1. A method for detecting anomalies in an infrastructure, the method comprising: providing a computationally-intelligent analysis model to model a behavior of at least one detection instrument in said infrastructure; inputting control instrument sensor data into said analysis model, said sensor data being provided by sensors in said infrastructure; outputting an estimated behavior for said at least one detection instrument from said analysis model; comparing measured output data from said at least one detection instrument to said estimated behavior and generating a set of residuals representing a difference between said measured output data and said estimated behavior; and identifying anomalies when said residuals exceed a predetermined threshold; and wherein said inputting sensor data into said analysis model comprises: using lag time information to delay corresponding input data; estimating a lag time between a cause and an effect in an infrastructure; identifying a first variable as said cause and a second variable as said effect; specifying a desired time period over which the lag time is estimated; assigning a maximum possible lag time between said cause and effect; calculating a cross-correlation function between said first variable and said second variable over said desired time period; and shifting forward in time said second variable until said maximum lag time is reached while recalculating said cross-correlation function between each shift in time, wherein a total shift needed to reach a maximum absolute cross-correlation corresponds to said lag time.