Intrusion Detection

[wizard3110]

Excellent set of nodes.

I have several cameras and have been trialling your alarm node with both the Hikvision DS-2CD2386G2-I and Annke C800 I91BF. Both cameras are setup in the same spot with the same settings and the same zones for motion/line crossing/intrusion.

Both cameras work well with video motion and line crossing, however with the intrusion detection the node doesn’t seem to send true when the event commences for the Hikvision DS-2CD2386G2-I (monitored via the IVMS Event Center). The Annke C800 I91BF sends true immediately then false after, however the Hikvision DS-2CD2386G2-I only sends false 5-10 seconds after event trigger. For line crossing the Hikvision DS-2CD2386G2-I sends true successfully then false soon after.

Below are screenshots from the Event Center showing 2 different triggers, and also the Node-Red debug node (connected direct to the alarm node [set to intrusion direction]) showing only the false.

Would appreciate some assistance as the Annke C800 I91BF in the same scenario show 2 triggers in Event Center and also in Node-Red debug node.

[Supergiovane]

HI wizard, let me do some tests with my cameras.

[Supergiovane]

Hi Wizard i checked with 2 my IP Cams and my PTZ and both sends TRUE and then FALSE at each intrusion detection. Can you please do a screenshot of your alarm node config? Mine is set like this

[Supergiovane]

PS: can you please use the RAW alarm node, attach a debug node to it and show me what it detects, whenever you enter the intrusion area of the HIKVISION camera? I think that the "Human Detection" triggers a different alarm than a simple intrusion detection. Thanks.

[wizard3110]

Hi Supergiovane,

Config is as follows...

Several outputs from the Debug attached to the RAW Alarm...

{"$":{"version":"2.0","xmlns":"http://www.hikvision.com/ver20/XMLSchema"},"ipAddress":"10.0.0.2","ipv6Address":"::ffff:10.0.0.2","portNo":"80","protocol":"HTTP","macAddress":"08:a1:89:6a:3d:59","channelID":"1","dateTime":"2021-04-24T16:59:47+08:00","activePostCount":"1","eventType":"fielddetection","eventState":"active","eventDescription":"fielddetection alarm","DetectionRegionList":{"DetectionRegionEntry":{"regionID":"1","sensitivityLevel":"50","RegionCoordinatesList":{"RegionCoordinates":[{"positionX":"363","positionY":"872"},{"positionX":"653","positionY":"870"},{"positionX":"631","positionY":"666"},{"positionX":"418","positionY":"676"}]},"detectionTarget":"human","TargetRect":{"X":"508","Y":"705","width":"49","height":"198"}}},"channelName":"Hik","detectionPictureTransType":"binary","detectionPicturesNumber":"1","isDataRetransmission":"false"}

Then 5 of the following across 5 seconds...

{"$":{"version":"2.0","xmlns":"http://www.hikvision.com/ver20/XMLSchema"},"ipAddress":"10.0.0.2","ipv6Address":"::ffff:10.0.0.2","portNo":"80","protocol":"HTTP","macAddress":"08:a1:89:6a:3d:59","channelID":"1","dateTime":"2021-04-24T16:59:47+08:00","activePostCount":"1","eventType":"duration","eventState":"active","eventDescription":"duration alarm","channelName":"Hik","DurationList":{"Duration":{"relationEvent":"fielddetection"}},"isDataRetransmission":"false"}

Then finally..

{"$":{"version":"2.0","xmlns":"http://www.hikvision.com/ver20/XMLSchema"},"ipAddress":"10.0.0.2","ipv6Address":"::ffff:10.0.0.2","portNo":"80","protocol":"HTTP","macAddress":"08:a1:89:6a:3d:59","channelID":"1","dateTime":"2021-04-24T16:59:56+08:00","activePostCount":"1","eventType":"fielddetection","eventState":"inactive","eventDescription":"fielddetection alarm","channelName":"Hik"}

Thanks.

[Supergiovane]

Thank you. That's very useful. Leave me check what's the difference between mine and you camera. Unfortunately, the Hik documentation over these APIs is very poorly written.

[Supergiovane]

Hi wizard I saw you're smart, so can you please unzip the content of this zip, into your .node-red/node_modules/node-red-contrib-hikvision-ultimate/nodes and restart node-red? As soon as you fires the intrusion alarm, a BANANA Log should appear in the node-red debug window and BANANA should appear in the node status.

bao.zip

[wizard3110]

Hi Supergiovane,

Below is the Event Center capturing 4 events...

Below is the output from the Node-Red debug window per your instructions, for the same 4 events...

