Distributed Internet of Things terminal equipment anomaly detection method based on federated learning
By adopting a distributed IoT terminal device anomaly detection method based on federated learning, the detection challenge caused by the diversity of the number and types of edge devices in the IoT is solved, achieving real-time and accurate anomaly detection and improving the system's security and coverage.
Patent Information
- Application Number
- CN202511878835.1
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-12-12
- Publication Date
- 2026-02-17
AI Technical Summary
The surge in the number, diversity, and performance differences of edge devices in the Internet of Things (IoT) makes it difficult to meet the requirements for real-time and accuracy in anomaly detection.
A distributed IoT terminal device anomaly detection method based on federated learning is adopted. By collecting network traffic data to cluster devices, global and gateway-level anomaly detection models are deployed. Combined with a dynamic weighted gradient federated mean aggregation strategy, the collaborative work of devices and gateways is realized to perform millisecond-level scans and anomaly detection without omissions.
It enables efficient and reliable anomaly detection for IoT devices, improves the real-time performance and accuracy of detection, reduces communication overhead, and enhances system security and coverage.
Smart Images
Figure CN121547273A_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The application belongs to the technical field of Internet of Things anomaly detection, and particularly relates to a distributed Internet of Things terminal device anomaly detection method based on federated learning. BACKGROUND
[0002] With the rapid development of big data, Internet of Things, artificial intelligence technology, and the wide application of the fifth generation mobile communication technology, intelligent devices are gradually integrated into people's daily life, promoting the arrival of the era of Internet of Things. However, with the increasing number and variety of devices connected to the Internet of Things, the state monitoring and fault diagnosis of devices become particularly important, and the computing power and storage space of cloud servers face increasingly severe challenges. The abnormal state and performance decline of devices may affect the stability and reliability of the overall system. Therefore, the detection technology for device state anomalies in the Internet of Things has become a key direction of current research.
[0003] The Internet of Things system can be divided into edge devices, gateways and cloud servers according to the hierarchy of functions and data flow. There are usually large-scale heterogeneous devices in the Internet of Things system, which makes it extremely difficult to train comprehensive and accurate anomaly detection models for different device types. Due to the significant difference in computing power and storage capacity between edge devices and cloud servers, existing Internet of Things anomaly detection technologies usually upload edge device data to cloud servers through gateways for centralized model training and anomaly detection. However, this solution has certain limitations: as the number of connected devices increases rapidly, the computing and storage pressure on cloud servers increases; at the same time, the diversity of device types in the Internet of Things environment makes it extremely complex to train comprehensive and accurate anomaly detection models in the cloud. Therefore, distributed systems have emerged, deploying lightweight anomaly detection models on devices with certain computing power, and deploying anomaly detection models on gateways for centralized detection of devices without computing power, thereby realizing the construction of distributed systems on device and gateway ends.
[0004] Federated learning is a new distributed training method proposed by Google in 2016, aiming to realize efficient machine learning in multiple parties under the premise of protecting user data privacy and security. Currently, the most commonly used federated learning algorithm is the federated averaging (FedAvg) algorithm. Although FedAvg effectively solves the problems of data privacy and training efficiency, it still cannot fully cope with potential challenges related to heterogeneity. The FedAvg algorithm does not consider the differences in data distribution between different types of devices, so it cannot guarantee the convergence of training in a heterogeneous scenario. Many existing solutions ignore the heterogeneity of system capabilities among intelligent devices, which affects the training efficiency of federated learning.
[0005] For devices with certain computing power, a lightweight anomaly detection model can be deployed, while for devices with limited computing power, centralized anomaly detection can be performed through a gateway end, thereby realizing distributed collaborative work of the device end and the gateway end. Due to the difference in processing power between devices, the performance of the trained anomaly detection model is different, which leads to the fact that when facing large-scale network attacks, some devices with poor performance may fail to alarm in time, thereby causing serious losses.
[0006] Therefore, it has become a key problem to be solved to build a distributed anomaly detection system that can balance the real-time performance and accuracy of anomaly detection. SUMMARY
[0007] The technical problem to be solved by the present application is that the number of edge devices is increasing, the types of edge devices are becoming more and more diversified, and there are differences in performance between edge devices, which leads to the fact that the anomaly detection of the Internet of Things cannot meet the needs of the system for real-time performance and accuracy.
