Abstract: Aiming at the security threats and insufficient active defense faced by shore-power industrial control network under complex network conditions, this paper proposes a "peacetime-wartime integrated" network security monitoring system architecture that integrates simulation detection, vulnerability knowledge base and real-time protocol analysis. Relying on a virtual-real integrated hardware-in-the-loop simulation platform, the architecture integrates key technologies including protocol reverse engineering, vulnerability mining, and dynamic attack-defense deduction, so as to realize multi-dimensional security modeling and automated vulnerability reproduction of power industrial control protocols. Based on a knowledge graph-driven vulnerability knowledge base, an intelligent knowledge system covering protocol defects, firmware vulnerabilities, and configuration risks is established, which enables self-learning and rapid updating of security detection models. Adopting an in-depth packet parsing engine and protocol state machine modeling, the system achieves microsecond-level protocol anomaly detection and millisecond-level threat blocking response, and constructs a full lifecycle closed-loop protection mechanism for security incidents. The technology can be applied in high-fidelity simulation security drills in peacetime and minute-level emergency detection and dynamic protection in wartime, providing full-time support for shore power industrial control networks.