Intrusion detection for critical infrastructure