A surveillance system including a surveillance server and at least one network camera is provided. The surveillance server includes: a communication interface configured to communicate with a network camera; and a processor configured to determine an event based on at least one image received from the network camera during a first period, determine an activation time of the network camera based on the event, and transmit an event reaction request including information about the activation time to the network camera during a second period after the first period.