Abstract: According to the industrial control system (ICS) behavior, COM-Express Module and finite state characteristics, combined with the data packet protocol deep analysis and industrial control system process control model, a control instruction rule-matching detection algorithm of process control and a specific intrusion detection model of detection schemes were designed. Several executive technologies were introduced, including the process control rule of One-Class Support Vector Machine (OCSVM) classification, sample feature extraction of the intrusion detection model, the generation process of single classifier, and the transformation of detection algorithm. Considering the model training accuracy of distributed control system (DCS) and the simulation experiment data of intrusion detection, simulation experiments accompanied with usage of COM-E Module demonstrate the effectiveness of the model for anomaly intrusion detection in ICS network. Results show its huge practicability and promotion value.