  In a state estimator, the presence of malicious or simply corrupt sensor data
or bad data is detected by the high value of normalized measurement residuals
that exceeds the threshold value, determined by the $\chi^2$ distribution.
However, high normalized residuals can also be caused by another type of
anomaly, namely gross modeling or topology error. In this paper we propose a
method to distinguish between these two sources of anomalies - 1) malicious
sensor data and 2) modeling error. The anomaly detector will start with
assuming a case of malicious data and suspect some of the individual
measurements corresponding to the highest normalized residuals to be
`malicious', unless proved otherwise. Then, choosing a change of basis, the
state space is transformed and decomposed into `observable' and `unobservable'
parts with respect to these `suspicious' measurements. We argue that, while the
anomaly due to malicious data can only affect the `observable' part of the
states, there exists no such restriction for anomalies due to modeling error.
Numerical results illustrate how the proposed anomaly diagnosis based on Kalman
decomposition can successfully distinguish between the two types of anomalies.
