Abstract: Internet of things dumb terminals based on the IP protocol and without user interaction interface is usually based on embedded system with difficulty in updating the program, limited computing resources, and simple security authentication. Aiming at the above problems, a dumb terminal security management system based on traffic feature recognition was designed and implemented to extract the traffic characteristics of the terminal, and implements identification and behavior supervision of the terminal. The system was arranged that, the static characteristics of the traffic of the terminal were extracted for implement legality authentication during equipment access, and the traffic dynamic behavior characteristics were extracted to determine abnormal behavior after equipment access. Finding abnormal behavior, the system could block the session connection. Under experiment and measuring condition, the results show that, the accuracy of equipment identification can reach 96.6% and the accuracy of abnormal behavior detection can reach 97.7%, and can effectively detect DOS, port scanning and other network attacks.