The invention discloses a switch data anomaly detection method based on a vector autoregression model, and relates to the technical field of communication processing. Aiming at the defects of an existing anomaly detection method, the adopted technical scheme comprises the steps of obtaining operation behavior data of a login user in a switch in real time, and storing the operation behavior data ina data set; performing graph mapping on the operation behavior data contained in the data set, and converting the operation behavior data into a symbolic graph; for the symbolic graph, introducing analgorithm with a vector autoregression model to carry out anomaly detection, and carrying out analysis by utilizing a Granger causality; according to an analysis result, identifying abnormal points in the symbolic graph, and determining that the operation of the user belongs to an attack behavior; and locking the user, feeding a locking result back to the switch control part, and enabling the switch control part to cancel the operation authority of the user and take countermeasure. According to the method, improper behaviors of operation can be discovered in advance, wrong identification of normal users is avoided, and security holes in the industrial Internet are filled in a targeted manner.