The invention provides a method and a device for detecting an IP of unauthorized access equipment in an industrial control network. The method comprises the following steps of acquiring a first data table, a second data table, an address forwarding table and an address mapping table, respectively comparing the first data table with the address forwarding table and the address mapping table to obtain a first comparison result, and determining an MAC address change condition of to-be-detected equipment according to the first comparison result; respectively comparing the second data table with the address forwarding table and the address mapping table to obtain a second comparison result, and determining an IP address change condition of the to-be-detected equipment according to the second comparison result; and determining an access authorization condition of the to-be-detected equipment according to the MAC address change condition and the IP address change condition. According to the method and the device, the technical problem that the data is unsafe and the normal operation of the equipment is influenced due to the fact that the unauthorized access of the equipment is difficult to detect is solved.