The power system is an important infrastructure that ensures social stability. With the development of information technologies, the power system has been providing more convenience with its highly digital and automatic characteristics. However, more and more network attacks against the power system network occurred, which could cause severe consequences. Hence, it is of great significance to ensure the network security of the power system. Because of attacks’ high concealment and high risk, the network attack detection has become a research hotspot in recent years. This paper studies the multi-step attack detection of the the power system, and proposes a multi-step attack detection framework. First, the alarm information of different intrusion detection systems is fused for further analysis. Then the massive alarms are aggregated and correlated to construct the attack chain templates for detecting multi-step attacks. Finally, by combining spatio-temporal constraint rules, the detection of multi-step attacks can be realized.