This paper presents a starting Ph.D topic on intrusion detection in complex industrial control systems. We are interested in network-based, process-oriented attacks, i.e. attacks which do not violate network protocols and target specifically the integrity of the physical process. We consider complex industrial processes with event-driven and time-driven weakly interconnected sub-processes. We consider local security properties of the physical sub-processes but also global properties which cannot be decomposed locally. Therefore we aim to develop an anomaly-based, process-aware, distributed detection methodology for event-driven and continuous dynamical systems.