Real‐Time Cyber‐Attack Detection and Adaptive Recovery in Islanded AC Microgrids Using a Fourth‐Order Backward‐Difference Predictor and Teager–Kaiser Energy Operator

ABSTRACT

Although islanded microgrids offer significant operational autonomy, their lack of external voltage and frequency references and absence of a global supervisory structure make them highly vulnerable to cyber‐attacks. Timely and accurate detection of such attacks is a critical prerequisite for maintaining microgrid stability and resilience. This paper presents a computationally efficient technique for real‐time detection and adaptive recovery of islanded AC microgrids against false data injection (FDI) and denial‐of‐service (DoS) attacks. Unlike complex machine learning‐ and observer‐based techniques, the proposed technique integrates a fourth‐order backward difference‐based predictor with the Teager–Kaiser energy operator (TKEO). Local frequency deviations are first estimated with high accuracy, generating a residual signal that is subsequently amplified by TKEO and assessed through an attack detection index (ADI). The key innovation lies in coupling this detection mechanism with an adaptive recovery scheme, which updates the communication adjacency matrix weights to isolate compromised links and restore network stability without prior knowledge of microgrid topology, attack type or location. Extensive simulations on an islanded IEEE 34‐bus test feeder demonstrate that the proposed technique achieves a high detection accuracy of 98.6% with a delay below 0.5 s. Moreover, it remains robust against measurement uncertainties, severe noise and typical microgrid disturbances such as sudden load changes and capacitor/reactor switching, while ensuring compatibility with diverse communication infrastructures. These results highlight the technique's effectiveness, resilience and practical applicability for next‐generation cyber‐secure microgrids.