A few-shot learning based intrusion detection method of an industrial control system, including: dividing an original data set extracted from a data flow of the industrial control system into a detection model training set and a basic model training set; using principal component analysis method to reduce dimension of a continuous data matrix M in the two training sets; using one-hot encoding method to process a discrete data matrix V in the two training sets; using processed basic model training set to construct few-shot training tasks required for basic model training; training a basic model based on convolutional neural networks with help of constructed few-shot training tasks; based on trained basic model, using processed detection model training set for further training to obtain the detection model; effectively detecting attacks in real-time data streams with help of center vectors of three different types of samples in the detection model.