The Internet of Things is a distributed system of collaborative microservices (μS) that manage the monitoring and control of devices.The interaction of the IoT with the physical environment raises serious security,privacy concerns.However,detecting anomalous behaviour becomes difficult due to the complexity of IoT services.This paper proposes a machine learning-based approach to model IoT service behaviour by observing the communication between services.The algorithm in this paper continuously learns the μS model on distributed nodes at IoT sites and achieves good anomaly detection by sharing stable models.As an application,this paper sets up a firewall for the IoT μS to enable security modification and access control of existing installations.