Method of monitoring operation of an electric power system (1000, 1600) which has a power utility automation system (1981-1984, 1991-1994), the power utility automation system (1981-1984, 1991-1994) comprising a plurality of intelligent electronic devices (IEDs) communicating via a communication network, the method comprising the following steps performed by a monitoring system (10; 92-95; 102-105) which uses configuration information that specifies properties of the plurality of IEDs (1981-1984; 82-85) and further includes information on components of the electric power system (1000, 1600) and their interconnections: monitoring, during operation of the electric power system (1000, 1600), properties of the electric power system (1000, 1600), the monitored properties comprising monitored data messages (41, 44, 47) which are transmitted by the plurality of IEDs (1981-1984; 82-85) over the communication network; and evaluating the monitored data messages (41, 44, 47) based on the configuration information to detect a critical event during operation of the electric power system (1000, 1600), wherein the evaluating comprises analyzing a data content (43, 46, 49) of at least some of the monitored data messages (41, 44, 47) which includes a process parameter of a primary element of the electric power system (1000, 1600) to determine, based on the configuration information, whether the data content (43, 46, 49) corresponds to a valid behaviour of both the electric power system (1000, 1600) and the power utility automation system (1981-1984, 1991-1994); wherein the monitoring system (10; 92-95; 102-105) generates a system model for the electric power system (1000, 1600) and its power utility automation system (1981-1984, 1991-1994) based on the configuration information; and wherein the evaluating step comprises: predicting anticipated data messages between the plurality of IEDs (1981-1984; 82-85) based on the system model, and comparing the monitored data messages (41, 44, 47) to the predicted anticipated data messages (41, 44, 47), characterized in that the predicting step comprises using the system model and the process parameter of the primary element included in the data message transmitted by a first IED to predict which value for another process parameter should be included in another data message transmitted by a second IED; and the method further comprises generating an alert signal in response to detection of the critical event. monitoring, during operation of the electric power system (1000, 1600), properties of the electric power system (1000, 1600), the monitored properties comprising monitored data messages (41, 44, 47) which are transmitted by the plurality of IEDs (1981-1984; 82-85) over the communication network; and evaluating the monitored data messages (41, 44, 47) based on the configuration information to detect a critical event during operation of the electric power system (1000, 1600), wherein the evaluating comprises analyzing a data content (43, 46, 49) of at least some of the monitored data messages (41, 44, 47) which includes a process parameter of a primary element of the electric power system (1000, 1600) to determine, based on the configuration information, whether the data content (43, 46, 49) corresponds to a valid behaviour of both the electric power system (1000, 1600) and the power utility automation system (1981-1984, 1991-1994); wherein the monitoring system (10; 92-95; 102-105) generates a system model for the electric power system (1000, 1600) and its power utility automation system (1981-1984, 1991-1994) based on the configuration information; and wherein the evaluating step comprises: predicting anticipated data messages between the plurality of IEDs (1981-1984; 82-85) based on the system model, and comparing the monitored data messages (41, 44, 47) to the predicted anticipated data messages (41, 44, 47), predicting anticipated data messages between the plurality of IEDs (1981-1984; 82-85) based on the system model, and comparing the monitored data messages (41, 44, 47) to the predicted anticipated data messages (41, 44, 47),