Industrial control systems anomaly detection by learning algorithms with physical process features

A system for monitoring security in a cyber-physical system comprises: a packet parser configured to obtain, from network traffic in the cyber-physical system, a plurality of sensor measurements from one or more sensors of the cyber-physical system, the plurality of sensor measurements relating to a physical process in the cyber-physical system, the physical process having a current process state; and a threat detector configured to determine, based on a model of the physical process and the current process state, whether the plurality of sensor measurements correspond to a security threat to the cyber-physical system.