A method for monitoring the network security of an industrial control system, characterized by comprising: selecting at least one first data source related to the industrial control system, wherein the at least one first data source is used for measuring whether the industrial control system meets a network security requirement; acquiring first data from the at least one first data source; counting time-varying features of the first data to serve as a behavior model for the industrial control system; acquiring second data from some or all of the at least one first data source; and determining whether the second data has the features described by the behavior model, and if so, determining that behavior of the industrial control system that is represented by the second data is normal behavior, and if not, determining that the behavior is abnormal behavior, wherein after determining that the behavior of the industrial control system that is represented by the second data is abnormal behavior, the method further comprises: determining whether the behavior of the industrial control system that is represented by the second data is a network attack, and if so, determining a network attack phase among a plurality of different network attack phases of the abnormal behavior of the industrial control system that is represented by the second data, wherein the different network attack phases pose different levels of threat to the industrial control system. selecting at least one first data source related to the industrial control system, wherein the at least one first data source is used for measuring whether the industrial control system meets a network security requirement; acquiring first data from the at least one first data source; counting time-varying features of the first data to serve as a behavior model for the industrial control system; acquiring second data from some or all of the at least one first data source; and determining whether the second data has the features described by the behavior model, and if so, determining that behavior of the industrial control system that is represented by the second data is normal behavior, and if not, determining that the behavior is abnormal behavior, wherein after determining that the behavior of the industrial control system that is represented by the second data is abnormal behavior, the method further comprises: determining whether the behavior of the industrial control system that is represented by the second data is a network attack, and if so, determining a network attack phase among a plurality of different network attack phases of the abnormal behavior of the industrial control system that is represented by the second data, wherein the different network attack phases pose different levels of threat to the industrial control system. determining whether the behavior of the industrial control system that is represented by the second data is a network attack, and if so, determining a network attack phase among a plurality of different network attack phases of the abnormal behavior of the industrial control system that is represented by the second data, wherein the different network attack phases pose different levels of threat to the industrial control system.