receiving, via a communication interface of an event detection and classification module comprising a processor, data from a plurality of sensors in a system, the data including a first data point and a second data point, wherein the event detection and classification module includes a detection module and a classification module;

determining an event occurred based on a change in measurements of the received first data point compared to the second data point and the change is within a pre-set magnitude and within a pre-defined amount of time;

applying a coherency similarity process to the received data via a classification module, wherein the coherency similarity process determines for the received data, which sensors of the plurality of sensors oscillate together before settling back to equilibrium and which sensors of the plurality of sensors oscillate out of phase before settling back to equilibrium, and the classification module determines whether the received data is similar to expected data for the event based on the applied coherency similarity process, and the similarity is within one of a threshold value and a range of values;

determining whether the event is an actual event or a mal-doer event based on an output of the classification module;

transmitting the determination of the event as the actual or the mal-doer event; and

modifying operation of the system based on the transmitted output.