Point cloud registration plays an important role in three-dimensional (3-D) computer vision. Local feature-based registration as a kind of effective and robust method has two critical steps: descriptor generation and transformation estimation. This paper proposes a novel local feature descriptor termed Local Normal Deviation Statistic Histogram (LNDSH) and an accurate transformation estimation method named 2-point based SAmple Consensus with Compatibility Ranking (2SAC-CR). Our LNDSH is generated on a local reference axis (LRA), and fully encodes geometric and spatial information by six attributes in which a new attribute named Mean Normal Deviation Value ( mndv ) is proposed. mndv encodes mean normal deviation at each point, which is not influenced by the error of an LRA. In 2SAC-CR, an effective compatibility ranking is firstly conducted to increase the possibility of capturing correct correspondences. Then an LRA-based hypothesis generation and a novel hypothesis verification strategy are alternately implemented based on the ranking to ensure an accurate and efficient “hypothesis generation and verification”. Finally, the maximum consensus is used to generate the output transformation, further reducing the error of the result. Extensive experiments conducted on six standard datasets verify that LNDSH has high descriptiveness and strong robustness, and 2SAC-CR possesses high accuracy and strong robustness. Rigorous comparisons with the state-of-the-arts show the overall superiority of our methods.

Internet of Things (IoT) traffic anomaly detection is essential for limiting device compromise and large-scale attacks. Existing detectors may miss attack families absent from model development, while heterogeneous benign traffic makes it difficult to maintain a low false-positive rate (FPR). To address these two practical limitations, we propose the Mode-Calibrated Dual-Evidence Detector (MCDE). Its supervised branch estimates the probability that a sample is malicious from labeled benign and known-attack traffic, while its benign-deviation branch measures distance from multiple learned benign traffic modes, providing a complementary route for unseen attacks. MCDE maps the heterogeneous probability and distance scores to comparable empirical benign-tail evidence, normalizes each branch by its allocated share of the target FPR, and fuses them into an anomaly score. A disjoint held-out benign set determines the decision threshold. Equivalently, the fusion compares budget-adjusted benign-tail surprisal, linking the decision rule to empirical self-information. We further establish the conditions under which the budgeted fusion controls the nominal overall FPR. Family-hold-out experiments on IoT-23 and N-BaIoT validate MCDE. At a 1% target benign FPR, MCDE improves IoT-23 unseen recall over histogram-based gradient boosting from 85.77% to 90.85% and harmonic known–unseen recall from 91.82% to 95.07%, while maintaining a 0.96% benign-test FPR. It also achieves 99.87% unseen recall on N-BaIoT.