[0008] In order to solve the above technical problems, the technical scheme of the present application provides a distributed Internet of Things terminal device anomaly detection method based on federated learning, comprising the following steps: collecting network traffic data corresponding to heterogeneous Internet of Things intelligent devices, extracting features with source IP address, destination IP address, source port number, destination port number, packet number and byte number, and taking the packet number and byte number as network traffic features; inputting the network traffic features into a pre-trained device clustering model, and dynamically clustering the heterogeneous Internet of Things intelligent devices into multiple categories according to the feature similarity through a mean shift clustering algorithm; deploying a device global level anomaly detection model on the heterogeneous Internet of Things intelligent devices, initializing on the gateway according to the categories, initializing a gateway level anomaly detection model deployed on the gateway and having source IP address, destination IP address, source port number and destination port number attributes, performing millisecond level non-missing scanning anomaly detection and alarming on the full amount of traffic of non-intelligent devices in the heterogeneous Internet of Things intelligent devices by using the gateway local real-time traffic data, and uploading only suspicious data to the gateway through a confidence screening mechanism, and performing anomaly detection on the low confidence data uploaded by the heterogeneous Internet of Things intelligent devices by the gateway; the heterogeneous Internet of Things intelligent devices download the device global level anomaly detection model related parameters corresponding to their own categories from the gateway as local device global level anomaly detection model parameters, and upload the parameters trained by local data to the gateway; the gateway updates the related parameters of each device global level anomaly detection model using a dynamic weighted gradient federated mean aggregation strategy update algorithm, the weight of which is dynamically adjusted according to the performance effect of the heterogeneous Internet of Things intelligent devices, until the model converges; the gateway trains and updates the related parameters of the gateway level anomaly detection model using the data uploaded by all the heterogeneous Internet of Things intelligent devices, until the model converges; finally, the trained device global level anomaly detection model is used for local detection of the heterogeneous Internet of Things intelligent devices, and the data with confidence lower than the threshold value is uploaded to the gateway, and the gateway level anomaly detection model performs anomaly detection on this part of data and non-intelligent devices.
[0009] Preferably, the device global level anomaly detection model comprises an encoder and a decoder, and is represented by a nonlinear function as follows: , wherein, and are the activation functions of the encoder and the decoder, and are the weight matrices of the encoder and the decoder, and are the biases of the encoder and the decoder, respectively.
[0010] Preferably, the step of using the gateway local real-time traffic data to perform millisecond level non-missing scanning anomaly detection and alarming on the full amount of traffic of non-intelligent devices in the heterogeneous Internet of Things intelligent devices comprises the following steps: calculating the reconstruction error according to the loss function, and the formula is as follows: , wherein, is input data and the reconstructed data after passing through the codec the difference between them, the original data after reconstruction, is the weight matrix of the encoder, when the reconstruction error is greater than the threshold, it is abnormal traffic, if the reconstruction error is less than the threshold, it is normal traffic.
[0011] Preferably, according to the abnormal traffic obtained after the millisecond-level non-missing scan anomaly detection, the packet size, the number of bytes, the start time and the end time of the abnormal traffic are obtained to construct edges, and the source IP address, the destination IP address, the source port number and the destination port number attributes are combined to construct the gateway-level anomaly detection model.
[0012] The technical scheme of the present application provides a distributed Internet of Things terminal device anomaly detection method based on federated learning, which collects network traffic data corresponding to heterogeneous Internet of Things intelligent devices, obtains multiple categories according to the network traffic characteristics of the network traffic data, initializes the device global level anomaly detection model on the gateway according to the categories, initializes the gateway level anomaly detection model according to the remaining characteristics of the network traffic data, performs scan anomaly detection and uploads to the gateway, and the gateway performs anomaly detection again. Heterogeneous Internet of Things intelligent devices download parameters from the gateway according to the categories and train, the gateway updates the device global level anomaly detection model according to the performance of the heterogeneous Internet of Things intelligent devices, and finally performs local detection of the heterogeneous Internet of Things intelligent devices based on the trained device global level anomaly detection model. The data with a confidence value lower than a threshold value is uploaded to the gateway, and the gateway level anomaly detection model performs non-intelligent device anomaly detection on this part of data. BRIEF DESCRIPTION OF DRAWINGS
[0013] Figure 1 is a flowchart of a terminal-gateway collaborative heterogeneous Internet of Things terminal device anomaly detection method of the present application; Figure 2 is a device level anomaly detection algorithm flowchart; Figure 3 is a distributed anomaly detection structure diagram; Figure 4 is a federated learning training process schematic diagram; Figure 5 is a terminal-gateway collaborative heterogeneous Internet of Things terminal device anomaly detection system diagram provided by the present application; Figure 6 is a terminal-gateway collaborative heterogeneous Internet of Things terminal device anomaly detection device diagram provided by the present application. DETAILED DESCRIPTION
[0014] The application will be further described in connection with the specific embodiments. It should be understood that these embodiments are only used to illustrate but not to limit the scope of the application. Furthermore, it should be understood that those skilled in the art can make various modifications or changes to the application after reading the content of the application, and these equivalent forms also fall within the scope defined by the appended claims.
