1. A system for cyber-physical system defense, the system comprising: a sensor interface to receive sensor data from a plurality of sensors; a sampling circuit set to sample sensor disagreements between the plurality of sensors over time; a cluster circuit set to perform cluster analysis on the sampled sensor disagreements including the cluster circuit set to perform a cluster analysis algorithm to calculate a time period and determine whether a predetermined number of the sampled sensor disagreements occurred within the calculated time period, wherein the calculated time period is calculated via an inverse Gamma function with a probability parameter, a sample-size parameter, and a time-of-arrival parameter, the time-of-arrival parameter determined via measurement of a sensor system during normative testing; and an alert circuit set to provide a deviation indication in response to the cluster analysis resulting in disagreement density beyond a threshold, the deviation indication including an alarm.