According to some embodiments, system and methods are provided including receiving, via a communication interface of an event detection and classification module comprising a processor, data from one or more sensors in a system; determining an event occurred based on the received data; applying a coherency similarity process to the received data via a classification module; determining whether the event is an actual event or a mal-doer event based on an output of the classification module; transmitting the determination of the event as the actual or the mal-doer event; and modifying operation of the system based on the transmitted output. Numerous other aspects are provided.