[0015] As shown in Figure 1 The embodiment of the application provides a distributed Internet of Things terminal device anomaly detection method based on federated learning, comprising the following steps: Step 1: Collect network traffic data of heterogeneous Internet of Things intelligent devices based on federated learning, and pre-process to extract network traffic features.
[0016] The network traffic data has source IP address, destination IP address, source port number, destination port number, packet number and byte number features. The network traffic features are two-dimensional features of the network traffic data, including packet number and byte number.
[0017] In this embodiment, the network traffic data uses the N-BaIoT dataset, which is an open source dataset released by Ben-Gurion University of the State of Israel in 2018, focusing on Internet of Things (IoT) botnet attack detection. The dataset collects network traffic (PCAP format) of 9 types of commercial IoT devices (such as smart doorbells, security cameras, baby monitors, etc.) in normal state and after being infected with Mirai / BASHLITE botnet, providing clear comparison between benign traffic and malicious traffic. The data of two types of IoT devices are used as non-intelligent device network traffic data, and the traffic data of the remaining categories are used as intelligent device network traffic data.
[0018] Step 2: Input the network traffic features into the pre-trained device clustering model, and dynamically cluster the heterogeneous Internet of Things intelligent devices into multiple categories according to the feature similarity through the mean shift clustering algorithm.
[0019] The device clustering model is aimed at the significant differences in traffic behavior of different devices. If a unified model is directly trained for all devices, it is easy to cause the model to be difficult to converge due to large differences in data distribution and uneven computing power between devices. Therefore, by clustering the devices, the devices in the same category share the same device global level anomaly detection model parameters, thereby ensuring the convergence performance of the device global level anomaly detection model in the heterogeneous scene.
[0020] The device clustering model divides the heterogeneous Internet of Things intelligent devices into M categories.
[0021] Step 3: Deploying a device global level anomaly detection model on the heterogeneous Internet of Things intelligent device, initializing on the gateway by category, and initializing a gateway level anomaly detection model deployed on the gateway, using the gateway local real-time traffic data to perform millisecond level non-missing scanning anomaly detection on the full volume of traffic of non-intelligent devices and alarm to make up for the terminal detection blind area, and through the confidence screening mechanism, only suspicious data is uploaded to the gateway, and the gateway performs anomaly detection on the low confidence data uploaded by the heterogeneous Internet of Things intelligent device, forming a "terminal rapid response-gateway global bottom-up" collaborative defense system, which not only ensures the real-time detection, but also reduces the communication overhead, effectively improving the detection coverage and accuracy.
[0022] Initializing the corresponding M device level anomaly detection models on the gateway by category, and initializing a gateway level anomaly detection model.
[0023] The device global level anomaly detection model is trained based on the shrink auto encoder (SAE) algorithm, which is an efficient unsupervised anomaly detection method based on the auto encoder model. The algorithm adds a sparsity constraint in the output of the hidden layer, specifically using L1 regularization as the constraint term. The role of L1 regularization is to encourage more neurons in the neural network to output zero, thereby reducing the activity of neurons, which helps the model to extract more valuable features. In this way, SAE can effectively identify abnormal points in the data.
[0024] The device global level anomaly detection model contains an encoder and a decoder. Assuming that the encoder is represented as , the data set is , and the decoder is defined as .
[0025] The encoder maps the input data to the latent space to generate the latent vector , where represents the latent representation of the input data. The role of the decoder is to map the latent representation back to the input space, thereby reconstructing the original data . The encoder and decoder are usually represented by a nonlinear function as follows:
[0026]
[0027] where and are the activation functions of the encoder and the decoder, and are the weight matrices of the encoder and the decoder, and are the biases of the encoder and the decoder, respectively.
