Internet of Things traffic auditing method and device suitable for white list strategy

The invention discloses an Internet of Things traffic auditing method and device suitable for a white list strategy, and the method comprises the steps: collecting traffic data in an Internet of Things convergence switch, and recognizing an instruction type in the traffic data; establishing a standard vector according to the instruction type of the first traffic data; establishing a monitoring vector according to the second flow data; calculating an included angle cosine value between the standard vector and the monitoring vector to obtain a monitoring sequence and generate a reference function corresponding to the monitoring sequence; and when the deviation amplitude of the monitoring sequence and the reference function is greater than a preset value, sending out a traffic abnormity alarm. According to the embodiment of the invention, the reference function is used as the white list, and the establishment of the standard vector and the monitoring vector does not depend on the mastering of the instruction; in