Intrusion Detection Video Analytics – AI-Powered with <1 False Alarm/HR

Imagine a bank server room, 3:00 AM. The camera detects motion – the system triggers an alarm, security dispatches a team, but it's just a plastic bag falling off a shelf. On a site with 20 cameras, up to 30% of all alarms are false. Operators get used to ignoring warnings, and a real intrusion goes unnoticed. Each false alarm carries potential liability or administrative fines. We solve this with a two-tier detection architecture that filters out 90% of empty frames while achieving recall >95% with <1 false alarm per hour per camera. Below are the technical details.

How does the two-tier architecture filter out 90% of empty frames?

The first tier is a motion pre-filter based on the MOG2 background subtractor. It's faster than a neural network – latency <5 ms per frame. If the motion level is below a threshold (0.001), the frame is skipped: no ML inference is triggered. This saves GPU resources – load drops by a factor of 3–5. The second tier is YOLO detection with zone-based filtering.

import cv2
import numpy as np
from ultralytics import YOLO

class IntrusionDetector:
    def __init__(self, model_path: str, zone_polygon: list, sensitivity: str = 'medium'):
        self.detector = YOLO(model_path)
        self.zone = np.array(zone_polygon, dtype=np.int32)
        self.bg_subtractor = cv2.createBackgroundSubtractorMOG2(
            history=500, varThreshold=16, detectShadows=True
        )
        self.conf_thresholds = {'low': 0.7, 'medium': 0.5, 'high': 0.3}
        self.conf = self.conf_thresholds[sensitivity]
        self.confirmed_tracks = {}
        self.confirmation_frames = 3

    def detect(self, frame: np.ndarray) -> dict:
        result = {'intrusion_detected': False, 'intruders': [], 'motion_level': 0.0}
        fg_mask = self.bg_subtractor.apply(frame)
        fg_mask[fg_mask == 127] = 0
        motion_level = float(fg_mask.sum()) / (frame.shape[0] * frame.shape[1])
        result['motion_level'] = motion_level
        if motion_level < 0.001:
            return result
        detections = self.detector(frame, conf=self.conf, classes=[0,2,3,5,7])
        for box in detections[0].boxes:
            x1,y1,x2,y2 = map(int, box.xyxy[0])
            cx,cy = (x1+x2)//2, (y1+y2)//2
            in_zone = cv2.pointPolygonTest(self.zone, (float(cx),float(cy)), False) >=0
            if in_zone:
                result['intruders'].append({
                    'class': self.detector.model.names[int(box.cls)],
                    'confidence': float(box.conf),
                    'bbox': [x1,y1,x2,y2],
                    'center': (cx,cy)
                })
        if result['intruders']:
            result['intrusion_detected'] = True
        return result

This approach runs the neural network only on frames with motion. In practice, it reduces GPU load from 100% to 20–30%, which is especially important when processing 8–16 cameras in parallel on a single server.

Why does area filtering and frame confirmation keep false alarms below 1 per hour?

False alarms are usually caused by small animals, falling leaves, or shadows. We apply two filters. First, a minimum bounding box area (2000 pixels): objects smaller than this are not considered intrusions. Second, confirmation over 3 consecutive frames: if the object disappears on the next frame, the alarm is not raised.

class FalsePositiveFilter:
    def __init__(self):
        self.event_buffer = []
        self.cooldown_seconds = 30

    def should_trigger_alarm(self, intrusion_event: dict, current_time: float) -> bool:
        for intruder in intrusion_event.get('intruders', []):
            x1, y1, x2, y2 = intruder['bbox']
            area = (x2 - x1) * (y2 - y1)
            if area < 2000:
                return False
        if self.event_buffer:
            last_event_time = self.event_buffer[-1]
            if current_time - last_event_time < self.cooldown_seconds:
                return False
        self.event_buffer.append(current_time)
        self.event_buffer = self.event_buffer[-10:]
        return True

This combination yields a consistently low false alarm rate – less than 1 per hour per camera while maintaining recall >95%.

Multi-zone configuration with schedules and whitelists

Each zone is defined by a polygon with parameters: alert_level (warning/critical), schedule (always/after_hours), and a list of allowed_persons. For example, a server room can be configured as critical, active only during off-hours, and ignore authorized staff.

zones_config = {
    'perimeter': {
        'polygon': [[0,300],[1920,300],[1920,1080],[0,1080]],
        'alert_level': 'warning',
        'schedule': 'always'
    },
    'server_room': {
        'polygon': [[500,200],[900,200],[900,600],[500,600]],
        'alert_level': 'critical',
        'schedule': 'after_hours',
        'allowed_persons': ['id_001', 'id_002']
    }
}

Such flexibility lets you tailor the system to any scenario – from a low-priority perimeter to critical zones with employee whitelists.

Low-light operation: IR and thermal cameras

Standard RGB cameras are unsuitable for detection in complete darkness. The solution is to use IR illuminators (850/940 nm) with a model fine-tuned on IR frames, or thermal cameras (FLIR, Axis). Combining RGB and thermal channels yields the best results: detection rate 90–94% at zero lux.

What's included

• Documentation: architecture diagram, zone configuration files, operator manual.
• Access to: code repository, metrics dashboard, REST API for integration.
• Training: 2-hour webinar for security and administrative staff.
• Support: 3 months of free maintenance with incident response within 24 hours.

Deployment process: from audit to support

1. Site analysis. On-site engineer visit, measuring illumination, camera placements, creating zone maps.
2. Design. Choosing architecture (single-server vs distributed), preparing configurations.
3. Development. Customizing YOLOv8 model on your footage (RGB, IR, thermal). Adding data augmentation: night, fog, rain.
4. Integration. Connecting to existing video surveillance and PSIM systems.
5. Testing. Running scenarios: real intrusions, noise, measuring recall and false alarm rate.
6. Documentation and training. Operator manual, handover of code and configurations.
7. Support. 3 months of free maintenance with incident response within 24 hours.

At each stage you receive a report and a demo of results.

Ensuring stable accuracy: tracking and data augmentation

To prevent losing targets during temporary occlusions, we use object tracking based on the SORT algorithm. Additionally, each model is trained with augmentation: night frames, fog, rain, glare. This guarantees stable operation in any weather and lighting conditions. Our team has 5+ years of experience in Computer Vision and has delivered over 30 video analytics projects of varying complexity.

Get a consultation for your site – our engineers will find the optimal solution. Order a pilot project on 2 cameras and see the technology in action. Contact us for a detailed audit.