[0028] The auto-encoder model minimizes the loss function with respect to the parameters using stochastic gradient descent. The reconstruction loss function on the training set can be written as follows:
[0029] where is the input data and is the reconstructed data after passing through the encoder-decoder.
[0030] The loss function of SAE aims to map normal data samples to almost the origin, and the loss can be represented as follows:
[0031] The SAE-based reconstruction error is calculated, and the reconstruction error is compared with the threshold. If the reconstruction error is greater than the threshold, it is abnormal traffic, and if it is less than the threshold, it is normal traffic. The device-level anomaly detection algorithm flow chart is shown in Figure 2 .
[0032] The gateway-level anomaly detection model is trained based on the attention mechanism random feature map neural network algorithm, aiming to solve the problem that non-intelligent devices in the Internet of Things cannot independently perform anomaly detection. This algorithm performs centralized anomaly detection on the traffic data uploaded by all devices to the gateway, thereby significantly improving the accuracy of anomaly detection.
[0033] Specifically, the construction of the graph is based on the attributes of the traffic data such as source IP address, destination IP address, source port number, and destination port number. The features of the nodes are represented by vectors , and the edges between the nodes and are represented by vectors to represent their features, finally forming a graph including node set and edge set . The features of the nodes are initialized by a vector, and the dimension of the vector is determined by the number of features of the edges in the graph. The edges connecting two nodes are used to represent the features of the traffic data between the two nodes.
[0034] The features of the edges mainly involve the packet size, byte size, start time, and end time of the data traffic, denoted as:
[0035] In addition, a one-dimensional random feature is added to each node and edge:
[0036] This helps improve the graph's resistance to interference, thereby enhancing the robustness of graph classification tasks.
[0037] During model training, the first The neighborhood sampled by the layer node The calculation after information aggregation is shown in the following formula:
[0038] When calculating the representation of each node in the graph, the system assigns different weights to different neighboring nodes based on the feature differences of their neighboring nodes. Through an attention mechanism, the weights of each neighboring node can be calculated. Weights in the aggregation process These weights are then applied to the aggregation operation to obtain the final aggregation information of the nodes.
[0039] The first The information aggregated from the layer nodes is concatenated with the embedding information of the nodes in the previous layer, and then the concatenation information is linked with the trainable parameters. Multiply and pass the result through a nonlinear activation function After transmission, the calculation is performed at the 1st... Layer nodes The embedded information is shown in the following formula:
[0040] in, The current node In the Embedded information of the layer. It is a weight matrix. It's an activation function. `cat` performs connection operations along the features; the nodes in the last layer... The embedded information is .
[0041] edge The embedding features are achieved by connecting nodes. and The information is formed as shown in the following formula (7):
[0042] Finally, the edge embedding features are... The data is input into the softmax function for classification to obtain the label of the traffic data and determine whether it is abnormal or normal traffic.
[0043] Step 4: Heterogeneous IoT smart devices download the relevant parameters of the device global anomaly detection model corresponding to their own category from the gateway as the parameters of the local device global anomaly detection model, train it using local data, and then upload the parameters to the gateway. Figure 3 This is a diagram of a distributed anomaly detection structure.
[0044] Step 5: The gateway uses a dynamic weighted gradient federated mean aggregation strategy to update the relevant parameters of the global anomaly detection model for various devices. The weights are dynamically adjusted according to the performance of heterogeneous IoT smart devices until the model converges.
[0045] Compared to the traditional federated mean aggregation strategy, the dynamic weighted gradient federated mean aggregation strategy can eliminate the adverse effects of poor local model performance on the global model during network training. This method rewards high-performing models while penalizing low-performing models.
[0046] Specifically, when training a local model with M categories of smart devices, if the performance of the current model is better than that of the previous model, its weight coefficient is increased (in its weight coefficient). Increase by 20% on the basis that If the performance of the current round model is poor, then reduce its weight coefficient (in its weight coefficient). Reduce by 20% on the basis of If the model performance remains unchanged in these two rounds, the coefficients will remain unchanged. ).
[0047] Then, the local model, its corresponding weight coefficients, and the category of the smart device are uploaded to the gateway. The gateway performs dynamic weighted average aggregation according to the smart device category, and the aggregated data is sent back to the corresponding category of smart devices for training until the model converges.
