Event-triggered distributed privacy-preserving security control of source-network-load-storage microgrid

1 Introduction

With the integration of renewable energy, energy storage systems, and flexible loads, source-grid-load-storage (SNLS) coordinated systems are playing an increasingly important role in modern power systems. Through the coordinated operation of generation units, power grids, loads, and energy storage devices, such systems can effectively improve energy utilization efficiency and enhance operational flexibility (Wang and Yang, 2026; He et al., 2026; Tan et al., 2026). To ensure stable and efficient operation, a hierarchical control is commonly adopted, mainly consisting of three levels: primary, secondary, and tertiary control. Primary control is typically based on the droop control principle and is used to maintain voltage and frequency stability. Secondary control compensates for voltage and frequency deviations caused by droop control and maintains system stability. Tertiary control focuses on system-level optimization by coordinating generation, energy storage, and load management to improve economic efficiency and overall performance (Olivares et al., 2014; Shafiee et al., 2014; Wang et al., 2026; Jiang et al., 2022).

This paper mainly focuses on the secondary control. Early studies primarily concentrated on centralized control strategies. However, such strategies suffer from obvious limitations in terms of flexibility, scalability, and communication bandwidth requirements (Qi et al., 2026). To address these issues, distributed control schemes have emerged, which can operate based only on sparse communication networks (Lou et al., 2020; Li et al., 2024). Nevertheless, distributed information exchange relies heavily on communication networks, making the control architecture vulnerable to privacy leakage and malicious cyber-attacks. Against this background, it is particularly important to develop distributed privacy-preserving resilient control strategies for microgrid systems (Liu et al., 2024).

Various privacy-preserving methods have been proposed, such as differential privacy, mask-function-based privacy preservation, and state-decomposition-based privacy preservation (Mo and Murray, 2017; Hadjicostis, 2018; Ruan et al., 2019). Differential privacy conceals the true values by adding noise to the transmitted data. Although it can effectively reduce privacy leakage, it may introduce significant harmonic distortion and thus negatively affect the power quality of microgrids (Mo and Murray, 2017). In contrast, mask-function-based privacy preservation employs encryption techniques to avoid such distortion. However, the encryption and decryption processes may cause transmission delays, making it difficult to satisfy real-time control requirements (Hadjicostis, 2018). In addition, to enhance privacy protection, researchers have developed consensus algorithms based on state-decomposition strategies. These algorithms decompose the original communication signals into multiple substates and transmit only one of them, thereby preventing external eavesdroppers from obtaining complete private information (Ruan et al., 2019; Yang et al., 2026).

Although the aforementioned methods can effectively protect the privacy of microgrid systems, the strong dependence of distributed secondary control structures on communication networks makes them highly vulnerable to cyber-attacks. The intercepted data may be exploited by external attackers to launch targeted cyberattacks, posing a serious threat to the stable operation of power grids (Fan et al., 2024; Wang et al., 2021; Fan et al., 2025). The most representative types of cyberattacks include false data injection (FDI) attacks and denial-of-service (DoS) attacks (Gao et al., 2025; Kim and Heo, 2012). Specifically, FDI attacks are launched by secretly tampering with shared information in communication networks, such as power injections and line flows. In contrast, DoS attacks block communication links among distributed generators (DGs), thereby disrupting network connectivity. Compared with conventional model-based resilient control strategies, data-driven resilient control strategies have attracted increasing attention in recent years due to their strong adaptability and ease of implementation. Reference (Yuan et al., 2024) has proposed a deep neural network (DNN)-based resilient secondary controller, which identifies the correlations between local signals and neighboring communication signals and uses the estimated neighboring signals as reference values for attack detection and compensation. Reference (Yu et al., 2023) has employed a reinforcement learning algorithm to train a neural network-based detector. Although the above data-driven resilient control methods have shown remarkable effectiveness in defending against cyber-attacks, their model training usually requires complete system information. Therefore, if attackers eavesdrop on the training data during this process, existing data-driven resilient control strategies may fail to guarantee the privacy and security of the system.

