A system to protect an industrial asset control system, comprising: a plurality of threat nodes each generating a series of current threat node values over time that represent a current operation of the industrial asset control system; and a threat detection computer, coupled to the plurality of threat nodes, to: (i) receive the series of current threat node values and generate a set of current feature vectors, (ii) access a threat detection model having at least one decision boundary created using a set of normal feature vectors and a set of threatened feature vectors, and (iii) execute the threat detection model and transmit a threat alert signal based on the set of current feature vectors and the at least one decision boundary; a normal space data source storing, for each of the plurality of threat nodes, a series of normal threat node values over time that represent normal operation of the industrial asset control system; a threatened space data source storing, for each of the plurality of threat nodes, a series of threatened threat node values over time that represent a threatened operation of the industrial asset control system; and a threat detection model creation computer, coupled to the normal space data source and the threatened space data source, to: (i) receive the series normal threat node values and generate the set of normal feature vectors, (ii) receive the series of threatened threat node values and generate the set of threatened feature vectors, and (iii) automatically calculate and output the at least one decision boundary for the threat detection model based on the set of normal feature vectors and the set of threatened feature vectors. a plurality of threat nodes each generating a series of current threat node values over time that represent a current operation of the industrial asset control system; and a threat detection computer, coupled to the plurality of threat nodes, to: (i) receive the series of current threat node values and generate a set of current feature vectors, (ii) access a threat detection model having at least one decision boundary created using a set of normal feature vectors and a set of threatened feature vectors, and (iii) execute the threat detection model and transmit a threat alert signal based on the set of current feature vectors and the at least one decision boundary; (i) receive the series of current threat node values and generate a set of current feature vectors, (ii) access a threat detection model having at least one decision boundary created using a set of normal feature vectors and a set of threatened feature vectors, and (iii) execute the threat detection model and transmit a threat alert signal based on the set of current feature vectors and the at least one decision boundary; a normal space data source storing, for each of the plurality of threat nodes, a series of normal threat node values over time that represent normal operation of the industrial asset control system; a threatened space data source storing, for each of the plurality of threat nodes, a series of threatened threat node values over time that represent a threatened operation of the industrial asset control system; and a threat detection model creation computer, coupled to the normal space data source and the threatened space data source, to: (i) receive the series normal threat node values and generate the set of normal feature vectors, (ii) receive the series of threatened threat node values and generate the set of threatened feature vectors, and (iii) automatically calculate and output the at least one decision boundary for the threat detection model based on the set of normal feature vectors and the set of threatened feature vectors. (i) receive the series normal threat node values and generate the set of normal feature vectors, (ii) receive the series of threatened threat node values and generate the set of threatened feature vectors, and (iii) automatically calculate and output the at least one decision boundary for the threat detection model based on the set of normal feature vectors and the set of threatened feature vectors.