A hybrid data-driven and physics-informed energy management model for electrical grids with spatio-temporal cyberattack detection-reconstruction using digital twin

• Real-time cyberattack detection and data reconstruction in EMS framework. • Model detects coordinated attacks using only RTU data, no PMU needed. • Physics-informed data reconstruction via network topology analysis. • Spatio-temporal analysis identifies multiple cyberattack scenarios. • EMS-Digital Twin feedback adapts dynamically to threats and grid states. This paper proposes a comprehensive framework for cyber-resilient optimal energy management system (EMS) in smart grids. A complete 24-hour closed-loop operational cycle is modeled and simulated. It begins with data measurement via a real-time updated nonlinear Digital Twin, followed by transmission through SCADA/RTUs, detection of cyberattacks, accurate reconstruction of corrupted data, and finally EMS. The outputs of EMS are then sent back to the Digital Twin, which is dynamically updated to reflect the actual network conditions and generate accurate synthetic measurements for the next hour. This entire process is embedded within a 24-hour rolling optimization scheme. The EMS includes a power flow model integrated with various distributed energy resources (DERs), such as renewables, diesel generator, battery, electric vehicle, and controllable loads. It also incorporates and ensures all technical, security, and dynamic constraints of the grid and DERs. Unlike previous studies that focus only on isolated aspects such as attack detection, data estimation, or day-ahead energy management, this work implements the entire process in a unified and dynamic framework. The model functions effectively in networks where PMUs are unavailable, as is the case in most real-world distribution grids, because it is designed solely based on RTU and SCADA data. Detection and reconstruction of coordinated attacks rely on physics-based recalculation methods, utilizing grid topology and data from neighboring buses to improve accuracy. The proposed model is validated on the IEEE 33-bus test system, successfully detecting various attack scenarios targeting different parameters, locations, and times. It reconstructs the correct values with high precision and optimizes the network operation accordingly. This 24-hour rolling simulation demonstrates the practicality and robustness of the approach in enabling secure, cost-effective, and resilient energy management in modern smart grids.