## 1 Introduction  
The Internet of Surveillance Things (IoST) combines the advantages of IoT technology with video surveillance systems. The most prevalent IoST devices, including IP cameras and digital or network video recorders (DVR/NDR), are widely deployed not only in public places to monitor activities and behaviors that may pose threats to assets and people, such as thefts and criminal actions, but also as part of critical infrastructure deployments to ensure the security and safety of operational processes. IP cameras stream video and images to the cloud or internal servers and can be found in strategic locations such as manufacturing facilities, hospitals, police departments, financial markets, and airports [1, 2, 3, 4]. The IoT technology provides access to these IP cameras via the internet and delivers their respective video streams to the analytical systems that can use AI technology to analyses data on the fly at edge devices or within the core network. Internet of Surveillance Things security has received massive attention due to the rise in IoT-related security problems. The experience of the Mirai botnet attack in 2016, which converted IoT devices including IP cameras into \"zombies\" and caused a massive DDoS attack that brought down the domain registration services provider Dyn [5], revealed the weaknesses of internet-connected devices, and motivated the companies and manufacturers to improve the security of their products. However, regardless of the level of awareness of possible attack vectors, the set of similar attacks shows that the lesson was not learned, and IoT is still susceptible to risks and vulnerabilities that can be difficult to mitigate. In 2022, the DDoS botnet attack was launched against a Chinese telecommunication company from almost 170,000 compromised devices, including security cameras from over 180 countries [6]. The recent hacktivist attack against the video security company Verkada in 2020 led to the exposure of over 150,000 internet-connected cameras that were being used in prisons, hospital intensive care units, schools, and major companies like Tesla and Cloudflare [7]. A network of 25,000 cameras that was infiltrated and was being prepared for an assault was discovered by PC Word in 2016 [8]. The cameras and recorders were used to cause havoc in US companies and network infrastructures, leading to a significant loss of productivity when the internet was down for nearly twenty-four hours in most of the USA, according to a report published in the Wall Street Journal in September 2016. Other vulnerabilities that were found in IoT include software and firmware vulnerabilities in digital video recorders (DVR) such as command injection vulnerability and IoT botnet malware, both exploiting the Lilin security camera's DVR devices [9,10] and the Wyze Cam camera's set of vulnerabilities, allowing access to video feeds [11]. Despite implementing cutting-edge cybersecurity measures, malicious insiders continue to pose a significant threat to businesses due to their extensive access to organizational resources, both physical and digital, and their comprehensive understanding of vulnerable internal procedures [12]. Many of the aforementioned attacks have leveraged publicly available IoT devices, discoverable through tools like Shodan, to get access and exploit various vulnerabilities. It might seem that by disconnecting an IoT device from the internet, the risk of vulnerability exploitation is eliminated; however, air-gapped networks, while challenging to breach from the outside, are vulnerable to insider threats, and breaches are not impossible. Over the past decade, it has been demonstrated that advanced persistent threats (APTs) can breach highly secure air-gapped networks via different IP camera exploitation techniques [13].