1. A system to protect an industrial asset control system, comprising: a plurality of threat nodes each generating a series of current threat node values over time that represent a current operation of the industrial asset control system; and a threat detection computer, coupled to the plurality of threat nodes, to: (i) receive the series of current threat node values and generate a set of current feature vectors, (ii) access a threat detection model having at least one decision boundary created using a set of normal feature vectors a set of threatened feature vectors, and (iii) execute the threat detection model and transmit a threat alert signal based on the set of current feature vectors and the at least one decision boundary.