A system to protect a cyber physical system, comprising: a plurality of real-time monitoring nodes to receive streams of monitoring node signal values over time that represent a current operation of the cyber physical system; a local status determination module comprising an ensemble of local agents, the module adapted to determine an agent anomaly status for one or more nodes; a global status determination module comprising an ensemble of global agents, the module adapted to determine an agent anomaly status for the cyber physical system; a threat detection computer platform comprising a memory and a computer processor, the threat detection computer platform coupled to the plurality of real-time monitoring nodes and adapted to: receive the monitoring node signal values, generate feature vectors from the received monitoring node signal values; compare via the local status determination module the feature vectors with at least one decision boundary associated with a local abnormal detection model; compare via the global status determination module the feature vectors with at least one decision boundary associated with a global abnormal detection model; and transmit an abnormal alert signal from the local status determination module and the global status determination module based on a result of each comparison, wherein each local agent is adapted to determine an agent anomaly status for a given node and a confidence score (131/135) for the agent anomaly status, and wherein each global agent is adapted to determine an agent anomaly status for a mode or a region of operation of the cyber physical system and a confidence score (131/135) for the agent anomaly status. a plurality of real-time monitoring nodes to receive streams of monitoring node signal values over time that represent a current operation of the cyber physical system; a local status determination module comprising an ensemble of local agents, the module adapted to determine an agent anomaly status for one or more nodes; a global status determination module comprising an ensemble of global agents, the module adapted to determine an agent anomaly status for the cyber physical system; a threat detection computer platform comprising a memory and a computer processor, the threat detection computer platform coupled to the plurality of real-time monitoring nodes and adapted to: receive the monitoring node signal values, generate feature vectors from the received monitoring node signal values; compare via the local status determination module the feature vectors with at least one decision boundary associated with a local abnormal detection model; compare via the global status determination module the feature vectors with at least one decision boundary associated with a global abnormal detection model; and transmit an abnormal alert signal from the local status determination module and the global status determination module based on a result of each comparison, wherein each local agent is adapted to determine an agent anomaly status for a given node and a confidence score (131/135) for the agent anomaly status, and wherein each global agent is adapted to determine an agent anomaly status for a mode or a region of operation of the cyber physical system and a confidence score (131/135) for the agent anomaly status. receive the monitoring node signal values, generate feature vectors from the received monitoring node signal values; compare via the local status determination module the feature vectors with at least one decision boundary associated with a local abnormal detection model; compare via the global status determination module the feature vectors with at least one decision boundary associated with a global abnormal detection model; and transmit an abnormal alert signal from the local status determination module and the global status determination module based on a result of each comparison, wherein each local agent is adapted to determine an agent anomaly status for a given node and a confidence score (131/135) for the agent anomaly status, and wherein each global agent is adapted to determine an agent anomaly status for a mode or a region of operation of the cyber physical system and a confidence score (131/135) for the agent anomaly status.