1. A computer-implemented method comprising: receiving, by a processor, measurement data from each of a plurality of measurement targets in a system comprising a plurality of industrial control systems; computing, by the processor, a plurality of sets of anomaly values based on the measurement data and a computation algorithm according to a plurality of classifications corresponding to a plurality of properties of each measurement target; computing, by the processor, an anomaly pattern using the plurality of sets of anomaly values computed based on the measurement data and the computation algorithm according to the plurality of classifications corresponding to the plurality of properties of each measurement target; determining, by the processor, a situation of the system based on the anomaly pattern, wherein a determination of the situation of the system is made by comparing the anomaly pattern with previously stored anomaly; and implementing a countermeasure action based at least in part on the situation of the system, wherein the computation algorithm is selected from a plurality of computation algorithms based on a type of the measurement data.