With the gradual development of digital power grid construction, power Internet of Things is becoming more and more important. However, the security threat will be more complex, which is mainly manifested in two aspects: the uncontrollable risk caused by the terminal equipment itself; and the risk of invasion of the power information network. It is necessary to use effective intrusion detection methods to prevent unknown network attacks, and the key technology is the accurate identification of the attack mode, which is conducive to the security operation and maintenance team to further analyze the enemy’s attack means, attack path and attack habits, and prepare for the next attack defense. In this paper, by improving the clustering analysis algorithm in machine learning, a network attack pattern recognition algorithm model based on clustering analysis is established. This model has the clustering analysis ability in the big data scenario. It can clear the isolated data, control the clustering categories and post process the clustered pattern data, so as to further improve the accuracy of attack pattern recognition. In addition, this paper also uses the open source network intrusion detection data set to analyze and verify the algorithm model, and evaluate its correctness and effectiveness. Finally, the algorithm is applied in practice.