A security detection device, wherein the security detection device is configured to detect an IoT device in an IoT network, and the security detection device comprises: a software wireless unit, configured to monitor a wireless signal sent by the IoT device to obtain a wireless message; and an analysis unit, configured to determine a target running feature of the IoT device by using the wireless message, and compare the target running feature with a historical normal running feature of the IoT device to determine whether the IoT device runs abnormally, wherein determining the target running feature of the IoT device by using the wireless message and comparing the target running feature with the historical normal running feature of the IoT device to determine whether the IoT device runs abnormally comprise: determining a first verification code in the wireless message generated by the IoT device; checking the first verification code in the message by using a verification rule specified in a communications protocol, wherein checking the first verification code comprises calculating a second verification code for data in the wireless message by using the verification rule and determining through comparison whether the second verification code is consistent with the first verification code; if the check fails, parsing the first verification code by using a private rule to verify whether the first verification code has been generated by the IoT device using the private rule to achieve private data transmission; and if the parsing succeeds, determining that the IoT device sends a private message and that the target running feature of the IoT device includes transmitting the private message, the private message being an alarm message in the wireless message. a software wireless unit, configured to monitor a wireless signal sent by the IoT device to obtain a wireless message; and an analysis unit, configured to determine a target running feature of the IoT device by using the wireless message, and compare the target running feature with a historical normal running feature of the IoT device to determine whether the IoT device runs abnormally, wherein determining the target running feature of the IoT device by using the wireless message and comparing the target running feature with the historical normal running feature of the IoT device to determine whether the IoT device runs abnormally comprise: determining a first verification code in the wireless message generated by the IoT device; checking the first verification code in the message by using a verification rule specified in a communications protocol, wherein checking the first verification code comprises calculating a second verification code for data in the wireless message by using the verification rule and determining through comparison whether the second verification code is consistent with the first verification code; if the check fails, parsing the first verification code by using a private rule to verify whether the first verification code has been generated by the IoT device using the private rule to achieve private data transmission; and if the parsing succeeds, determining that the IoT device sends a private message and that the target running feature of the IoT device includes transmitting the private message, the private message being an alarm message in the wireless message. determining a first verification code in the wireless message generated by the IoT device; checking the first verification code in the message by using a verification rule specified in a communications protocol, wherein checking the first verification code comprises calculating a second verification code for data in the wireless message by using the verification rule and determining through comparison whether the second verification code is consistent with the first verification code; if the check fails, parsing the first verification code by using a private rule to verify whether the first verification code has been generated by the IoT device using the private rule to achieve private data transmission; and if the parsing succeeds, determining that the IoT device sends a private message and that the target running feature of the IoT device includes transmitting the private message, the private message being an alarm message in the wireless message.