A system to protect an industrial asset, comprising: a plurality of monitoring nodes each generating a series of current monitoring node values over time that represent a current operation of the industrial asset; and an attack detection computer platform, coupled to the plurality of monitoring nodes, to: receive the series of current monitoring node values and generate a set of current feature vectors including a current feature for capturing transients, access an attack detection model having at least one decision boundary created using at least one of a set of normal feature vectors and a set of attacked feature vectors, and execute the attack detection model and transmit an attack alert signal based on the set of current feature vectors and the at least one decision boundary; compute a decision boundary score; compare the decision boundary score to a threshold value to determine if the system statues of the industrial asset is attack or normal, characterized in that the current feature for capturing transients captures local transients at a monitoring node based on a time-derivative local features of time-domain values from a monitoring node and/or captures global transients at an industrial asset level based on the time-derivative features of time-domain values from a monitoring node, and the feature vectors are combined into a global feature vector to extract global features. a plurality of monitoring nodes each generating a series of current monitoring node values over time that represent a current operation of the industrial asset; and an attack detection computer platform, coupled to the plurality of monitoring nodes, to: receive the series of current monitoring node values and generate a set of current feature vectors including a current feature for capturing transients, access an attack detection model having at least one decision boundary created using at least one of a set of normal feature vectors and a set of attacked feature vectors, and execute the attack detection model and transmit an attack alert signal based on the set of current feature vectors and the at least one decision boundary; compute a decision boundary score; compare the decision boundary score to a threshold value to determine if the system statues of the industrial asset is attack or normal, receive the series of current monitoring node values and generate a set of current feature vectors including a current feature for capturing transients, access an attack detection model having at least one decision boundary created using at least one of a set of normal feature vectors and a set of attacked feature vectors, and execute the attack detection model and transmit an attack alert signal based on the set of current feature vectors and the at least one decision boundary; compute a decision boundary score; compare the decision boundary score to a threshold value to determine if the system statues of the industrial asset is attack or normal, characterized in that the current feature for capturing transients captures local transients at a monitoring node based on a time-derivative local features of time-domain values from a monitoring node and/or captures global transients at an industrial asset level based on the time-derivative features of time-domain values from a monitoring node, and the feature vectors are combined into a global feature vector to extract global features. the current feature for capturing transients captures local transients at a monitoring node based on a time-derivative local features of time-domain values from a monitoring node and/or captures global transients at an industrial asset level based on the time-derivative features of time-domain values from a monitoring node, and the feature vectors are combined into a global feature vector to extract global features.