The present invention relates to the technical field of network security, and in particular to an abnormal data detection method, system and device for industrial Internet. This detection method compares data distribution of an initial node with a normal feature expression performance in first normal data distribution subject to extraction processing to obtain a first anomaly score, compares the data distribution of the initial node with the normal feature expression performance in second normal data distribution subject to enhancement processing to obtain a second anomaly score, obtains a risk level of the node based on the first anomaly score and the second anomaly score, and immediately provides corresponding limits on a node communication permission; and the method provides dual detection, is high in accuracy and stable in detection results, and facilitates the maintenance of industrial Internet security.