The pervasive use of heterogeneous and non‐proprietary information and communication technology exposes the power grid to cyber‐attacks. In particular, monitoring‐control attacks (MCA), which manipulate control decisions by fabricating measurements, are highly threatening, because MCA are difficult to detect and can coordinately inflict severe consequences at a large scale. To defend against MCA, a semantic analysis framework is proposed in complement to direct‐setting intrusion detection. The proposed framework has the advantages of promising runtime and detection performance. The performance of the proposed framework is evaluated under different attack scenarios and compared with a direct‐settings intrusion detection systems using a 6‐bus test system and the New‐England 39‐bus test system.