The invention relates to the field of safety of industrial control systems and aims to provide a controller protection technology based on a white list. The controller protection technology based on the white list uses the white list for analytical judgment on industrial control controller behaviors through an intelligent mainframe learning technology. The white list of an industrial control software normal behavior mode automatically generated by an intelligent learning module is compared, matched and judged with real-time transmitted data in a current network through big data acquisition andanalysis, and a safe 'white environment' is constructed in a running environment of the controller. The controller protection technology can be used for safety protection based on white list rules, blocks and warns user node behaviors which do not conform to white list behavior characteristics so as to prevent an industrial control network again threat from unknown loopholes, and meanwhile can effectively avoid harm brought by abnormal operation performed by operators.