[0048] Step 6: Simultaneously, the gateway uses data uploaded by all heterogeneous IoT smart devices to train and update the relevant parameters of the gateway-level anomaly detection model until the model converges.
[0049] Step 7: Finally, use the trained device-wide anomaly detection model to perform local detection of heterogeneous IoT smart devices, and upload data with confidence scores below the threshold to the gateway. The gateway-level anomaly detection model then performs anomaly detection on this data as well as on non-smart devices.
[0050] This invention provides an efficient and reliable method for detecting anomalies in heterogeneous IoT terminal devices through a terminal-gateway collaborative approach.
[0051] A gateway is used to store device-level anomaly monitoring model parameters and perform dynamic weighted aggregation. The gateway includes a dynamic weighted aggregator for dynamically adjusting model parameter weights based on the detection performance of smart devices, and a multi-category device-level anomaly monitoring model parameter library, categorized by device clustering. Non-smart devices are connected to the gateway and include data collectors for collecting network traffic data. A smart device organization consists of multiple smart devices, each including a data collector for collecting local network traffic data and a device-level anomaly detection model whose parameters are downloaded from the gateway and synchronized with the global model parameters corresponding to its device category. All smart devices within the smart device organization download global model parameters of the same category from the gateway for local anomaly detection.
[0052] The gateway updates the parameters of each training round uploaded by the device to the dynamic weighted aggregator; after passing through the dynamic weighted aggregator, the updated global models are obtained, and the device downloads the global models to the device for local model updates.
[0053] like Figure 4 As shown, the anomaly detection system comprises two types of participating organizations: gateway servers and device organizations. The gateway servers belong to the owner of the federated learning platform. This organization includes a dynamic weighted aggregator and a global model, responsible for aggregating updates from local models on devices and maintaining a global model to guide the training direction of multiple local models. The device organization contains multiple devices of the same type. Each device uses local device traffic data and computing resources to train a local device-level anomaly detection model and submits its model training updates for each round to the gateway server.
[0054] like Figure 5 and Figure 6 As shown, at least one edge gateway is connected to the cloud server, and the edge gateway is connected to at least one terminal device: Terminal device: If the device is a non-smart device, it only includes a data acquisition unit for collecting traffic data from the terminal device; a data reporting unit for uploading the collected traffic data to the gateway; if the device is a smart device, it includes a data acquisition unit, a data reporting unit for uploading data with a confidence level lower than the threshold to the gateway; a data processing unit for processing the collected traffic data; a device-level anomaly detection unit for identifying abnormal data from the device and making preliminary judgments locally; a device training parameter transmission unit for sending the training parameters of the device-level anomaly detection model to the gateway and downloading model parameters from the gateway; and an anomaly reporting unit for smart devices that have deployed and trained the model to report anomalies to the cloud server. Gateway: Gateway-level anomaly detection unit, used to train by integrating data from all terminal devices and identify abnormal data from terminal devices; Gateway-level model initialization unit, used to initialize the gateway-level anomaly detection model; Device clustering model unit, used to cluster multiple smart devices to generate smart device categories; Device-level model initialization unit, used to initialize the anomaly detection model for each category of devices; Device training parameter update unit, used to receive training parameters from each smart device and update the device-level model parameters; Anomaly reporting unit, after deployment and training, the gateway-level anomaly detection model reports anomalies to the cloud server when detected.
[0055] Compared with the prior art, the embodiments of the present invention have the following technical effects: (1) A method, system, and apparatus for detecting anomalies in heterogeneous IoT terminal devices through terminal-gateway collaboration, which performs real-time anomaly detection on the operating status of terminal devices. The device-level anomaly detection algorithm identifies abnormal data in a timely manner by directly monitoring the data of smart devices. This enhances the system's sensitivity and responsiveness to potential security threats.
[0056] Meanwhile, gateway-level anomaly detection algorithms centrally monitor network traffic data to detect both non-smart and smart terminal devices throughout the network environment. This algorithm integrates traffic information from multiple devices and users to identify abnormal traffic, effectively improving the accuracy of device anomaly detection. Through centralized processing of large amounts of data, gateway anomaly detection can compensate for the shortcomings of device-level anomaly detection, reduce missed detections, and improve the accuracy of detecting abnormal states of terminal devices.
