The embodiment of the invention provides an Internet of Things intrusion detection method, system and device and a medium, and belongs to the technical field of data processing, and the method specifically comprises the steps: obtaining a target traffic data packet; extracting feature information in the target traffic data packet; inputting the initial node feature, the routing graph and the adjacent matrix into a graph convolutional neural network to obtain a source node feature corresponding to a source ip address in the target traffic data packet and a target node feature corresponding to a target ip address; splicing the source node features, the data features and the target node features to obtain a target vector; and inputting the target vector into the multi-layer sensor, and outputting an attack type corresponding to the target traffic data packet. Through the scheme of the invention, the flow packet is analyzed and processed, the network node information and the network structure information are spliced, the semantic information of the edge is combined with the node representation output by the graph convolution and provided with the structure information, and the node representation is input into the multi-layer perceptron for intrusion attack detection, so that the detection efficiency, accuracy and security are improved.