Abstract: Disclosed herein are systems and methods for anomaly detection. A distributed physical state estimation system determines low-level state estimates covering respective sections of a cyber-physical system based on raw, high-performance measurement data. Low-level state estimates may be determined for a plurality of sections (substations) concurrently. An upper-level state estimate may be derived from the low-level state estimates. Anomalies pertaining to the system may be detected through analysis of the low-level and upper-level state estimates. The anomalies may be analyzed to determined whether the system is exhibiting behavior indicative of a fault, cyber-attack, and/or compromise.