This article introduces a thermal side channel as a proxy for the behavior of embedded processors to detect changes in the behavior in a cyber-physical system. Such changes may be due to software/hardware attacks and altered processors. Since control system processes are periodic computations, the thermal side channels exhibit a temporal pattern. This enables the detection of altered code and changed device characteristics. We present a machine learning approach to estimate the activity of the embedded device from the time sequence of thermal images and show that deviations from expected behavior can be detected. The approach is validated on a multi-core processor running a periodic computational code. The infrared imager collects thermal imagery from the processor, which is cooled from the backside. Instead of an external imager, one can deploy a finite number of on-chip temperature sensors. This article shows that integrating on-chip temperature sensors allows robust real-time monitoring of the processor behavior. Finally, we offer a machine learning approach to optimally place the on-chip sensors to aid detection.