DL-Based Distributed Anomaly Detection for Attack Resilient DER Monitoring and Control Applications

The proliferation of distributed energy resources (DERs) within modern cyber-physical power systems has transformed grid operations, while simultaneously introducing sophis-ticated cybersecurity vulnerabilities. Communication protocols such as Modbus, SunSpec Modbus, and DNP3, widely used for DER coordination, were not originally designed with robust security, rendering them susceptible to confidentiality, integrity, and availability (CIA) threats. In this paper, we propose a scalable, distributed intrusion and anomaly detection system (D-IADS) that integrates protocol-specific rule generation with deep learning (DL)-based temporal pattern recognition. Our framework employs physics-informed thresholding, rule-based mitigation logic, and a lightweight LSTM-based anomaly detection module deployed across edge-intelligent devices (EIDs) and control centers. We present a rule taxonomy for IT/OT-based attacks on SunSpec Modbus and DNP3, along with a hybrid Snort/Suricata-compatible rule engine. Case studies on the IEEE 123-bus feeder demonstrate the proposed system's ability to achieve 97.32% anomaly detection accuracy and 97.30% macro-precision against stealthy cyberattacks. This research offers a modular and deployment-ready solution for securing DER-integrated smart grids.