In summary, to address the challenges of privacy leakage and cyber-attacks in SNLS microgrid systems, this paper proposes a DNN-based privacy-preserving event-triggered distributed resilient secondary control strategy. The main contributions are summarized as follows.

• This paper is the first to simultaneously achieve data-driven resilient secondary control and privacy preservation in microgrid systems. Compared with the data-driven control method proposed in (Yuan et al., 2024), the DNN estimator designed in this paper can effectively prevent privacy leakage during the offline training stage, thereby integrating data-driven control with privacy protection.
• A state-decomposition-based privacy-preserving mechanism is proposed and further integrated with weighted proportional coefficients and an event-triggered control strategy. This method effectively reduces the communication burden while ensuring privacy and security, and avoids the harmonic distortion problem caused by differential privacy methods.
• Based on Lyapunov theory, the stability of the designed privacy-preserving distributed resilient controller is proved. Moreover, the effectiveness and feasibility of the proposed method in terms of privacy preservation and resilient control are verified.

2 System modeling and problem formulation

This section first presents the fundamentals of graph theory, then establishes an SNLS microgrid system model with a distributed control. Finally, by incorporating state decomposition and an event-triggered mechanism, the control objectives of this paper are clarified.

2.1 Graph-theoretic preliminaries

The communication topology of the SNLS microgrid is represented by an undirected connected graph G = ( V , Λ ), where V = { 1 , … , N } denotes the set of DG nodes, Λ = { ( i , j ) ∈ V × V ∣ j ∈ N i } denotes the set of communication links, and N i represents the neighbor set of the i-th DG. The Laplacian matrix L = [ l i j ] ∈ R N × N satisfies l i i = ∑ j = 1 N a i j and l i j = − a i j for i ≠ j.

2.2 SNLS microgrid modeling

Before introducing the primary control model of DGs, this subsection models the physical connections of the SNLS system, including transmission lines, loads, and energy storage units.

2.2.1 Line model

DGs and loads in the SNLS microgrid are connected through transmission lines, jointly forming the distribution network. Microgrid lines usually exhibit resistive-inductive characteristics. A simplified series impedance model is adopted to describe the transmission line between DG nodes i and j, whose impedance is given by Z i j = R i j + j X i j.

2.2.2 Load model

To describe the dynamic characteristics of loads in the SNLS microgrid more accurately, a generalized nonlinear load model is adopted in this paper. This model consists of constant impedance (Z), constant current (I), and constant power (P) components connected in parallel at the point of common coupling (PCC). Based on this model, the load current I L i at the i-th bus can be expressed as a function of the node voltage V i, i.e., I L i = 1 R c i V i + I c i + P c i V i, where R c i, I c i, and P c i denote the constant impedance, constant current, and constant power parameters, respectively. The active and reactive load powers are denoted by P L and Q L, respectively.

2.2.3 Energy storage system

The energy storage system (ESS) is a key component for achieving SNLS coordination, and is mainly used to provide inertia support, smooth power fluctuations, and maintain system stability in islanded mode. In the SNLS microgrid studied in this paper, the energy storage units are connected to the system through inverters and are regarded as special DG units participating in both primary and secondary control. Their dynamic behaviors are determined by the inverter model and the corresponding control strategy.

The preceding line, load, and ESS models determine the electrical variables P i, Q i, V i, and ω i that characterize the local operating state of each DG. Based on these variables, the next subsection introduces the hierarchical primary and secondary control laws used to achieve local regulation and distributed coordination.

2.3 Hierarchical control in SNLS microgrids

Hierarchical control is commonly used in SNLS microgrids to ensure stable operation. In this framework, primary control provides fast local regulation and initial power sharing, while secondary control restores frequency and voltage deviations and improves power sharing accuracy through coordination among DGs.

