1. A system comprising: a device monitoring component configured to measure control system behavior; and an intrusion prevention system communicatively coupled to the device monitoring component and a communications network, wherein the intrusion prevention system comprises: a control system analysis component configured to analyze the control system behavior measured by the device monitoring component against a first rule set to determine whether an anomaly, an intrusion, or both are present.