Multi-loop control strategy with embedded cyberattack detection for enhancing AC microgrid resilience in grid-tied and islanded operating modes

• Real-time detection of cyber-physical threats using second-derivative metrics. • Fault Ride-Through enhancement via localized reactive power injection. • Accurate anomaly classification using voltage/frequency/power composite index. • Smooth transition control between grid-connected and islanded modes. • Lightweight, practical microgrid protection without communication dependency. In a typical microgrid, multiple control strategies run simultaneously. Therefore, it is essential to protect the system against faults, islanding, large-scale grid outages, natural disasters, and cyberattacks. In this paper, a general multi-purpose framework is presented to increase the resilience of AC microgrids against cyberattacks and physical faults. The proposed method is designed based on the second derivative analysis of vital signals such as frequency, voltage, and power, which provides the ability to distinguish between real faults and cyber attacks, and stabilizes the voltage and frequency within the permissible range using an adaptive soft switch controller in islanded mode through a battery and capacitor. Additionally, the Fault Ride-Through (FRT) capability is enhanced through the immediate injection of reactive power to mitigate the impact of a severe fault. Here, the microgrid consists of two separated and parallel subsets that are connected to the main grid through a transmission line, and each subset is supported by its battery. Simulation results in MATLAB/Simulink confirm that the proposed method effectively identifies attacks and real faults, and this controller offers a robust and practical solution for real-time cyber-physical threat mitigation and reliable microgrid operation.