The invention discloses an industrial control network Modbus protocol-oriented data flow anomaly analysis method. The method comprises the following steps of 1, an initialization phase, wherein a Modbus protocol data flow anomaly analysis model is generated; 2, an initialization phase, wherein a Modbus protocol self-learning normal behavior model is generated; 3, a run phase, wherein the run state of Modbus protocol data flow is judged; 4, a run phase, wherein the normal/abnormal behavior state of Modbus protocol data messages is judged; 5, representing, wherein the results in the step 3 and the step 4 are visibly represented. The method is designed on the basis of deeply knowing the Modbus protocol and the anomaly analysis technology, good comprehensiveness and practicality are achieved, the efficiency of anomaly analysis can be effectively improved, and Modbus abnormal data flow existing in an industrial control system can be efficiently found through the method.