Network-based, unsupervised classifiers are provided. The classifiers identify both known and unknown attacks aimed at industrial networks without the need to have a priori knowledge of known malicious attack patterns.