A safety monitoring method for an industrial control system, comprising: obtaining a first data, wherein the first data is data generated during the process of operating the industrial control system; performing a first statistics on the first data, wherein the first statistics comprise time statistics compiled on at least one first characteristic of the first data, and the time statistics result of at least one first characteristic is used by a user to identify an abnormal behavior in the industrial control system; providing a result of a first statistics to the user, wherein providing a result of the first statistics to the user comprises displaying the result of the first statistics to the user on a touchscreen; obtaining an operation performed by the user on the result of the first statistics, wherein obtaining an operation performed by the user on the result of the first statistics comprises: obtaining a touch operation performed, on the touchscreen, by the user on the displayed result of the first statistics, wherein the operation is performed by the user when an abnormal behavior in the industrial control system is suspected, and wherein the operation is used for selecting a data range for further analysis; characterized by determining, based on the operation, a target time period related to the first statistics and a second data satisfying a preset condition in the first data; obtaining a result of a second statistics over the target time period, wherein the second statistics comprise time statistics compiled on at least one second characteristic of the second data, and a time statistics result of the at least one second characteristic is used by the user to analyze the abnormal behavior in the industrial control system; and performing a safety analysis on the industrial control system based on the result of the second statistics in the target time period, wherein the at least one second characteristic is for an in-depth analysis of the identified abnormal behavior and is different from the at least one first characteristic. obtaining a first data, wherein the first data is data generated during the process of operating the industrial control system; performing a first statistics on the first data, wherein the first statistics comprise time statistics compiled on at least one first characteristic of the first data, and the time statistics result of at least one first characteristic is used by a user to identify an abnormal behavior in the industrial control system; providing a result of a first statistics to the user, wherein providing a result of the first statistics to the user comprises displaying the result of the first statistics to the user on a touchscreen; obtaining an operation performed by the user on the result of the first statistics, wherein obtaining an operation performed by the user on the result of the first statistics comprises: obtaining a touch operation performed, on the touchscreen, by the user on the displayed result of the first statistics, wherein the operation is performed by the user when an abnormal behavior in the industrial control system is suspected, and wherein the operation is used for selecting a data range for further analysis; characterized by determining, based on the operation, a target time period related to the first statistics and a second data satisfying a preset condition in the first data; obtaining a result of a second statistics over the target time period, wherein the second statistics comprise time statistics compiled on at least one second characteristic of the second data, and a time statistics result of the at least one second characteristic is used by the user to analyze the abnormal behavior in the industrial control system; and performing a safety analysis on the industrial control system based on the result of the second statistics in the target time period, wherein the at least one second characteristic is for an in-depth analysis of the identified abnormal behavior and is different from the at least one first characteristic.