An industrial control system security analysis method, comprising: collecting a communication data packet from a first industrial control system, wherein an Operational Technology, OT, network comprises the first industrial control system and at least one second industrial control system connected with the first industrial control system and the communication data packet is interactive data transmitted between control devices in the first industrial control system; extracting network identifiable information from the communication data packet, wherein the network identifiable information is configured to identify at least one of a communication object, a communication rule and a communication content; determining whether the network identifiable information is located in a pre-created event database; if the network identifiable information is located in the event database, performing the following: determining that the communication data packet is a malicious data packet; acquiring security policies of the first industrial control system and each of the second industrial control system in the OT network, wherein the security policies are configured to represent the rules for processing a malicious data packet; determining a threat coefficient of the communication data packet for each of the second industrial control system according to the network identifiable information and each of the security policies, wherein the threat coefficient is configured to represent a degree of threat of the communication data packet to the corresponding second industrial control system. collecting a communication data packet from a first industrial control system, wherein an Operational Technology, OT, network comprises the first industrial control system and at least one second industrial control system connected with the first industrial control system and the communication data packet is interactive data transmitted between control devices in the first industrial control system; extracting network identifiable information from the communication data packet, wherein the network identifiable information is configured to identify at least one of a communication object, a communication rule and a communication content; determining whether the network identifiable information is located in a pre-created event database; if the network identifiable information is located in the event database, performing the following: determining that the communication data packet is a malicious data packet; acquiring security policies of the first industrial control system and each of the second industrial control system in the OT network, wherein the security policies are configured to represent the rules for processing a malicious data packet; determining a threat coefficient of the communication data packet for each of the second industrial control system according to the network identifiable information and each of the security policies, wherein the threat coefficient is configured to represent a degree of threat of the communication data packet to the corresponding second industrial control system. determining that the communication data packet is a malicious data packet; acquiring security policies of the first industrial control system and each of the second industrial control system in the OT network, wherein the security policies are configured to represent the rules for processing a malicious data packet; determining a threat coefficient of the communication data packet for each of the second industrial control system according to the network identifiable information and each of the security policies, wherein the threat coefficient is configured to represent a degree of threat of the communication data packet to the corresponding second industrial control system.