A method in a cyber-physical system comprising at least one sensor means (102a,; 102b; 102c; 102d) for creation of a baseline of normal behavior of the system for anomaly detection in sensor data and the method comprises the steps: - collecting a time series of raw process data from the at least one sensor means, - defining a lag parameter, - defining a training subseries of length being a portion of the time series representing a normal process behavior, thus selecting a portion of the time series, - applying a sliding window mechanism with a length of the lag parameter to the time series, - forming a defined quantity of lagged vectors (x i, 4) from the training subseries of length lagged with the lag parameter, wherein the defined quantity is a number of lagged vectors equal to the training subseries length minus the lag parameter plus one, - embedding the lagged vectors in a vector space ( R L) with a number of dimensions equal to the lag parameter, - constructing a trajectory matrix (X; 3) wherein the columns are the embedded lagged vectors, - performing Singular Value Decomposition of the trajectory matrix (X; 3) obtaining a first set of eigenvectors, wherein the number of eigenvectors in the first set is equal to the lag parameter, - selecting a statistical dimension (r) of the time series, - applying the statistical dimension (r) selecting the first eigenvectors from the first set of eigenvectors to extract noise-reduced information describing the deterministic behavior of the process, - using the noise-reduced information to create a mathematical representation of the normal process behavior by creating a second matrix (U; 5) with a number of rows corresponding to the lag parameter and a number of columns corresponding to the statistical dimension (r), wherein the columns are the noise-reduced information from the first set of eigenvectors, - computing the sample mean (c) of the lagged vectors, - defining a subspace () spanned by the column vectors of the second matrix, - projecting the lagged vectors onto the defined subspace (), wherein the projected vectors of the lagged vectors form a cluster, and - calculating a centroid ( c̃) of the cluster formed in the subspace (). - collecting a time series of raw process data from the at least one sensor means, - defining a lag parameter, - defining a training subseries of length being a portion of the time series representing a normal process behavior, thus selecting a portion of the time series, - applying a sliding window mechanism with a length of the lag parameter to the time series, - forming a defined quantity of lagged vectors (x i, 4) from the training subseries of length lagged with the lag parameter, wherein the defined quantity is a number of lagged vectors equal to the training subseries length minus the lag parameter plus one, - embedding the lagged vectors in a vector space ( R L) with a number of dimensions equal to the lag parameter, - constructing a trajectory matrix (X; 3) wherein the columns are the embedded lagged vectors, - performing Singular Value Decomposition of the trajectory matrix (X; 3) obtaining a first set of eigenvectors, wherein the number of eigenvectors in the first set is equal to the lag parameter, - selecting a statistical dimension (r) of the time series, - applying the statistical dimension (r) selecting the first eigenvectors from the first set of eigenvectors to extract noise-reduced information describing the deterministic behavior of the process, - using the noise-reduced information to create a mathematical representation of the normal process behavior by creating a second matrix (U; 5) with a number of rows corresponding to the lag parameter and a number of columns corresponding to the statistical dimension (r), wherein the columns are the noise-reduced information from the first set of eigenvectors, - computing the sample mean (c) of the lagged vectors, - defining a subspace () spanned by the column vectors of the second matrix, - projecting the lagged vectors onto the defined subspace (), wherein the projected vectors of the lagged vectors form a cluster, and - calculating a centroid ( c̃) of the cluster formed in the subspace ().