A method for detecting security using an industry internet operating system, characterized in that, the method comprises: obtaining operating data information of respective field devices in a specified period of time respectively, and analyzing the operating data information corresponding to the respective field devices respectively to obtaining respective dimensions corresponding to the field devices, and determining operating events in the respective dimensions, and association relationships among the operating events in the respective dimensions; and determining the obtained operating events in the respective dimensions corresponding to the respective field devices, and the association relationships among the operating events in the respective dimensions respectively as a characteristic data information of the corresponding field devices in the specified period of time; obtaining respective security detecting rules corresponding to the respective field devices according to obtained characteristic data information of the corresponding field devices in the specified period of time; determining respective target security detection rules corresponding to the respective field devices, and execution devices corresponding to the respective target security detection rules according to the obtained respective security detection rules corresponding respectively to the respective field devices; and issuing the respective determined target security detection rules respectively to the corresponding execution devices, so that the respective execution devices detect the corresponding field devices for security respectively under the received target security detection rules. obtaining operating data information of respective field devices in a specified period of time respectively, and analyzing the operating data information corresponding to the respective field devices respectively to obtaining respective dimensions corresponding to the field devices, and determining operating events in the respective dimensions, and association relationships among the operating events in the respective dimensions; and determining the obtained operating events in the respective dimensions corresponding to the respective field devices, and the association relationships among the operating events in the respective dimensions respectively as a characteristic data information of the corresponding field devices in the specified period of time; obtaining respective security detecting rules corresponding to the respective field devices according to obtained characteristic data information of the corresponding field devices in the specified period of time; determining respective target security detection rules corresponding to the respective field devices, and execution devices corresponding to the respective target security detection rules according to the obtained respective security detection rules corresponding respectively to the respective field devices; and issuing the respective determined target security detection rules respectively to the corresponding execution devices, so that the respective execution devices detect the corresponding field devices for security respectively under the received target security detection rules.