \quad \xi_i \geq 0$$

for OCSVM,

$$\min_{w} \frac{1}{2}\|w\|^2 + \frac{1}{\nu n} \sum_{i=1}^{n} \max(0, \rho - w^\top x_i)$$

for SGDOCSVM,

$s(x, n) = 2^{-\frac{E(h(x))}{c(n)}}$

for Isolation Forest, and

$$\mathcal{L}(\theta) = \frac{1}{n} \sum_{i=1}^n \|f_\theta(x_i) - c\|^2$$

for DeepSVDD.

The reported hyperparameterization underscores the asymmetry between supervised and one-class settings. OCSVM is described as using a low $\nu = 0.001$, and DeepSVDD is described as using two fully connected 512-neuron hidden layers, latent dimension 8, and the Adam optimizer. These details indicate that zero-day detection was treated not as a secondary add-on, but as a separate optimization problem with its own sensitivity constraints.

5. Empirical performance and evaluation results

The reported headline result for known-camera identification is that XGB identifies IoT cameras with 99.2%–99.8% accuracy, depending on the dataset configuration, with precision over 97% and false negatives as low as 0.3% (Chaudhary et al., 10 Sep 2025). More specifically, the paper reports 99.24% on Set I, 99.84% on Set II, and 99.8% on the combined Set I and Set II configuration. It also reports that supervised classifiers outperformed prior state-of-the-art methods such as iCamInspector’s CART by at least 4% accuracy.

For zero-day detection, the reported accuracies are 93.20% for OCSVM, 96.55% for SGDOCSVM, 78.65% for IF, and 92.16% for DeepSVDD in the principal reported setting. In the stricter setting where all devices are treated as zero-day, DeepSVDD is reported as the best-performing method, with mean training and testing accuracies of 96.03% and 74.51%, respectively. The paper also states that zCamInspector achieved more than 95% accuracy for specific devices.

Evaluation setting	Model	Reported result
Known camera identification	XGB	99.24% on Set I; 99.84% on Set II; 99.8% on combined Set I and II
Known camera identification	XGB	Precision over 97%; false negatives as low as 0.3%
Zero-day detection	OCSVM / SGDOCSVM / IF / DeepSVDD	93.20% / 96.55% / 78.65% / 92.16%
All devices treated as zero-day	DeepSVDD	Mean training/testing accuracies of 96.03% / 74.51%

These results establish an important distinction. In-distribution multiclass recognition of known cameras is reported as very strong, whereas the all-zero-day setting remains materially harder. The gap is not anomalous; it is characteristic of the difference between closed-set classification and open-set or novelty-detection regimes. The system’s value lies partly in making that distinction explicit rather than collapsing both problems into a single accuracy number.

The reported runtime is also operationally relevant. Classifier training is reported as 1–2.4 seconds, and testing as less than 0.3 seconds, which the paper describes as far below average flow duration and therefore suitable for near-real-time monitoring.

6. Relation to adjacent work, misconceptions, and limitations

The paper positions zCamInspector as a system that not only detects IoT cameras but also substantially addresses zero-day IoT camera detection using purely flow-based features (Chaudhary et al., 10 Sep 2025). This differentiates it from prior camera-detection systems that focus only on supervised recognition of known devices. It also differentiates it from a separate line of work on hidden-camera discovery based on similarity of simultaneous observation, in which a user records a scene with a known camera and correlates bytes-per-second patterns against nearby wireless devices. That paradigm reported accuracy as high as 97% and an F1 score over 0.95 for indoors and outdoors settings, with delay-tolerant extensions producing F1 scores above 0.98 (Wu et al., 2019). The two approaches address related but non-identical problems: one is scene-correlated hidden-camera discovery, the other is flow-based device identification and zero-day novelty detection.

A further adjacent development is rCamInspector, which adopts a Flow Classifier with four classes and a SmartCam Classifier with six camera classes, and augments XGB-based traffic classification with SHAP and LIME explanations. rCamInspector reports XGB accuracies of 92% and 99% in the Flow and SmartCam classifiers, respectively, and evaluates explanation faithfulness with consistency of more than 0.7 and sufficiency of 1.0 (Chaudhary et al., 12 Sep 2025). This suggests a plausible implication: explanation-oriented tooling could complement zCamInspector’s flow-based decision process, especially in operational settings where administrators need auditable justification for blocking or investigating suspected cameras.

Several limitations are explicitly reported for zCamInspector. The experiments used 11 camera models, so performance may vary with unseen consumer devices. Integrated multi-function IoT devices, such as smart bulbs with cameras, may pose subtle detection challenges. Continuous adaptive learning was identified as not yet explored. These caveats are significant because they constrain how the reported results should be interpreted. zCamInspector demonstrates strong performance under the studied datasets and protocols, but its zero-day claims should be read as evidence of practical novelty detection under the reported conditions rather than as a guarantee of universal future-device recognition.