At present, data flow anomaly detection for an intelligent substation requires high accuracy and real-time, and the detection method of a simple threshold cannot meet the requirements. To solve this problem, based on the architecture of an intelligent substation, a method combining an improved density clustering algorithm and an improved single class support vector machine algorithm for abnormal data flow detection in intelligent substation is proposed. The k-dist graph optimized density clustering algorithm is used to cluster normal data stream samples to form sample clusters. An improved particle swarm optimization algorithm is used to optimize the single class support vector machine algorithm, and the corresponding detection model is established to detect abnormal data flow. The effectiveness of the proposed method is verified by comparing the simulation with the traditional detection method. The results show that compared with the traditional OCSVM method, the proposed anomaly detection method divides the conventional data stream samples into multiple OCSVM models, which can wrap the normal samples more closely. The detection effect is ideal, and the detection accuracy is higher than 99%, which can meet the requirements of accuracy and real-time for anomaly data detection. This work is supported by the Science and Technology Project of China Southern Power Grid Co., Ltd. (No. 0002200000072652).