1. A method for use in identifying abnormal behavior in a control system, said method comprising: receiving, by a computing device, a plurality of operating events associated with a control system, wherein the operating events represent at least one physical operating event; determining, by the computing device, an actual behavior of the control system based on the operating events; comparing, by the computing device, the actual behavior to an expected behavior to determine whether the actual behavior differs from the expected behavior, wherein the expected behavior includes a correlation between a plurality of operating events associated with the control system; receiving, by the computing device, an indication of whether the actual behavior is abnormal from a user when the actual behavior differs from the expected behavior; and updating, by the computing device, the expected behavior based on the received indication.