A computer-implemented method, system, and computer program product are provided for anomaly detection in a power system. The method includes receiving, by a processor-device, a plurality of measurements from a plurality of meters throughout the power system. The method also includes generating, by the processor-device, temporal causal networks based on pair-wise relationships between the plurality of measurements from the plurality of meters over time. The method additionally includes determining, by the processor-device, invariant relationships for the plurality of meters between the temporal causal networks. The method further includes predicting, by the processor-device, an anomaly from the invariant relationships for the plurality of meters with a residual anomaly threshold. The method also includes disabling one of the plurality of meters that originated the anomaly.