As the core equipment of the distributed photovoltaic grid-connected system to realize the functions of telemetry, telesignaling, and remote control, the secondary fusion terminal is the key target of network attacks. Based on the typical service features of secondary fusion terminals, this paper analyzes the network flow security threats of secondary fusion terminals in combination with DNP 3, which is widely used in distributed energy systems. Furthermore, the network flow security protection strategy of the secondary integration terminal based on DNP3 is proposed. The experimental results show that the proposed anomaly traffic detection model based on Attention-LSTM can effectively detect the abnormal traffic of the secondary fusion terminal.