Digital Twin-Based Cyberattack Detection in Active Distribution Networks: A Review

The increasing integration of distributed generation (DG), renewable energy sources, electric vehicle charging infrastructure, and intelligent control devices has transformed conventional distribution networks into complex cyber-physical systems. Although these advancements improve operational flexibility and efficiency, they also increase vulnerability to cyberattacks, including false data injection (FDI), denial-of-service (DoS), replay, and coordinated attacks. Such attacks can compromise measurement integrity, disrupt state estimation, and adversely affect voltage regulation and overall system reliability. Digital twin (DT) technology has emerged as a promising approach for enhancing cybersecurity by establishing a continuously updated virtual representation of the physical distribution network. This paper presents a comprehensive review of digital twin-based cyberattack detection and resilient voltage regulation strategies in active distribution networks. Various digital twin architectures, including model-based, data-driven, hybrid, and node-level approaches, are examined alongside residual-based detection, cumulative sum (CUSUM) analysis, machine learning, and active watermarking techniques. Furthermore, the integration of cyberattack detection with secure measurement reconstruction and adaptive voltage control mechanisms is discussed to highlight potential approaches to maintaining reliable network operation under compromised conditions. A comparative analysis identifies the strengths, limitations, and practical challenges of existing methods, particularly regarding model uncertainty, measurement observability, communication delays, detection accuracy, and computational complexity. Finally, key research gaps and future directions are identified, emphasising topology-aware detection, uncertainty-conscious digital twin adaptation, and experimentally validated cyber-resilient voltage-control frameworks.