According to the needs of power grid monitoring architecture and information security cooperation protection, this project builds a multi-level, deeply distributed active security cooperation defense mode. A complete implementation method is proposed from the perspective of model architecture and function mechanism. The optimal defense strategy based on grey correlation is studied according to the characteristics of cooperation between regions. In this way, the coordination between the equipment is realized to achieve multi-level protection from the host layer to the security equipment layer and then to the network layer. Multiple detection mechanisms are used to realize the comprehensive detection and integrated judgment of abnormal documents in the cloud environment. This provides maximum protection for cloud users. Experiments show that this method can effectively suppress the malicious attacks of malicious users and reduce the damage caused by viruses. In this way, both the cloud and the customer are protected.