Industrial control systems is the core part of infrastructures such as power grid. nowadays , with enhancement in technology, the need for centralized control over infrastructures is intensified. For this reason, there is a rising trend to extract industrial networks from isolation and connect them to public networks such as internet. There are some advantages in connecting industrial networks to public networks such as various control network interconnection via WAN, remote control over control networks and adoption to TCP/IP stack. One important disadvantage of connecting industrial networks to public network is security degradation which is unacceptable for industrial networks which control critical infrastructures. As a result, control networks become more vulnerable to cyber attacks and being exposed to the same threats that make suffer IT networks. For this reasons, securing industrial networks become very important. However, public networks and industrial networks are inherently different and security strategies which are used in public networks, cannot be adopted to industrial networks. One of the network security elements, is intrusion detection system. Intrusion detection systems are deployed in networks and detect intrusions and attacks by means of analyzing network traffic. In this thesis, a comprehensive intrusion detection system for Modbus/TCP networks, is proposed, with the consideration of security differences between industrial network and public networks in mind. The proposed intrusion detection system is a state-based intrusion detection and designed with this principle in mind that, during stable situation, industrial network status is not changed significantly. The proposed intrusion detection system triggers an alarm when state of the process, changes. The proposed comprehensive detection system comprises three complementary components: first component is state-based intrusion detection which detects transformation in process state. Second component is critical state detection which determines whether the process state is in critical hypervolume or not and the third component is anomaly origin detection which determines the process variable that causes anomaly. For evaluating efficiency of proposed approach , a boiler control system is simulated and test datasets are provided from this simulation. Proposed intrusion detection system, evaluated through these datasets. Results show that proposed approach is highly efficient for detecting these anomalies. Key words: Intrusion Detection System , Industrial Networks , Modbus/TCP , anomaly Detection