A method can include detection of policy anomalies in packets on a 1553B bus of an airborne system. A computer network defense (CND) capability message is decoded and indicates an interface to monitor. The interface is a 1553B bus of the airborne system. A CND command message, associated with the CND capability message, is decoded and includes a policy set. Packets are received from the 1553B bus. The 1553B packets are analyzed based on the policy set to determine anomalies. Non-anomalous 1553B packets are allowed to reach destinations of the non-anomalous 1553B packets. Anomalous 1553B packets are discarded such that the anomalous 1553B packets do not reach respective destinations of the anomalous 1533B packets.