SENTRY: Sensor and Natural Language Processing-Fused Real-Time Cyberattack Detection and Mitigation in Smart Microgrids

Smart microgrids increasingly rely on complex cyber-physical control and communication infrastructures, making them vulnerable to coordinated cyberattacks that may not be fully observable through sensor data alone. This paper presents SENTRY, a real-time cyberattack detection and mitigation framework that explicitly fuses high-frequency sensor measurements with semantic information extracted from system logs using natural language processing. SENTRY employs a gated multimodal architecture that adaptively integrates time-series representations from LSTM or Transformer-XL models with log embeddings generated by DistilBERT or RoBERTa, enabling context-aware detection of Replay, False Data Injection (FDI), and Denial-of-Service (DoS) attacks. Beyond detection, the framework incorporates a selective mitigation strategy based on a cold-standby backup communication channel that is activated only after verified attack detection, reducing overhead and false activations compared to always-on redundancy approaches. Experiments conducted on a simulated smart microgrid dataset comprising 504 scenarios demonstrate that the best-performing configuration (LSTM + DistilBERT) achieves 94.92% detection accuracy with an average inference latency of 0.203 ms. The mitigation mechanism restores voltage stability within 1.07 s under replay attacks and within sub-millisecond timescales for FDI and DoS attacks, while exhibiting zero false activations during normal operation. These results demonstrate that multimodal fusion of sensor data and system logs, combined with selective mitigation, can significantly enhance the security and resilience of smart microgrids.