An apparatus for a network of electrical and/or electronic devices coupled to a data bus comprises a sensor coupled to the data bus and configured to capture information content communicated through the data bus in a form of electromagnetic emissions being at least one of differential mode electromagnetic emissions, common mode electromagnetic emissions, coupled radiated electromagnetic emissions, and data bit streams; one or more processors or logic devices, and a non-transitory computational medium comprising executable instructions. The apparatus measure a feature value in at least one region of a time domain or a frequency domain of the captured electromagnetic emissions, calculates a difference value between the measured feature value and one or more baseline feature values, and determines, based on the calculated value, a presence or an absence of anomalies indicative of at least one of cyber intrusion attempt, cyber attack, cyber-physical attacks, malware, etc.