2.3.1 Primary control

The SNLS microgrid system adopts droop control as the primary control strategy. The frequency and voltage droop characteristics can be respectively expressed aswhere ω i and V i denote the frequency and output voltage magnitude, respectively. ω n and V n are the reference values of frequency and voltage magnitude. P i and Q i are the active power and the reactive power. m P i and m Q i are the droop gains in the droop control.

ω i = ω n − m P i P i , V i = V n − m Q i Q i ,

2.3.2 Distributed secondary control

Since droop control relies on proportional regulation, frequency and voltage offsets may persist at steady state. To compensate for these deviations and realize precise power allocation, secondary control should be implemented through coordinated interactions among DGs. The secondary control strategies are given bywhere Ω i and ψ i are the secondary control inputs. Based on the state decomposition strategy and the event-triggered mechanism, ξ p i = m P i P i and ξ q i = m Q i Q i.

ω i = ω n − ξ p i + Ω i , V i = V n − ξ q i + ψ i ,

1. Event-Triggered Mechanism: To reduce the communication burden, the following distributed event-triggered mechanism is adopted. The event-triggering sequence t k i, determined by the dynamic condition, is defined as follows,where α, β, and γ i are design parameters, and χ i is an internal auxiliary dynamic variable. ξ q i , 1 denotes the first substate of the reactive-power droop term ξ q i = m Q i Q i after state decomposition. Its dynamics are given bywhere σ is the auxiliary-variable gain. This mechanism adaptively adjusts the triggering frequency through the dynamic threshold γ i ( χ i + β e − α t ), thereby reducing the number of communications when the system approaches the steady state.

t k + 1 i = inf t > t k i ∣ ‖ ξ q i , 1 t − ξ q i , 1 t k i ‖ 2 ≥ γ i χ i + β e − α t ,

χ ̇ i = σ χ i − γ i ‖ ξ q i , 1 t − ξ q i , 1 t i k ‖ 2 + β e − α t ,

2. Privacy-Preserving Mechanism: To protect system privacy, a state decomposition strategy is adopted to decompose the communication state of each DG into n i substates, and only the first substate ξ q i , 1 ( t ) is transmitted to neighboring nodes. The weighted proportional coefficient is defined as z i = B / ( N n i ), where B = ∑ i = 1 N n i. Since external attackers cannot obtain all substate information, they cannot reconstruct the true state, thereby achieving privacy preservation.

3. Frequency Secondary Control Design: The proposed controller reduces communication through event triggering and protects the privacy of active power information through state decomposition. The dynamic design of the secondary control input Ω i is given bywhere k p 1 and k p 2 are adjustable control gains used to regulate the dynamic performance of the system; Δ ξ p i = ξ p i − z i ∑ d = 1 n i ( n i − 1 ξ p i + Ω i , d ) characterizes the local consistency deviation of the active-power substates; t k i and t k j are dynamically generated by the event-triggered condition and represent discrete communication instants, ensuring that information exchange is performed only when necessary; and ξ p i , 1 is the active-power substate that actually participates in communication after state decomposition. External attackers cannot infer the true ξ p i from ξ p i , 1, thereby realizing privacy preservation.

Ω i = − k p 1 Δ ξ p i t k i − k p 1 z i ξ p i , 1 t k i ∑ j = 1 N a i j + k p 1 z i ∑ j = 1 N a i j ξ p j , 1 t k j + k p 2 ξ p i t k i ,

4. Voltage Secondary Control Design: The proposed controller reduces communication through event triggering and protects the privacy of reactive power information through state decomposition. The dynamic design of the secondary control input ψ i is given bywhere k q 1 and k q 2 are the gains of the voltage control loop, and Δ ξ q i = ξ q i − z i ∑ d = 1 n i ( n i − 1 ξ q i + Ω i , d ) denotes the local consistency deviation of reactive power. This design adopts an event-triggered mechanism and a state-decomposition-based privacy-preserving strategy similar to those used in the frequency controller.

