Abnormal flow detection in power industrial control systems(ICS)is a critical technology for ensuring the normal operation of control systems and identifying potential network attacks.This paper takes the IEC 60870-5-104 protocol as an example and proposes an unsupervised abnormal flow detection method for power ICS based on convolutional autoencoder(CAE)and adaptive threshold adjustment. The method addresses the limitations of current ICS flow anomaly detection methods

including inadequate detection capability

poor interpretability

and lack of dynamic adjustment mechanisms.Initially

session packets from large volumes of normal ICS traffic are extracted for feature generation using a sliding window approach

forming input vectors.Subsequently

the constructed CAE model is trained

with optimal hyperparameters determined through cross-validation

and the model is solidified. During the detection phase

real-time traffic session packets are reconstructed by the model

and reconstruction errors are calculated.An adaptive threshold adjustment mechanism is then used to dynamically generate a threshold interval

enabling anomaly determination and detection output.Finally

experiments with typical anomalous traffic are conducted to validate the model

with results showing that the proposed method accurately identifies various anomalies in power ICS environments and effectively improves safety protection capabilities.