>>940883
This guy >>940700
has a good idea of dividing the image into chunks.
If your image is 640x480 then 40x40 pixel chunks will divide it into 16x12 chunks. I'm not so sure I agree with the idea of down sampling by averaging chunks. It may work but if it is too costly, then go with subsampling by checking the center square of nxn pixels for each 40x40 block.
For example, maybe the center 2x2 pixels. Thus you would be checking 16*12*4 = 768 pixels.
Then for each 2x2 center square, keep track of the running median (for some time window size of n frames) of the sum of those pixels, perhaps with a skiplist
https://rhettinger.wordpress.com/tag/running-median/
Use this to calculate Median Absolute Deviation (MAD) every few frames. The idea is to have the algorithm that is running be light enough that it can still run fully when something is detected and you need to add on more computations.
Once MAD detects an outlier in one or more of the center 2x2 squares of some blocks, increase the inner square size to 4x4 for those blocks. To be able to do this means you need previous image frames as far back as n (the window size) stored in main memory and you would need to pull required pixels up. Also, stop deleting old frames at this point so you have a window or partial window of old frames without the intruder in them as reference.
Once the blob of outliers is determined to be of critical mass, trigger some alarm functions that send a text message to you or something.
Also, the critical mass should exist for a certain period of time to avoid being triggered by a light flash (lightning or passing car).
One downside to this method is that an intruder could get past it by moving very very slowly.