embodiments of the present invention disclose a solution for performing real - time analytics using input from internet protocol ( ip ) cameras directly connected to a network , where the analytics are performed by a remotely located network element . in the solution , a network element providing intelligent video surveillance ( ivs ) services is able to directly interact with raw output of a set of one or ore ip cameras . no video management system ( vms ) intermediary is needed or is existent between the ip cameras and the remotely located ivs service provider . the ivs service provider can perform real - time analytics a video stream directly ingested from one or more ip cameras . real - time analytics performed on the stream can include face recognition , object tracking , motion detection , and the like . in one embodiment , an owner of an ip camera or an establishment where the ip cameras are deployed can establish user / location specific profile settings . these profile settings can specify thresholds and elements to be examined by analytic processing operations and can establish user specific programmatic actions to be performed based the analytic processing results . programmatic action can include , for example , notification , alerts , programmatic actions altering a localized system , and the like . profile settings can be arbitrarily complex which can include multiple ip camera video streams , one or more analytics per stream , and the like . embodiments of the invention permit complex digital signal processing ( dsp ) and video based analytics to be performed in real time or near real time by network based computers . for example , these analytics can be performed as a web service or other software service . thus , instead of requiring end - users to host and purchase expensive video analytics hardware and software , raw video captured at a customer location can be analyzed . this analysis can occur rapidly , which permits real - time responses on location . for example , a video capture device located in a store can capture a video of a theft , which is undetected by in - store personnel . this video can be streamed over a network , where metrics are extracted during processing . these metrics can be compared against established values to determine that a consumer is attempting to shoplift an item by hiding it in his / her closing without payment . appreciably , such detailed analytics can require substantial computing processing power and logic , which is beyond the ability of all but the highest end security systems available today . once the shoplifting attempt is determined , a true comparison result can be generated , which triggers a programmatic action to immediately inform the store of the ongoing theft . when a false comparison result ( no shoplifting or other adverse event detected by video analysis ), no action or message is sent . the store owners can be informed through a message , notification , call , or other electronic means . thus , the programmatic action can be as simple as sending a message . the message may include a portion of the video showing the theft and / or an analysis of what occurred , which provides proof to the responder of the incident . in another example , a street level camera can capture video of an accident . this raw video can be streamed over the network for processing . the processing can automatically indicate an incident has occurred , which evaluates as a true comparison result . the programmatic action triggered can be to provide the accident video to a device of a responding officer , who can utilize this information for his / her report . in another embodiment , a report can be partially generated / completed automatically based on video analytics , which can save a responding officer a considerable amount of time . additionally , programmatic actions can immediate contact responders , such as an ambulance service , to ensure that help arrives on a scene as rapidly as possible . similar analytic actions can detect a fire in progress ( evaluated as a true condition ), which triggers a programmatic action of informing fire department responders . as will be appreciated by one skilled in the art , aspects of the present invention may be embodied as a system , method or computer program product . accordingly , aspects of the present invention may take the form of an entirely hardware embodiment , an entirely software embodiment ( including firmware , resident software , micro - code , etc .) or an embodiment combining software and hardware aspects that may all generally be referred to herein as a “ circuit ,” “ module ” or “ system .” furthermore , aspects of the present invention may take the form of a computer program product embodied in one or more computer readable medium ( s ) having computer readable program code embodied thereon . any combination of one or more computer readable medium ( s ) may be utilized . the computer readable medium may be a computer readable signal medium or a computer readable storage medium . a computer readable storage medium may be , for example , but not limited to , an electronic , magnetic , optical , electromagnetic , infrared , or semiconductor system , apparatus , or device , or any suitable combination of the foregoing . more specific examples ( a non - exhaustive list ) of the computer readable storage medium would include the following : an electrical connection having one or more wires , a portable computer diskette , a hard disk , a random access memory ( ram ), a read - only memory ( rom ), an erasable programmable read - only memory ( eprom or flash memory ), an optical fiber , a portable compact disc read - only memory ( cd - rom ), an optical storage device , a magnetic storage device , or any suitable combination of the foregoing . in the context of this document , a computer readable storage medium may be any tangible medium that can contain , or store a program for use by or in connection with an instruction handling system , apparatus , or device . a computer readable signal medium may include a propagated data signal with computer readable program code embodied therein , for example , in baseband or as part of a carrier wave . such a propagated signal may take any of a variety of forms , including , but not limited to , electro - magnetic , optical , or any suitable combination thereof . a computer readable signal medium may be any computer readable medium that is not a computer readable storage medium and that can communicate , propagate , or transport a program for use by or in connection with an instruction handling system , apparatus , or device . program code embodied on a computer readable medium may be transmitted using any appropriate medium , including but not limited to wireless , wireline , optical fiber cable , rf , etc ., or any suitable combination of the foregoing . computer program code for carrying out operations for aspects of the present invention may be written in any combination of one or more programming languages , including an object oriented programming language such as java , smalltalk , c ++ or the like and conventional procedural programming languages , such as the “ c ” programming language or similar programming languages . the program code may execute entirely on the user &# 39 ; s computer , partly on the user &# 39 ; s computer , as a stand - alone software package , partly on the user &# 39 ; s computer and partly on a remote computer or entirely on the remote computer or server . in the latter scenario , the remote computer may be connected to the user &# 39 ; s computer through any type of network , including a local area network ( lan ) or a wide area network ( wan ), or the connection may be made to an external computer ( for example , through the internet using an internet service provider ). aspects of the present invention are described below with reference to flowchart illustrations and / or block diagrams of methods , apparatus ( systems ) and computer program products according to embodiments of the invention . it will be understood that each block of the flowchart illustrations and / or block diagrams , and combinations of blocks in the flowchart illustrations and / or block diagrams , can be implemented by computer program instructions . these computer program instructions may be provided to a processor of a general purpose computer , special purpose computer , or other programmable data processing apparatus to produce a machine , such that the instructions , which execute via the processor of the computer or other programmable data processing apparatus , create means for implementing the functions / acts specified in the flowchart and / or block diagram block or blocks . these computer program instructions may also be stored in a computer readable medium that can direct a computer , other programmable data processing apparatus , or other devices to function in a particular manner , such that the instructions stored in the computer readable medium produce an article of manufacture including instructions which implement the function / act specified in the flowchart and / or block diagram block or blocks . the computer program instructions may also be loaded onto a computer , other programmable data processing apparatus , or other devices to cause a series of operational steps to be performed on the computer , other programmable apparatus or other devices to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide processes for implementing the functions / acts specified in the flowchart and / or block diagram block or blocks . fig1 is a schematic diagram illustrating a set of scenario 105 , 160 for directly ingesting raw video streams from internet protocol ( ip ) cameras and performing real - time analytics on the received video streams in accordance with an embodiment of the inventive arrangements disclosed herein . in scenario 105 , warehouse 114 owner 142 can utilize a surveillance service to monitor property 110 . service provided by computing environment 130 can include ip cameras 112 directly connected to an intelligent video surveillance ( ivs ) system 132 . ingested video 116 can be used to surveil property 110 using real - time analytics . when incident events occur , alert 150 can be conveyed to owner 142 via mobile computing device 140 . scenario 160 can represent a contemplated embodiment of scenario 105 unlike prior art where ip cameras 112 are connected indirectly to an ivs system 130 via a video management system . in one embodiment , standard communication protocols can be utilized for communicating between the ip camera 112 and the ivs system 132 and between the ivs system 132 and the mobile computing device 140 . in scenario 105 , ip cameras 112 can be connected to intelligent video surveillance system 132 via communication port 118 . communication port 118 can include physical connections such as ethernet , twisted pair , wireless communication ports , and the like . physical layer components and network technologies can vary based on camera 112 , port 118 and network 120 configurations . raw video stream 116 can be conveyed from property 110 via network 120 directly to ivs system 132 without being treated by a video management system . engine 134 