ψ ̇ i = − k q 1 Δ ξ q i t k i − k q 1 z i ξ q i , 1 t k i ∑ j = 1 N a i j + k q 1 z i ∑ j = 1 N a i j ξ q j , 1 t k j + k q 2 ξ q i t k i ,

2.4 Problem formulation

Based on the above model and mechanisms, this paper aims to design a distributed secondary controller based on state decomposition and a dynamic event-triggered mechanism to address frequency and voltage regulation, as well as active and reactive power sharing, in SNLS microgrids. Specifically, without continuous communication and while preserving the privacy of each DG, the following control objectives are expressed as follows,where D p and D q are positive constants representing the upper bounds of the active and reactive power sharing errors, respectively. This indicates that, after the system reaches the steady state, the differences between the active and reactive power droop terms ( ξ p i , ξ q i ) of any two DGs are constrained within acceptable ranges, thereby achieving approximate proportional power sharing. Meanwhile, the output frequency and voltage of all DGs are restored to their nominal values ω n and V n, respectively.

lim t → ∞ ‖ ω i − ω n ‖ = 0 , lim sup t → ∞ ‖ ξ p i − ξ p j ‖ ≤ D p , lim t → ∞ ‖ V i − V n ‖ = 0 , lim sup t → ∞ ‖ ξ q i − ξ q j ‖ ≤ D q , (1)

The objectives in Equation 1, together with the state-decomposition and event-triggered communication constraints, define the principal requirements for the distributed controller. Accordingly, Section 3 develops a privacy-preserving resilient controller that uses the available decomposed information and reconstructs corrupted neighboring signals under hybrid cyber-attacks. To further highlight the distinctive features of the proposed control framework, Table 1 is introduced to provide a comparison with existing distributed security control methods.

TABLE 1. Comparison with existing distributed security control methods.

3 DNN-based distributed privacy-preserving event-triggered control for SNLS microgrids

This section first designs a privacy-preserving event-triggered secondary controller. Then, to address cyber-attacks, a resilient control method based on a DNN estimator is proposed. A hybrid cyber-attack scenario, including FDI and DoS attacks, is considered. Both the active-power and reactive-power communication channels are assumed to be vulnerable to these attacks. For notational simplicity, the active-power communication channel is taken as a representative example to formulate the cyber-attack model. Let the neighboring aggregate signal received by the i-th DG be H i ( t ) = ∑ j = 1 N a i j ξ p j , 1 ( t ). Then, the attacked signal actually received by the i-th DG, denoted by H i A ( t ), can be modeled aswhere a i ( t ) is the FDI attack signal satisfying ‖ a i ( t ) ‖ ≤ a ̄ and ‖ a ̇ i ( t ) ‖ ≤ b ̄, with a ̄ , b ̄ > 0 being known constants. The variable σ i ( t ) ∈ { 0,1 } is the DoS attack indicator function, where σ i ( t ) = 1 indicates normal communication and σ i ( t ) = 0 indicates that the communication link is blocked. To ensure that the input of the DNN estimator is continuously available, it is assumed that during DoS attacks, i.e., when σ i ( t ) = 0, the receiver holds the last valid value. Therefore, H i A ( t ) remains a well-defined signal. It should be noted that (8) is formulated for the active-power communication channel as a representative example. The reactive-power communication channel is subject to the same FDI and DoS attack mechanism by replacing the active-power communication signal ξ p j , 1 with the reactive-power communication signal ξ q j , 1. Therefore, both communication channels are considered vulnerable to the hybrid cyber-attacks.