As you can see they are all false, and several seconds behind the actual alarm time.

Thanks for your help.

[Supergiovane]

Hi Wizard by passing your alert string directly to the node, all works good and i obtain { payload: true, topic: '', channelid: '1', zone: 1, description: 'fielddetection alarm' } As expected, the payload is true. I really cannot find out the issue, but having multiple "false" payloads after some seconds from the triggering of the intrusion, leave me think about some issues with the node configuration itself. Can you please delete the node (not the server one, only the alarm node), deploy and put again a new alarm node in the flow (please do not copy/paste the old one, just add a new one)? Thanks.

[wizard3110]

Hi Supergiovane,

I've deleted the original node, and replaced with a new alarm node with the same server details and deployed, but unfortunately with the same result. I also tried a different Pi/Node-Red build I have loading the package and deploying an alarm node connected to the same camera, but again with the same result.

I certainly get payload true and then false for Line Crossing...

...and also payload true and then false for Region Entrance (although a little delayed from the alarm event)...

...but still only false for Intrusion Detection.

[Supergiovane]

I need to ditch more into that tomorrow in office. For info, what you see from the RAW alarm output is what i get into the alarm node as well. In the alarm node i take this raw message and parse the eventtype to find the “fielddetection” string having eventstate “active”. This triggers the payload true. Eventstate “inactive” triggers the payload false. For some reasons, they don’t work.
Manually tweaking the code and injecting the string coming from your RAW alarm sample above, into the alarm node, does work. In the meantime i fix this thing, you can use the RAW alarm and filter for these properties to do what you want.

[wizard3110]

Hi Supergiovane,

Based on your last message and the explanation of how the alarm node details are extracted from the RAW alarm, I had a look in to the output coming from the RAW node. I assessed each of Motion Detection, Line Crossing and Intrusion Detection, with the intention of extracting the key details as you suggested.

There are some other useful properties also, but from what I can tell the key properties are eventType (for alarm type) and eventState (for active or inactive). This being the case, I compared the different alarms.

For Motion Detection, the eventType is VMD and eventState either active or inactive. Line Crossing is similar, with eventType linedetection and eventState either active or inactive.

For Intrusion Detection though, when the alarm is triggered the eventType is duration and eventState is active, then when the alarm stops the eventType is fielddetection and eventState is inactive. Is the active output correct? If the intension for Intrusion Detection is the same as Motion Detection and Line Crossing, should the eventType be fielddetection instead of duration? fielddetection is part of the overall output for active so would eventually be picked-up, but further down instead of eventType.

Below are some snips…

Line Crossing active then inactive

Intrusion Detection active then inactive

[Supergiovane]

Hi Wizard Thank you for ditching into that. Yes i noted that, but the "duration" event tells the receiver, that the subject is moving into the region. If you look at your message here https://github.com/Supergiovane/node-red-contrib-hikvision-ultimate/issues/16#issuecomment-826062229 you wrote that the RAW node picks up the "fielddetection" "active" as well:

So there must be something wrong, because as far i can seen, sometime the event "fielddetection" is fired, sometime not. For a pure and simple workaround, i can look at the "duration" event, to signal an intrusion detection, but the "duration" is common to other events as well and that's a problem. The fact that your other camera do works everytime, leave me thinking something wrong with the Hikvision firmware. Are you able to update the Hikvision camera firmware?

[wizard3110]

Yes you are right, there was "fielddetection" "active" previously on the Hikvision DS-2CD2386G2-I, and also on the Annke C800 I91BF.

I'll have a look at the firmware, and do a few more checks of the RAW Alarm between different cameras, and maybe different firmware on the Hikvision.

[Supergiovane]

Ok, let me know!

[Supergiovane]

This sort of alarm stream alerter should be nearly identical for the entire range of Hik cameras. It's very useful to leave the RAW node attached and to monitor if at every intrusion detection, the camera emits a "fielddetection" "active". If yes, there is some issue somewhere else, otherwise, it can be an issue with the camera (please check that the maximum allowed connection to the camera hasn't been reached).

PS: as a side note, the hikvision PC software can overcome these hiccups in the transmission, by looking at the "duration" and other stuffs, that only hikvision really knows. So the PC software may work even if it doesn't receive the "fielddetection" "active" telegram.

[Supergiovane]

Hi Wizard Please install v. 1.0.44. The fix for you issue has been done, with correct attribution of "duration" to "fielddetection". If you've time, you can continue ditching into the camera issue or... enjoy the node. Cheers.

[Supergiovane]

Sorry, the 1.0.47 is the right version!