With　the　growing　demand　of　location-independent　access　to　Industrial　Control　Systems　(ICS),　anomaly　detection　scheme　for　industrial　Ethernet　which　highly　satisfied　with　demanding　real-time　and　reliable　industrial　applications　becomes　one　of　the　problems　in　ICS.　In　this　paper,　we　present　an　innovative　approach　to　build　a　traffic　model　based　on　structural　time　series　model.　Basic　structural　model　which　decomposes　time　series　into　four　factors　is　established　by　the　stationary　analysis　of　industrial　traffic.　Parameters　in　the　model　are　identified　by　state　space　model　which　is　conducted　from　the　training　sequence　using　standard　Kalman　filter　recursions　and　EM　algorithm.　Furthermore,　performance　of　state　space　model　is　evaluated　by　the　experimental　comparative　results　that　confirm　significant　improvement　in　detection　accuracy　and　the　validity　of　abnormal　data　localization.