Efficient malicious information detection method based on set partitioning for large-scale Internet of Things

With the large-scale integration of Internet of Things (IoT) into enterprise information management systems, organizations are pursuing digital transformation that hinges on real-time data insights-and yet face escalating security and governance risks. Detecting and responding to threats at scale without impairing system efficiency has therefore become a critical information-management and decision-support challenge for today's executives. This paper develops a distributed, gain-based anomaly-detection framework tailored to IoT-enabled enterprise systems, underpinned by an optimized sensor-subset partitioning strategy. Starting from the perspective of set partitioning strategies, this study analyzes the key factor that contributes to the performance differences between distributed and centralized algorithms. By examining the gain mutual influence of sensor subsets, an optimal set partitioning strategy is designed to minimize inter-subset mutual influence while enhancing intra-subset correlation. To further reduce the computational cost of gain updates, a suboptimal partitioning strategy based on Grassmann distance is proposed, improving the efficiency of selecting suspicious sensors. Theoretical analysis demonstrates that this approach effectively reduces the computational cost of gain updates while maintaining detection performance. Finally, simulation results validate the effectiveness of the proposed method in enhancing attack detection performance.