The malicious traffic detection system monitors the communication between the industrial equipment and analyzes the protocol in real time. At the same time, we launch a variety of attacks on the industrial system, such as Denial of Service attack, Man-in-the-Middle attack and so on. These attacks are also the major threat in the ICS currently. Then, we collect and classify different kinds of attack flow. These flows are intercepted from multiple collection stations during different periods.