A method for detecting a traffic anomaly of Internet of Things (IoT) device based on automata. The method includes: collecting normal traffic of an IoT device to be monitored in each working state, and deriving normal traffic traces; generating flow trees by assembling each flow in the normal traffic traces, and generating joint flow trees by merging the flow trees; and converting a data structure representing the flow in the joint flow trees into automata models after performing reduction processing on the flow in the joint flow trees.