Method and apparatus for detecting anomaly of traffic of internet of things device based on automata

An apparatus for detecting a traffic anomaly of Internet of Things (IoT) device based on automata, comprising:

• a processor;
• and
• a memory storing instructions executable by the processor,
• wherein the processor is configured to:
• collect normal traffic of an IoT device to be monitored in each working state, and generate normal traffic traces;
• generate flow trees by assembling each flow in the normal traffic traces, and generate joint flow trees by merging the flow trees;
• and
• convert a data structure representing the flow in the joint flow trees into automata models after performing reduction processing on the flow in the joint flow trees.

A non-transitory computer-readable storage medium, having instructions stored thereon, wherein when the instructions are executed by a processor, the processor is caused to implement a method for detecting a traffic anomaly of Internet of Things (IoT) device based on automata, comprising:

• collecting normal traffic of an IoT device to be monitored in each working state, and deriving normal traffic traces;
• generating flow trees by assembling each flow in the normal traffic traces, and generating joint flow trees by merging the flow trees;
• and
• converting a data structure representing the flow in the joint flow trees into automata models after performing reduction processing on the flow in the joint flow trees.