A system for determining a source of anomaly in a cyber-physical system, the system comprising: a computing platform including computing hardware of at least one processor and memory operably coupled to the at least one processor; instructions that, when executed on the computing platform, cause the computing platform to implement: a forecasting tool configured to - obtain a plurality of CPS feature values during an input window, the input window determined by a trained forecasting model, and forecast the plurality of CPS feature values for a forecast window using the trained forecasting model and the CPS feature values obtained during the input window; and an anomaly identification tool configured to - determine a total forecast error for the plurality of CPS features in the forecast window, identify an anomaly in the cyber-physical system when the total forecast error exceeds a total error threshold, and identify at least one CPS feature as the source of the anomaly when the contribution of forecast error by the at least one CPS feature from among the plurality of CPS features to the total forecast error is higher than the contribution by other CPS features from among the plurality of CPS features to the total forecast error. a computing platform including computing hardware of at least one processor and memory operably coupled to the at least one processor; instructions that, when executed on the computing platform, cause the computing platform to implement: a forecasting tool configured to - obtain a plurality of CPS feature values during an input window, the input window determined by a trained forecasting model, and forecast the plurality of CPS feature values for a forecast window using the trained forecasting model and the CPS feature values obtained during the input window; and an anomaly identification tool configured to - determine a total forecast error for the plurality of CPS features in the forecast window, identify an anomaly in the cyber-physical system when the total forecast error exceeds a total error threshold, and identify at least one CPS feature as the source of the anomaly when the contribution of forecast error by the at least one CPS feature from among the plurality of CPS features to the total forecast error is higher than the contribution by other CPS features from among the plurality of CPS features to the total forecast error. a forecasting tool configured to - obtain a plurality of CPS feature values during an input window, the input window determined by a trained forecasting model, and forecast the plurality of CPS feature values for a forecast window using the trained forecasting model and the CPS feature values obtained during the input window; and obtain a plurality of CPS feature values during an input window, the input window determined by a trained forecasting model, and forecast the plurality of CPS feature values for a forecast window using the trained forecasting model and the CPS feature values obtained during the input window; and an anomaly identification tool configured to - determine a total forecast error for the plurality of CPS features in the forecast window, identify an anomaly in the cyber-physical system when the total forecast error exceeds a total error threshold, and identify at least one CPS feature as the source of the anomaly when the contribution of forecast error by the at least one CPS feature from among the plurality of CPS features to the total forecast error is higher than the contribution by other CPS features from among the plurality of CPS features to the total forecast error. determine a total forecast error for the plurality of CPS features in the forecast window, identify an anomaly in the cyber-physical system when the total forecast error exceeds a total error threshold, and identify at least one CPS feature as the source of the anomaly when the contribution of forecast error by the at least one CPS feature from among the plurality of CPS features to the total forecast error is higher than the contribution by other CPS features from among the plurality of CPS features to the total forecast error.