H i A t = σ i t H i t + a i t ,

3.1 Privacy-preserving event-triggered controller design

System privacy is protected through state decomposition, whose basic idea is to decompose the system state information that needs to be communicated with neighboring DGs into multiple substates. By transmitting only the selected substates, external eavesdroppers are prevented from obtaining complete communication data. Define that the i-th DG has n i substates, and the total number of substates in the microgrid system is B = ∑ i = 1 N n i. Then, the weighted proportional coefficient of the i-th DG is defined as z i = B / ( N n i ). Based on the state decomposition strategy and the event-triggered mechanism, the control input can be designed aswhere k 1 and k 2 are positive constants, and t k i is the k-th dynamically triggered instant of the i-th DG. The dynamic event-triggered time sequence t k i is defined aswhere α, β, and γ are user-defined positive real numbers, and χ i is an internal auxiliary dynamic variable defined aswhere σ is a user-designed variable gain.

ψ ̇ i = − k 1 Δ ξ q i t k i − k 1 z i ∑ j = 1 N a i j ξ q i , 1 t k i − ξ q j , 1 t k j − k 2 ψ i ξ q i t k i ,

t k + 1 i = inf t > t k i ∣ ξ q i , 1 t − ξ q i , 1 t k i 2 ≥ γ χ i + β e − α t ,

χ ̇ i = σ χ i − γ V i , 1 t − V i , 1 t k i 2 + β e − α t ,

Define V i , n as the substate of the i-th DG, satisfying V i , n = n i − 1 V i + ψ i , n. Then, ψ i , 1 is designed as follows:and for the other substates, it is given by

ψ ̇ i , 1 = − k 1 ∑ k = 1 n i ξ q i , 1 t k i − ξ q i , k t k i − ξ q j , 1 t k j − k 1 1 − z i n i − 1 ∑ j = 1 N a i j ξ q i , 1 t k i − ξ q j , 1 t k j + k 1 n i − 1 Δ ξ q i t k i ,

ψ ̇ i , n = − k 1 n i − 1 Δ ξ q i t k i + k 1 ξ q i , n t k i − ξ q i , 1 t k i + k 1 z i n i − 1 ∑ j = 1 N a i j ξ q i , 1 t k i − ξ q j , 1 t k j .

Remark 1. By introducing the state decomposition mechanism and the weighted proportional coefficient z i, an external attacker must obtain the number of substates of each DG to recover the true value of the transmitted signal, thereby ensuring privacy and security.

3.2 DNN-based estimator design

DNNs can learn complex feature relationships from time-series data through multilayer nonlinear mapping structures. Unlike traditional shallow models, DNNs achieve high-dimensional mapping and abstract representation of input features through multilayer neuron connections, thereby providing stronger feature extraction and function approximation capabilities. The core idea is to continuously update and optimize network parameters to establish a nonlinear mapping relationship between input signals and output estimations. The overall structure is shown in Figure 1.

In the DNN-based estimator, neurons in different layers are connected through weight matrices and bias terms, and the inter-layer mapping relationship is formed through nonlinear activation functions. The forward propagation process of the k-th layer can be expressed aswhere ϕ k is the activation function of the k-th layer, α k and β k are the weight and bias parameters of this layer, respectively, x is the input signal, and y k is the output of the k-th layer. Through multilayer recursive mapping, the DNN can effectively capture the nonlinear features of input data and achieve accurate prediction of complex dynamic system states.

y k = ϕ k α k x + β k , k = 1 , ϕ k α k y k − 1 + β k , k ≥ 2 ,

During the training process, the DNN calculates the output through forward propagation and minimizes the prediction error using the backpropagation algorithm, thereby continuously adjusting the network parameters. Assume that the training dataset is D s = { ( ξ s i , H s i ) } i = 1 N s, where ξ s denotes the input feature, H s denotes the target output, and N s is the total number of samples. In each training iteration of the DNN learning process, a mini-batch of size m is selected from the mapping dataset, denoted as B s = { ξ s 1 , … , ξ s m }. Meanwhile, the feature extraction process can be defined as q s = F ( ξ s ), and the output of the DNN is R ( F ( ξ s ) ). Therefore, the loss function can be defined asThen, the designed DNN estimator can be trained by solving the following optimization problem:where τ is a hyperparameter. By using Δ H i = H ̄ i − H i A as the input, the PI controller can generate the compensation signal κ i. After compensation, the attacked signal H i A can be restored to the reference signal H ̄ i. If the DNN-based estimator performs well, the resilient controller can effectively counteract the influence of cyber-attacks and ensure stable system operation. Therefore, the designed DNN-based privacy-preserving distributed resilient secondary controller can be expressed as

