Abstract: In the context of big data, the detection performance of minority classes is poor when facing imbalanced data sets. To address this issue, a combined model of relevance vector machine (RVM) and one- class support vector machine (OC- SVM) is proposed to achieve ICS intrusion detection under imbalanced data sets. All attack type data was treated as a type of abnormal data. It was used to form a balanced sample set with normal data to solve two classification problems. Furthermore, an RVM model was established to jointly optimize feature selection and classification decision functions, thereby classifying data into two categories: normal and abnormal. To address the imbalance problem of the distribution of abnormal samples, a multi- level OC- SVM model was constructed to achieve the identification of different attack types one by one. The RVM and multilevel OC- SVM decision results were integrated to obtain the final ICS intrusion detection result. At the same time, considering the problem that the recognition performance of RVM and OC- SVM was greatly affected by the kernel parameters, an improved water cycle optimization algorithm (IWCA) was proposed to globally optimize them and improve the recognition performance. The experimental results based on the KDD CUP99 intrusion detection evaluation standard dataset show that the proposed method exhibits significant advantages in terms of detection accuracy (ACC), false positive rate (FPR), false negative rate (FNR), and ROC curve AUC value, and has high application prospects.