An abnormality detection method applicable to a video surveillance system comprising a network video recorder in connection with a front-end IP-camera and a video server, characterized in that the abnormality detection method comprising steps of: generating, by the front-end IP-camera, first verification information by using a hash operation according to the sending time, device feature information on the front-end IP-camera, and first process feature information, wherein the first process feature information is corresponding to processes run by the front-end IP-camera when sending first keep-alive information; receiving, by the NVR, first keep-alive information from the front-end IP-camera, wherein the first keep-alive information carries the first verification information; acquiring, by the NVR, second process feature information on the front-end IP-camera, wherein the second process feature information is calculated according to processes running on the front-end IP-camera in a normal running status; saving, by the NVR, the second process feature information and IP-camera feature information on the front-end IP-camera corresponding to the second process feature information, where the second process feature information and the IP-camera feature information are reported when the front-end IP-camera registers with the NVR for the first time after the front-end IP-camera is discovered by the NVR; sending, by the NVR, the first verification information to the video server with the first verification information carried in second keep-alive information; and sending, by the NVR, the IP-camera feature information and the second process feature information to the video server while pushing the front-end IP-camera to the video server; performing, by the NVR, time synchronization with the front-end IP-camera and the video server; generating, by the video server, second verification information by using a hash operation according to the sending time of the first keep-alive information, front-end IP-camera feature information, and the second process feature information; determining, by the video server, by comparison of the first verification information and the second verification information, whether an abnormality has occurred to the front-end IP-camera. generating, by the front-end IP-camera, first verification information by using a hash operation according to the sending time, device feature information on the front-end IP-camera, and first process feature information, wherein the first process feature information is corresponding to processes run by the front-end IP-camera when sending first keep-alive information; receiving, by the NVR, first keep-alive information from the front-end IP-camera, wherein the first keep-alive information carries the first verification information; acquiring, by the NVR, second process feature information on the front-end IP-camera, wherein the second process feature information is calculated according to processes running on the front-end IP-camera in a normal running status; saving, by the NVR, the second process feature information and IP-camera feature information on the front-end IP-camera corresponding to the second process feature information, where the second process feature information and the IP-camera feature information are reported when the front-end IP-camera registers with the NVR for the first time after the front-end IP-camera is discovered by the NVR; sending, by the NVR, the first verification information to the video server with the first verification information carried in second keep-alive information; and sending, by the NVR, the IP-camera feature information and the second process feature information to the video server while pushing the front-end IP-camera to the video server; performing, by the NVR, time synchronization with the front-end IP-camera and the video server; generating, by the video server, second verification information by using a hash operation according to the sending time of the first keep-alive information, front-end IP-camera feature information, and the second process feature information; determining, by the video server, by comparison of the first verification information and the second verification information, whether an abnormality has occurred to the front-end IP-camera.