Novel Deep Learning-Based Approach for Detection, Classification, and Mitigation of Cyber Attacks in Power Distribution Systems

Distribution automation (DA) systems face critical cybersecurity challenges due to legacy communication protocols and the expanded attack surface introduced by Industrial Internet of Things (IIoT) integration. To address these issues, this paper proposes a two-stage cyber-resilient framework for detecting and mitigating cyber-attacks. The first stage uses an advanced deep neural network (ADNN) to detect and classify multiple attack types, including unauthorized command injection, network latency anomalies, and Denial-of-Service (DoS) attacks. The model is trained using a hybrid feature set that combines Wireshark footprints with distribution system data. The second stage improves system resilience by applying a transformer-based deep learning model to recover data packets lost due to cyber-attacks. The framework is validated on a cyber-physical testbed based on an IEEE 13-bus distribution network implemented in a real-time digital simulator (RTDS) with industrial-grade hardware and a communication network emulator. Experimental results demonstrate strong generalization to dynamic attacks, achieving a 45-61% reduction in retraining effort while retaining 99% performance on unseen data. The algorithm achieves over 96% per-class accuracy, a per-class false alarm rate below 1%, and an overall detection accuracy of 98%, effectively distinguishing cyber-attacks from normal power system events. High-fidelity data recovery is achieved with an${\mathrm{R}^2}$value of 0.9898, confirming accurate reconstruction of lost measurements. The end-to-end detection, classification, and mitigation process completes within approximately 95 μs, meeting latency requirements for time-critical DA operations. This demonstrates computational efficiency and real-time applicability. Further, it outperforms existing studies across multiple metrics.