Cyberattacks are rampant and can play a major role in modern warfare, particularly on a widely adopted platforms such as the MIL-STD-1553 standard. To protect a 1553 communication bus system from attacks, a trained statistical or machine learning model can be used to monitor commands from a bus controller of the 1553 communication bus system. The statistical and/or machine learning model can be trained to recognize communication anomalies based at least on the probability distribution of patterns of one or more commands. The statistical model can be stochastic model such as a Markov chain that describes a sequence of possible commands in which the probability of each command depends on the occurrence of a group of one or more commands.