Cyber-Resilient Digital Twin Architectures for Smart Grids: A Review of Attack Modeling, Detection, Mitigation, and Secure Control Strategies

The digitalization of smart grids has expanded the cyberattack surface of critical energy infrastructure, creating a need for security mechanisms that integrate communication behavior, physical-system dynamics, and resilient control. Digital twins provide a promising foundation for this integration, but existing research remains fragmented across system architectures, threat models, defense methods, and validation environments. The aim of this review is to identify, classify, and critically compare how cyber-resilient DT architectures support the smart-grid cybersecurity lifecycle across DT architecture, cyber–physical attack modeling, detection and mitigation, secure control and recovery, and experimental validation. A structured multi-database search of Scopus, IEEE Xplore, and the ACM Digital Library identified 1627 records. After duplicate removal, publication-type exclusions, and eligibility assessment, 149 publications were retained for thematic synthesis and quality appraisal. The evidence indicates that a qualifying cyber-resilient digital twin is distinguished not merely by the presence of a virtual model, but by bidirectional physical–virtual synchronization combined with explicit cyber-resilience functions. Cyberattack studies span measurement, communication, control, device and infrastructure, and coordinated attack surfaces, although study-specific assumptions regarding attacker access and compromised interfaces frequently limit direct comparison. Physics-based detectors offer strong interpretability and real-time suitability but remain sensitive to model and topology errors, whereas data-driven methods capture complex attack patterns but depend on representative data and may generalize poorly. Federated learning preserves data locality but introduces privacy, poisoning, and communication concerns, while moving target defense and deception provide complementary proactive capabilities. No detection or mitigation strategy is uniformly superior across attack coverage, interpretability, false-alarm behavior, latency, scalability, and computational burden. DT-enabled secure control and self-healing further require safety-constrained mitigation under detection uncertainty, communication delay, model mismatch, and partially compromised information. Validation is dominated by simulation, with comparatively little hardware-in-the-loop (HIL) or utility-scale field evidence. Key research gaps include inconsistent digital twin terminology, limited benchmark datasets, synchronization and model-fidelity challenges, inadequate interoperability, and insufficient validation of autonomous mitigation. This review contributes an integrated taxonomy and decision-oriented framework for evaluating and selecting cyber-resilient digital twin strategies for smart grids.