Disclosed area method and apparatus for detecting security using an industry internet operating system so as to address problems in the prior art of poor security of field devices, and high difficulty of manipulating the field devices. In the method, security detection rules corresponding to respective field devices are obtained according to various heterogeneous and dispersed operating data information in an industry field acquired in real-time into a database, in a big-data analysis mode of an industry big-data analysis platform, and some of the security detection rules corresponding to the field devices are selected and then issued to execution devices to detect the field devices for security to guarantee controllable security in the industry field. In this way, industry data can be acquired, parsed, stored, mined, optimized, and secured in the big-data analysis mode, so that an industry and the field devices can operate in a trusted operating environment.