L s = E R F ξ s i − H s i 2 .

min α , β τ L s F , R ,

ψ ̇ i = − k 1 Δ ξ q i t k i − k 2 z i − D i ξ s p i , 1 t k i + H ̄ i t k i − k 2 ψ i − ξ q i t k i . (2)

By incorporating the DNN-estimated neighboring aggregate signal into the controller in Equation 2, the system model, communication mechanism, and resilient controller are combined into a unified closed-loop framework. On this basis, the next subsection analyzes the corresponding closed-loop error dynamics and derives sufficient conditions for system stability and the exclusion of Zeno behavior.

3.3 Stability analysis

Theorem 1. Assume that the communication graph G is undirected and connected, the FDI attack signal a i ( t ) and its derivative a ̇ i ( t ) are bounded, and the active time ratio of DoS attacks is less than one, i.e., communication will not be interrupted permanently. Given a positive definite matrix P v, if k 1 > λ max ( L ) / ( 2 λ min ( P v ) ) and k 2 > σ / 2, where λ max ( L ) denotes the largest positive eigenvalue of the Laplacian matrix L and λ min ( P v ) denotes the smallest positive eigenvalue of P v, and if the estimation error e i of the DNN-based estimator satisfiesthen the resilient secondary controller in (17) can ensure that, under hybrid cyber-attacks, the AC main bus voltage is restored to its reference value and proportional reactive power sharing is achieved. Meanwhile, the proposed triggering mechanism can effectively avoid Zeno behavior.

lim sup t → ∞ k 2 z i e i ≤ ε i ,

The above assumptions have the following physical interpretations. The connected communication graph guarantees the information exchange required for distributed coordination among DGs. The boundedness of a i ( t ) and a ̇ i ( t ) limits the magnitude and variation rate of the injected malicious signal. The condition on the DoS active time ratio ensures that the communication links are not permanently unavailable. Moreover, the bounded DNN estimation error is treated as a bounded perturbation in the subsequent stability analysis.

Proof. Since the event-triggering condition is satisfied, the DG updates its transmitted substate information ξ g i , 1 ( t k i ), and the triggering error is reset as e ̄ i ( t k i ) = ξ g i , 1 ( t k i ) − ξ g i , 1 ( t k i ) = 0. The control input and the neighboring information are updated to their latest values, ensuring that the control signal is generated based on accurate local information. The dynamic equation of the auxiliary variable is given as follows,

χ ̇ i = σ χ i − γ i ‖ V i , 1 t − V i , 1 t k i ‖ 2 + β e − α t .

During the non-triggered interval t ∈ [ t k i , t k + 1 i ], the DG keeps ξ q i , 1 ( t k i ) unchanged, and the triggering error e ̄ i ( t ) = ξ q i , 1 ( t ) − ξ q i , 1 ( t k i ) accumulates over time. The control input ψ i based on outdated information drives the tracking error ζ i to evolve according towhere ψ ̃ i , n = V i , n − V i , n *, and V i , n * denotes the ideal value of the n-th substate of the i-th DG.

ζ ̇ i = − k 1 ∑ j = 1 N a i j ξ q i , 1 t k i − ξ q j , 1 t k j − k 2 ψ ̃ i , n + E i ,

Consider the following Lyapunov function:where P v and Q v are symmetric positive definite matrices. Taking the time derivative of M gives

M = 1 2 ∑ i = 1 N ζ i T P v ζ i + 1 2 ∑ i = 1 N ∑ n = 1 n i ψ ̃ i , n T Q v ψ ̃ i , n + ∑ i = 1 N χ i ,

M ̇ = ∑ i = 1 N ζ i T P v ζ ̇ i + ∑ i = 1 N ∑ n = 1 n i ψ ̃ i , n T Q v ψ ̃ ̇ i , n + ∑ i = 1 N χ ̇ i .

