The existing cyber-attack tracing methods mainly focus on the Internet and are not suitable for power industrial control system (PICS) due to its high real-time requirements and special communication protocols. In PICS

the end-to-end delays between the nodes are consistent

and most of the terminals are embedded terminals with limited resources and a single business. Therefore

a tracing method based on delay feature and security assessment for cyber-attack is proposed in this paper. A delay feature library is built according to the delay features of messages

which can be matched with the delay feature of the attack message to obtain the suspicious terminals. The security assessment of suspicious terminals is performed by assessment indicators to locate the attack source. Experiments and analysis show that the proposed method can traceback in non-internat protocoal (IP) network

and the impact on the performance of terminals in PICS is within acceptable limits. Compared with existing fine-grained tracing methods

the proposed method is relatively easy to deploy.