Grid-connected microgrids enhance grid reliability and reduce costs by integrating distributed energy resources such as solar panels and battery storage systems. However, many microgrids operate in remote locations with limited monitoring and rely on legacy communication protocols that lack robust cybersecurity safeguards. Adversaries can exploit these vulnerabilities to tamper with critical signals—such as battery state-of-charge or power reference commands—disrupting the microgrid's central controller and forcing increased reliance on grid power while inflating operational costs.
A new research framework addresses this vulnerability through an integrated anomaly detection and mitigation system (ADMS). The approach combines an online long short-term memory (LSTM) neural network with a model-based mitigation strategy to operate alongside the microgrid's existing optimization logic. The LSTM system continuously monitors control and measurement signals for suspicious patterns indicative of cyberattacks, while the mitigation layer automatically adjusts power reference commands using heuristic estimates when anomalies are detected.
Testing on a hardware-in-the-loop cybersecurity testbed—which simulated realistic microgrid hardware, distributed energy protocols, and client-server architectures—demonstrated exceptional performance. The anomaly detection system achieved 99.97% real-time detection accuracy across multiple attack scenarios. Critically, once an attack was detected, the mitigation mechanisms maintained operational costs near optimal levels by relying on heuristic-based control rather than compromised sensor data.
The framework addresses a pressing industry need as utilities increasingly deploy autonomous microgrids in geographically dispersed locations where direct human oversight is impractical. By coupling sophisticated machine learning detection with pragmatic mitigation strategies, the system preserves both security and economic performance. This research aligns with emerging industry standards for distributed energy resource cybersecurity and provides utilities with a practical, deployable solution for protecting microgrid investments against evolving cyber threats.
