The invention discloses an industrial control network device abnormal traffic detection method, comprising the following steps of 1, connecting smart monitoring terminals with a management platform; 2, setting a smart monitoring terminal deployment mode; 3, starting a learning mode and auxiliarily establishing a security base line; 4, turning to an operation mode and starting monitoring abnormal traffic; 5, collecting traffic in real time and carrying out abnormal traffic monitoring according to an abnormal traffic algorithm; 6, generating abnormal traffic alarm and record logs; and 7, restarting monitoring. The method has the beneficial effects that through adoption of an advanced self-learning algorithm, most fundamental traffic trend modes of various devices of an industrial control network are established, on the basis, whole-day real-time monitoring is carried out, once abnormal traffic is triggered, real-time prompting is carried out in a sound and light mode, and the corresponding abnormal traffic logs are generated for subsequent history log query. The powerful technical support for secure, stable and reliable operation of the industrial network of a user is provided.