Aiming at the problem that Precise Time Protocol (PTP) is vulnerable to be attacked in power internet of things construction, and to overcome the inaccuracy of traditional Ethernet, an attack detection and recovery model of smart substation is built based on Markov logic tree and system brittleness analysis. Firstly, the attack models are analyzed, which are divided into threat model, attack tree and delay attack model, and the impact of different attack models on time synchronization schemes is judged. Then, based on Markov tree and system brittleness analysis, the deviation of the system is classified and judged, and the attack detection and recovery model is constructed. Experiments have verified the effectiveness of the proposed scheme in the ideal situation and the actual engineering simulation angle, and the detection and recovery index of the ideal model can reach to 97%. Compared with traditional attack detection and recovery schemes, the proposed model reduces the computational offset on the protection side by 14.25% and the synchronization error by 35.43%. This work is supported by Project of State Grid Chongqing Electric Power Company and National Key Research and Development Program of China (No. 2017YFB0902800) “Key Techniques Research on Intelligent Distribution Network Operation based on Micro Synchronization Phasor Measurement”.