System and method to monitor programmable logic controller (PLCS) in a cyber physical environment

An anomaly monitoring system for a cyber-physical environment having at least one programmable logic controller and a monitored component, the anomaly monitoring system having a human machine interface, a separate controller with at least a processor and associated memory, and providing a communication network for electronic communication between components of the cyber-physical environment, the anomaly monitoring system providing at least one plugin module to monitor the performance of the monitored component and the PLC, as provided through the communication network through a PLC data collection module, the plugin module having a processor, memory, and instructions stored in the memory and executed by the processor, the plug in module comparing the data from the PLC data collection module to a model of learned behavior patterns, and thereby classify reviewed data as being normal or anomaly events;

• and further comprising a network switch configured to direct the transmission of data from the PLC data collection module to the separate controller;
• wherein the at least one plugin module is provided as a lightweight framework, with less than 20% of the at least one plugin module being associated with the performance of the PLC, and the balance of the at least one plugin module being associated with the performance of the separate controller.