A computer-based method for multilevel intrusion detection in an automation and control system, the method comprising: placing at least two intrusion detection units (160, 161) in the automation and control system at different control levels of the system, the control levels comprising a field bus control level and a direct control level, wherein the field bus control level includes one or more field buses to which field devices are connected, wherein the direct control level includes direct controllers responsible for controlling actions of field devices and for collecting sensor and measurement information related to the field devices, wherein one of the at least two intrusion detection units (160, 161) is placed at the field bus control level and another one of the at least two intrusion detection units (160, 161) is placed at the direct control level; collecting, by the at least two intrusion detection units (160, 161), control data associated with a field device (102, 104, 106) of the automation and control system; translating, by the one of the at least two intrusion detection units, which is placed at the field bus control level, the field device control data it collects, from a serial protocol to a communication protocol used by higher control levels; correlating the control data collected and translated by the one of at least two intrusion detection unit, which is placed at the field bus control level, with the control data collected by the other one of the at least intrusion detection units, which is placed at the direct control level; detecting an anomaly based on the correlation; and identifying the anomaly as an intrusion detection. placing at least two intrusion detection units (160, 161) in the automation and control system at different control levels of the system, the control levels comprising a field bus control level and a direct control level, wherein the field bus control level includes one or more field buses to which field devices are connected, wherein the direct control level includes direct controllers responsible for controlling actions of field devices and for collecting sensor and measurement information related to the field devices, wherein one of the at least two intrusion detection units (160, 161) is placed at the field bus control level and another one of the at least two intrusion detection units (160, 161) is placed at the direct control level; collecting, by the at least two intrusion detection units (160, 161), control data associated with a field device (102, 104, 106) of the automation and control system; translating, by the one of the at least two intrusion detection units, which is placed at the field bus control level, the field device control data it collects, from a serial protocol to a communication protocol used by higher control levels; correlating the control data collected and translated by the one of at least two intrusion detection unit, which is placed at the field bus control level, with the control data collected by the other one of the at least intrusion detection units, which is placed at the direct control level; detecting an anomaly based on the correlation; and identifying the anomaly as an intrusion detection.