can receive and decode raw video stream 116 prior to performing analytics on stream 116 . default analytics established by computing environment 130 and ivs system 132 can be combined with owner 142 settings to provide customized monitoring for property 110 . for instance , to reduce the likelihood of false alerts from facial recognition , owner 142 can provide portrait pictures of authorized personnel for property 110 . analytics engine 134 can be used to detect incident events which can include , motion detection , object tracking , presence detection , and the like . mobile computing device 140 can be a portable hardware / software device able to receive alerts 150 and communicate with computing environment 130 . device 140 can include mobile phone , personal digital assistant ( pda ), laptop , ultra - mobile computing devices , and the like . the device 140 need not be a portable device , but can be any device ( e . g ., a personal computer , a home telephone , etc .) able to receive communicated notifications . computing environment 130 can include a set of software components able to provide monitoring and analysis functionality . for example , environment 130 can be a java 2 enterprise edition ( j2ee ) environment 130 , such as ibm &# 39 ; s websphere . functionality can be embodied as web services which can include remote control , monitoring , reporting , and the like . components can include intelligent video surveillance system 132 and analytics engine 134 . in one embodiment , ivs system 132 can be implemented within a middleware software platform . in scenario 160 , an ip camera 180 can convey a raw video stream to a smart surveillance engine ( sse ) 184 . sse 184 utilizing direct show filter 182 can process the raw video stream received from ip camera 180 . directshow filter 182 can be a software application programming interface ( api ) able to decode motion picture experts group ( mpeg ), motion joint photographic expert group ( m - jpeg ), and the like . decoded video streams can be analyzed in real - time by sse 184 to provide notifications and alerts to appropriate entities . middleware for large scale surveillance ( mils ) server 168 can provide consolidation , management , and access for video streams processed by sse 184 . in one embodiment , mils server 168 can be a java 2 enterprise edition ( j2ee ) software platform . metadata exported from video streams can be indexing and managed using database 118 . fig2 is a schematic diagram illustrating a system 200 for providing real - time analytics on directly ingested ip camera video streams in accordance with an embodiment of the inventive arrangements disclosed herein . in system 200 , intelligent video surveillance system 240 can provide real - time analysis of video stream 216 provided by directly connected ip camera 210 . system 240 determining an incident event ( e . g ., unattended object ) can respond by notifying / alerting associated entities , altering the state of cameras 210 and / or surveillance system 210 . as used herein , ip cameras 210 can include cameras able to convey a video stream to an ivs system using one or more internet protocols . the ivs system 240 can be one or more component systems lacking an intermediate video management system . system 240 can be able to record , monitor , perform real - time analytics , and reporting on ip camera 210 streams . real - time analytics can encompass real - time and near real - time analysis of video streams . ip camera 210 , which can include volatile memory 212 and transceiver 214 , can convey raw video stream 216 to ivs 240 . video information received from camera 210 optics can be temporarily stored in volatile memory 212 prior to transmission . transmission of video stream 216 to ivs 240 can be facilitated by transceiver 214 which can convey stream 216 via network 220 . in one embodiment , raw video stream 216 can include an h . 264 mpeg4 encoded video stream . ivs 240 can receive and process raw video stream 116 to condition the stream for analytics . processing can be predicated on camera modules 248 which can allow ivs 240 to interface with vendor specific camera configurations . in one embodiment , modules 248 can be a plug - in based framework allowing vendor specific application programming interfaces ( apis ) to interoperate with ivs 240 . modules 248 can enable ivs 240 to perform actions such as query camera data , enable remote control of cameras , and the like . once processed , video stream 216 can be analyzed and incident events can be identified . analytics engine 246 can perform one or more examinations of video stream 216 . in one embodiment , one or more frames of video stream 216 can be analyzed based on one or more specialized algorithms . algorithms can include , but is not limited to , face recognition , path tracking , object tracking , motion detection , presence detection , and the like . extracted data from video stream 216 can be stored in data store 264 . data can include , but is not limited to , attribute data 266 , incident information , actions taken in response to incident events , and the like . for instance , attribute table 266 data can be used to index and search processed video streams quickly . profile manager 242 can permit user and / or camera specific settings to be maintained for a set of ip cameras 210 . for instance , analytics such as object tracking and license plate identification can be enabled for cameras surveilling a loading dock at a warehouse . manager 242 can be utilized to maintain user notification settings which can vary based on camera , analytics , incident events , and