Orion

A 100% offline AI security assistant. Orion turns existing CCTV into a smart incident-response system that runs locally on standard laptops, solving for Africa’s cloud & hardware constraints.

Comment

Security cameras are excellent at recording evidence, but that evidence is often reviewed manually only after a burglary or safety incident has already occurred. Continuous human monitoring is expensive, tiring, and difficult to scale across multiple feeds.

We built Orion to turn existing CCTV and IP cameras into a local security-response system. Instead of replacing installed equipment or continuously uploading private footage to the cloud, Orion connects to camera feeds that people already own, detects motion locally, preserves relevant evidence, and alerts the operator immediately. Local vision models then assess the incident asynchronously and propose safe, auditable responses.

This is particularly relevant for homes, shops, schools, clinics, farms, gated estates, warehouses, and infrastructure facilities across Africa, where security resources, internet connectivity, and access to dedicated GPU servers may be limited.

What it does

Orion supports:

  • RTSP and HTTP camera streams
  • Direct HTTP-MJPEG feeds from phone camera applications
  • USB cameras
  • ONVIF camera discovery
  • Uploaded demonstration videos
  • Motion detection and protected monitoring zones
  • Immediate dashboard alerts
  • Three-second pre-event context and post-event evidence
  • Two-stage local visual analysis
  • A bounded priority inference queue
  • Event acknowledgement, resolution, and deletion
  • Auditable mock security-response actions through FastMCP

Camera footage, model inference, credentials, event metadata, and evidence remain on the operator’s laptop.

Orion does not identify people, autonomously call emergency services, or control gates, locks, alarms, fences, drones, or other physical equipment.

How we built it

Orion is implemented as a local FastAPI application with SQLite persistence and a browser dashboard.

Each camera has independent capture, motion-processing, and preview stages. Capture always keeps the newest frame, preventing a slow dashboard, disk operation, or model request from blocking the camera feed.

OpenCV MOG2 provides the first low-cost motion gate. We added:

  • Background-model warm-up
  • Motion persistence across multiple frames
  • Protected polygon zones
  • Morphological noise removal
  • Minimum moving-object area
  • Lighting-change suppression
  • Motion bounding boxes
  • Pre-event buffering
  • Per-camera incident coalescing

Motion creates an event and dashboard alert immediately. AI analysis never delays that first alert.

Two-stage local AI

Orion uses two small multimodal models through llama.cpp:

  1. SmolVLM2-500M Q8_0 receives one selected evidence frame and produces a short structured triage result.
  2. Qwen3.5-0.8B Q6_K receives the triage result, event metadata, and up to three chronological evidence images when an incident is suspicious or uncertain.

The models share one priority scheduler. Triage jobs run before reviews, and only one model performs inference at a time. This avoids CPU contention and keeps the application usable on a four-thread, 8 GB laptop.

Model responses are constrained to JSON and validated by application policy. Qwen may propose only allow-listed workflows:

  • Notify security
  • Preserve evidence
  • Request human review
  • Request gate closure as a simulation requiring operator approval

Every proposal, acceptance, rejection, and simulated result is recorded.

Challenges we faced

Unreliable IP camera streams

Some Android IP Webcam feeds produced truncated-JPEG warnings or failed when decoded through FFmpeg. We implemented a direct multipart MJPEG reader for /video endpoints and added specific diagnostics for control-page URLs, VPN restrictions, and incorrect HTTPS camera URLs.

Model latency on CPU

Running two visual models concurrently caused timeouts and made the camera preview less responsive. A shared priority queue now serializes inference while capture, preview, motion detection, and evidence writing remain asynchronous.

Missing the important part of short videos

An early version started analysis two seconds after initial motion. In one security clip, this occurred before the person displayed the important handheld object.

Orion now treats an uploaded clip as one complete incident. It samples the source at 5 FPS, replays it over a bounded 20–45 seconds, collects evidence throughout the clip, and starts analysis only after the complete incident context has been captured.

Ambiguous visual classifications

Small models can confuse visually similar handheld objects. We therefore do not claim guaranteed weapon recognition. Orion preserves the original evidence and conservatively escalates uncertain handheld-object cases for human review.

Local HTTPS and phone notifications

Background browser push requires trusted HTTPS. A locally generated certificate introduced an inconvenient trust ceremony for phones, which was distracting for the MVP. The push implementation remains experimental, while the primary hackathon demonstration uses a reliable localhost HTTP dashboard.

What we learned

We learned that a practical security system should not make model inference the first step. A cheap deterministic signal can notify the operator immediately, while slower AI adds context afterward.

We also learned that model size is only one part of local performance. Queue design, image selection, output length, context size, evidence encoding, and avoiding concurrent inference had a major effect on reliability.

Most importantly, security AI should expose uncertainty. Original evidence, explicit failure states, deterministic policy checks, and human authority are more valuable than presenting every model response as certain.

Accomplishments

  • Runs locally using CPU-oriented GGUF models
  • Supports existing IP cameras and uploaded videos
  • Produces immediate motion alerts without waiting for AI
  • Uses two specialized model stages without concurrent CPU contention
  • Keeps evidence and credentials on the laptop
  • Records a complete audit trail for safe response workflows
  • Includes 43 automated tests
  • Provides one-command Windows setup and launch scripts
  • Follows the official ADTC submission structure

What’s next

Future work could include:

  • A production-grade trusted LAN deployment
  • Better mobile notification enrollment
  • Additional sensor inputs such as door contacts and acoustic alarms
  • Drone and mobile-camera feed adapters
  • Improved object tracking across longer incidents
  • Security-specific evaluation data with human-reviewed labels
  • Hardware workflows that always require explicit operator approval
  • Formal latency, memory, thermal, and accuracy benchmarking

Orion’s long-term goal is to become an interoperability layer between existing cameras, local intelligence, human operators, and safe security workflows—without requiring continuous cloud surveillance.

Built With

Share this project:

Updates