Detecting Malicious False Frame Injection Attacks on Surveillance Systems at the Edge Using Electrical Network Frequency Signals

Abstract

Over the past few years, the importance of video surveillance in securing national critical infrastructure has significantly increased, with applications including the detection of failures and anomalies. Accompanied by the proliferation of video is the increasing number of attacks against surveillance systems. Among the attacks, False Frame Injection (FFI) attacks that replay video frames from a previous recording to mask the live feed has the highest impact. While many attempts have been made to detect FFI frames using features from the video feeds, video analysis is computationally too intensive to be deployed on-site for real-time false frame detection. In this paper, we investigated the feasibility of FFI attacks on compromised surveillance systems at the edge and propose an effective technique to detect the injected false video and audio frames by monitoring the surveillance feed using the embedded Electrical Network Frequency (ENF) signals. An ENF operates at a nominal frequency of 60 Hz/50 Hz based on its geographical location and maintains a stable value across the entire power grid interconnection with minor fluctuations. For surveillance system video/audio recordings connected to the power grid, the ENF signals are embedded. The time-varying nature of the ENF component was used as a forensic application for authenticating the surveillance feed. The paper highlights the ENF signal collection from a power grid creating a reference database and ENF extraction from the recordings using conventional short-time Fourier Transform and spectrum detection for robust ENF signal analysis in the presence of noise and interference caused in different harmonics. The experimental results demonstrated the effectiveness of ENF signal detection and/or abnormalities for FFI attacks.

EconLedger: A Proof-of-ENF Consensus Based Lightweight Distributed Ledger for IoVT Networks

“…The most commonly used imaging sensors are complementary metal oxide semiconductors (CMOSs) and charge-coupled device (CCD) sensors, which have different shutter mechanisms. In this work, we assume that ENF signals are extracted from video recordings generated by cameras with CMOS imaging sensors in an indoor setting with artificial light [11,16]. The estimation of ENF involves various signal processing techniques such as power spectral analysis and spectrogram-based techniques, which are beyond the scope of this paper.…”

“…In contrast to existing solutions that directly collect ENF fluctuations from power grids and stores audio/video recordings in a centralized location-dependent ENF database [10,11], EconLedger uses Swarm [12], which is a decentralized database (DDB) technology, to archive raw ENF-containing multimedia proofs and transactions over IoVT networks. Only hashed references of data are recorded on an immutable and auditable distributed ledger.…”

BlendSPS: A BLockchain-ENabled Decentralized Smart Public Safety System

“…To design an online frame duplication attack detection for SPS system, an environmental fingerprint-based detection technique by using Electrical Network Frequency (ENF) was proposed [36]. ENF is the power supply frequency with a nominal frequency of 50/60 Hz depending on the geographical location.…”

“…As Figure 4 shows, the ENF of duplicated recordings is mismatched with the ENF of power recordings as sliding window comes, the correlation coefficient for duplicated recordings will drop and the false frame injection attack is detected. Readers interested in a detailed study of ENF application in digital media forensic analysis are referred to the work in [36].…”

An Automated Approach for Electric Network Frequency Estimation in Static and Non-Static Digital Video Recordings

“…A forgery detection algorithm based on ENF signal was proposed in [37] without needing any ground truth signal. A technique to detect false frame injection attacks in video recordings using the ENF was discussed in [38]. ENF was employed to authenticate video feeds from surveillance cameras.…”