the like . notification engine 244 can be used to provide alerts to users , authorities , first responders , and the like . when an incident event occurs , notification engine 244 can communicate messages to one or more user configured devices . further , engine 244 can be used to manage varying degrees of critical alerts . for instance , when motion is detected in a non - critical area of surveillance , a text exchange message can be delivered to a user notifying of a possible presence . communication server 242 can enable ivs 240 to execute one or more communication functions in response to real - time analytics performed . server 242 can include , but is not limited to , a text exchange server , telephony server , facsimile server , and the like . although presented as a separate entity communication server 242 functionality can be expressed in ivs system 240 . fig3 is a flowchart illustrating a method 300 for executing real - time analytics on directly ingested internet protocol ( ip ) camera video streams in accordance with an embodiment of the inventive arrangements disclosed herein . method 300 can be performed in the context of system 200 . in method 300 , one or more ip cameras can convey video streams directly to an intelligent video surveillance ( ivs ) system which can initiate real - time analytics on the video streams . as used herein , ip cameras can include cameras able to convey a video stream to an ivs system using one or more internet protocols . the ivs system can be one or more component systems lacking an intermediate video management system able to record , monitor , perform real - time analytics , and reporting . real - time analytics can encompass real - time and near real - time analysis of video streams . the analytics , which need not occur in real time , can also be performed after an arbitrary delay . in step 302 , one or more ip cameras can establish a direct connection to an ivs system . in step 305 , the ivs system can identify a raw video stream originating from an ip camera . in step 310 , the raw video stream from the ip camera can be received . in step 315 , the raw video stream can be decoded and processed . in step 320 , real - time analytics can be performed on the video stream based on one or more processing criteria and / or user profile settings . criteria / settings can include , face recognition , path tracking , object tracking , motion detection , and the like . in step 325 , if analytics identifies an incident event has occurred , the method can proceed to step 330 , else return to step 310 . in step 330 , a programmatic action can be performed by the ivs system . actions can include notification and / or alerting appropriate entities , altering a localized system state ( e . g ., zooming / panning a camera ), adjusting analytics , and the like . in step 335 , the ivs system can optionally log the incident event in a system log , user history log , and the like . the flowchart and block diagrams in the fig1 - 3 illustrate the architecture , functionality , and operation of possible implementations of systems , methods and computer program products according to various embodiments of the present invention . in this regard , each block in the flowchart or block diagrams may represent a module , segment , or portion of code , which comprises one or more executable instructions for implementing the specified logical function ( s ). it should also be noted that , in some alternative implementations , the functions noted in the block may occur out of the order noted in the figures . for example , two blocks shown in succession may , in fact , be processed substantially concurrently , or the blocks may sometimes be processed in the reverse order , depending upon the functionality involved . it will also be noted that each block of the block diagrams and / or flowchart illustration , and combinations of blocks in the block diagrams and / or flowchart illustration , can be implemented by special purpose hardware - based systems that perform the specified functions or acts , or combinations of special purpose hardware and computer instructions . the terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention . as used herein , the singular forms “ a ,” “ an ,” and “ the ” are intended to include the plural forms as well , unless the context clearly indicates otherwise . it will be further understood that the terms “ comprises ” and / or “ comprising ,” when used in this specification , specify the presence of stated features , integers , steps , operations , elements , and / or components , but do not preclude the presence or addition of one or more other features , integers , steps , operations , elements , components , and / or groups thereof . the corresponding structures , materials , acts , and equivalents of all means or step plus function elements in the claims below are intended to include any structure , material , or act for performing the function in combination with other claimed elements as specifically claimed . the description of the present invention has been presented for purposes of illustration and description , but is not intended to be exhaustive or limited to the invention in the form disclosed . many modifications and variations will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the invention . the embodiment was chosen and described in order to best explain the principles of the invention and the practical application , and to enable others of ordinary skill in the art to understand the invention for various embodiments with various modifications as are suited to the particular use contemplated .