[0057] By combining these two detection mechanisms, device-level detection and gateway-level detection complement each other, forming a well-structured system for detecting abnormal device operating states. Device-level detection is responsible for quickly responding to device-level anomalies, while gateway-level detection addresses the detection blind spots of non-intelligent devices that lack local processing capabilities. Furthermore, it improves the coverage and accuracy of abnormal device state detection from a global perspective, thereby ensuring that the entire system can effectively monitor and respond to abnormal device operating states.
[0058] (2) This embodiment of the invention proposes a learning framework based on dynamic weighted federated learning, where multiple intelligent devices can independently train models using local data. Subsequently, after each intelligent device completes its training, the model parameters will periodically interact with the gateway for updates. The gateway will collect model update information from each intelligent device and summarize and integrate it. Through the dynamic weighted federated learning strategy, various global device-level anomaly detection model updates are generated according to device type. The dynamic weighted federated learning strategy can adaptively balance the contribution of model updates of different quality, both incentivizing the active participation of high-performance devices and effectively suppressing the interference of low-quality updates. This update reflects the learning results of the entire device network, which helps to improve the generalization ability and accuracy of the model.
Claims
1. A method for anomaly detection in distributed Internet of Things (IoT) terminal devices based on federated learning, characterized in that, Includes the following steps: Network traffic data corresponding to heterogeneous IoT smart devices is collected, and features such as source IP address, destination IP address, source port number, destination port number, packet count, and byte count are extracted. Packet count and byte count are used as network traffic features. These network traffic features are input into a pre-trained device clustering model. Based on feature similarity, a mean-shift clustering algorithm is used to dynamically cluster the heterogeneous IoT smart devices into multiple categories. A global anomaly detection model is deployed on the heterogeneous IoT smart devices. Initialization is performed on the gateway according to category, and a gateway-level anomaly detection model with source IP address, destination IP address, source port number, and destination port number attributes is also initialized. Using real-time traffic data from the gateway, millisecond-level, comprehensive anomaly detection and alarm are performed on all traffic from non-smart devices within the heterogeneous IoT smart devices. A confidence-based filtering mechanism is used to upload only suspicious data to the gateway. Anomaly detection is performed on low-confidence data uploaded by heterogeneous IoT smart devices. Each heterogeneous IoT smart device downloads parameters from the gateway corresponding to its own category's global anomaly detection model as its local global anomaly detection model parameters. After training with local data, the parameters are uploaded to the gateway. The gateway uses a dynamic weighted gradient federated mean aggregation strategy to update the parameters of various device global anomaly detection models. The weights are dynamically adjusted based on the performance of the heterogeneous IoT smart devices until the model converges. The gateway uses data uploaded by all heterogeneous IoT smart devices to train and update the gateway-level anomaly detection model parameters until the model converges. Finally, the trained device global anomaly detection model is used for local detection of heterogeneous IoT smart devices, and data with confidence levels below a threshold is uploaded to the gateway. The gateway-level anomaly detection model then performs anomaly detection on this data, as well as on non-smart devices.
2. The anomaly detection method for distributed IoT terminal devices based on federated learning as described in claim 1, characterized in that, The device global anomaly detection model includes an encoder and a decoder, which are represented by a nonlinear function as follows: ,in, and , which are the activation functions of the encoder and decoder, respectively. and It is the weight matrix of the encoder and decoder. and These are the biases of the encoder and decoder, respectively.
3. The anomaly detection method for distributed IoT terminal devices based on federated learning as described in claim 1, characterized in that, The steps for performing millisecond-level, comprehensive anomaly detection and alarm on the full traffic of non-smart devices among heterogeneous IoT smart devices using real-time traffic data from the gateway are as follows: The reconstruction error is calculated based on the loss function, as shown in the formula below: ,in, Input data Rather than reconstructing data after encoding and decoding The differences between them The original data after reconstruction. It is the encoder's weight matrix; when the reconstruction error is greater than the threshold, it is abnormal traffic, and if the reconstruction error is less than the threshold, it is normal traffic.
4. The anomaly detection method for distributed IoT terminal devices based on federated learning as described in claim 1, characterized in that, Based on the abnormal traffic obtained after millisecond-level complete scan and anomaly detection, the packet size, number of bytes, start time and end time of the abnormal traffic are obtained to construct edges, and the gateway-level anomaly detection model is constructed by combining the source IP address, destination IP address, source port number and destination port number attributes.