The invention provides an abnormal flow detection method for an electric power monitoring system. The method comprises the following steps of capturing and classifying real data traffic; splitting captured real data flow information; repairing message information as required, and returning the modified data traffic to the network at a specified speed; recording the distribution condition of each attribute in the connected attribute record and the connection initiated by each host in the network; classifying and comparing data traffic information in a normal state in the database to establish anormal attribute list. Security risks such as network attacks and system vulnerabilities faced by a service system can be prevented, so that the security of the system is ensured, meanwhile, securityproblems can be avoided, and once data is illegally accessed and even leaked, loss is avoided by adopting an analysis and detection method.