Methods and systems for detecting and correcting anomalies include detecting an anomaly in a cyber-physical system, based on a classification of time series information from sensors that monitor the cyber-physical system as being anomalous. A similarity graph is determined for each of the sensors, based on the time series information. A subset of the sensors that are related to the classification is selected, based on a spectral embedding of the similarity graphs. A corrective action is performed responsive to the detected anomaly, prioritized according to the selected subset.