This paper, for the purpose of meeting challenges of fewer resources of storage and calculation in the detection of ICS intrusion as well as real-time requirements, has particularly designed an online hybrid kernel learning machine with dynamic forgetting mechanism. First, on the basis of online kernel limit learning machine, a dynamic forgetting mechanism is designed to dynamically adjust the amount of forgetting data according to the current block error, which reduces the system burden and improves the detection accuracy. Then, it replaces the former single kernel function with a hybrid kernel function, which successfully advances the accuracy rate and generalized performance. Finally, a hybrid noise-reducing autoencoder is created to perform dimensional reduction of industrial data with huge dimensions, resulting in the improvement of algorithm and efficiency. The validity and superiority of the proposed online hybrid kernel learning machine with dynamic forgetting mechanism are verified through simulation experiments.