With the close combination of modernization and digitalization, the industrial Internet has been upgraded in an all-round way. In recent years, safety accidents of industrial control system (commonly known as industrial automation) system software have occurred from time to time. The vulnerability of the endogenous security of industrial production communication protocol is one of the key reasons for the software security accidents of industrial automation system. IDS (Intrusion Detection System) is a kind of network security technology. It can monitor the activities in the network through port scanning, network traffic analysis and so on, and identify the possible intrusion behavior. By detecting abnormal activities in the network, we can detect possible intrusion behaviors, so as to detect and prevent network security attacks in time. But the intrusion detection and Defense Technology in traditional information technology can not be applied to industrial automation system software immediately. Therefore, according to the characteristics of industrial automation system software, this paper studies the intrusion detection technology suitable for industrial automation system software, uses haqspo algorithm to improve elm and SVM, and obtains ICs intrusion detection entity model based on improved elm and ICs intrusion detection entity model based on Improved SVM. Finally, compared with QPSO, PSO and GA algorithms, the ICs intrusion detection entity model improved by haqspo algorithm has stronger main performance and can better meet the requirements of specific ICs for intrusion detection. According to the simulation results, the accuracy of ICs intrusion detection model composed of stacked classifiers is higher than that of single classifier model, while the false negative rate and false negative rate are lower than that of single classifier model.