With the strengthening of the power system construction, the power information network and the service system it carries have been developed rapidly. Although a large number of encrypted data packets are currently being transmitted, existing network traffic analysis techniques cannot effectively identify these packets, resulting in the omission of many important features during the monitoring process. This not only increases the probability of false positives and false negatives, but also provides useful space for criminals. To address this issue, it is necessary to conduct online analysis of full traffic and dynamically identify anomalies. We develop a new method for flow analysis and anomaly detection in power monitoring systems. This method adopts different detection strategies based on whether network traffic is encrypted, to achieve comprehensive monitoring of network attack behavior.