Abstract: A system and method for anomaly detection in a networked control system can include: receiving information transmitted over a network at a device; parsing the information at the device to determine whether information specified as relevant to anomaly detection is contained therein, wherein if relevant information is identified, then extracting the relevant information, including, for example protocol information, and saving the relevant information in a first dataset, and if relevant information is not identified, saving the information in a second dataset; storing the first and second datasets on a memory to train a prediction model for anomaly detection; and monitoring network traffic using the prediction model for anomaly detection.