This paper presents an intelligent detection method for network security violations in power monitoring system. Among them, the cross-connection detection method based on device portrait obtains the association characteristics analysis between different network segment devices and systems, the host illegal extravasation trace detection method accurately extracts traces of suspicious extravasation behavior, and the weak password and high-risk service detection method detects the vulnerability of login interaction characteristics, finally, the effectiveness of the method is verified by an example. The technology proposed in this paper can improve the efficiency and accuracy of on-site illegal external investigation of power monitoring system, reduce the security risk introduced by on-site operation and maintenance, and avoid the grid intrusion or even power outage caused by network cross connection or virus.