In order to ensure the network communication security of intelligent substations and their stable operation, this paper proposes an analysis method of abnormal flow based on machine learning k-means clustering algorithm. Firstly, according to the characteristics of the process level network in the intelligent substation, the message structure of IEC61850 intelligent substation's proprietary GOOSE(generic object-oriented substation event) and SV protocol is analyzed. Then, the network communication flow in the intelligent substation during normal operation is analyzed and selected by using a feature selection method based on information entropy. Finally, k-means clustering algorithm is used to complete the detection and analysis of the abnormal flow. Compared with the previous methods, the proposed method first selects the characteristics of process layer network flow information of intelligent substation. According to the theory of information entropy, the selection of important features and the elimination of redundant features are then completed, improving the efficiency of clustering algorithm and the accuracy of abnormal flow detection.