Substituting the error dynamics in (19)–(20) into the above expression and using the symmetry and positive definiteness of P v and Q v yields (22). Therefore, at the triggering instant, the time derivative of M is calculated as

M ̇ = − ∑ i = 1 N k 1 ζ i T P v L ζ i + k 2 ψ ̇ i T Q v ψ ̇ i + ∑ i = 1 N σ χ i .

Since P v and Q v are positive definite, their quadratic terms are bounded by their minimum eigenvalues. Together with the spectral properties of the Laplacian matrix L, the conditions k 1 > λ max ( L ) / [ 2 λ min ( P v ) ] and k 2 > σ / 2 ensure that the negative terms dominate the remaining terms in M ̇. Therefore,

M ̇ t k i ≤ − α 1 M t k i ,

where α 1 = min { 2 k 1 λ min ( P v ) , 2 k 2 λ min ( Q v ) , σ } > 0. During the non-triggered interval t ∈ [ t k i , t k + 1 i ), the triggering condition is not satisfied. Hence, the triggering error satisfies

‖ e ̄ i t ‖ 2 < γ i χ i + β e − α t .

Using this inequality to bound the error terms induced by the sampled neighboring information, together with the bounded DNN estimation error in (18), the derivative of M can be upper bounded aswhere α 2 = min { 2 k 1 λ min ( P v ) , 2 k 2 λ min ( Q v ) , σ / 2 }. By jointly analyzing the triggering instants and the non-triggered intervals, the Lyapunov function globally satisfies M ( t ) ≤ M ( 0 ) e − α 2 t + N γ β / ( α 2 − α 1 ) e − α 1 t, which indicates that under hybrid attacks, the designed controller ψ ̇ i can effectively achieve voltage restoration and reactive power sharing. During the non-triggered interval t ∈ [ t k i , t k + 1 i ], the control input is kept as δ v i, and the voltage dynamics can be expressed aswhere κ = r v i ω i ∑ j = 1 N a i j V i , 1 ( t k i ) − V j , 1 ( t k j ).

M ̇ ≤ − α 2 M t + N γ β e − α t ,

V ̇ i = − r v i Δ V i t k i − κ ,

Since the system stability is guaranteed, the voltage substate is bounded. Thus, there exists a positive constant V such that ‖ V i , 1 ‖ ≤ V. Define the triggering error as e ̄ i = V i , 1 − V i , 1 ( t k i ). By integration, one obtains

‖ e ̄ i t ‖ ≤ V t − t k i , ∀ t ∈ t k i , t k + 1 i .

The solution of the dynamic auxiliary variable χ i satisfies χ i ≤ χ i ( t k i ) e − σ 1 ( t − t k i ) + γ i β 1 / ( σ 1 − α 1 ) ( e − α 1 t − e − σ 1 t ). Furthermore, it can be obtained that γ i ( χ i + β 1 e − α 1 t ) ≤ γ i ( C + β 1 ) e − min { σ 1 , α 1 } t, where C is a positive constant. Since the exponential term e − min { σ 1 , α 1 } t decays with time, there exists a time-independent constant τ such that

t k + 1 i − t k i ≥ τ = γ i C + β 1 V 2 .

Therefore, under the proposed privacy-preserving event-triggered secondary controller, Zeno behavior can be excluded for each DG.

Remark 2. The secondary frequency control problem can be handled in a similar manner. Specifically, the frequency controller can be designed as follows: where Φ i = ∑ j = 1 N a i j ξ p i , 1 ( t k i ) − ξ p j , 1 ( t k j ), Δ ξ p i = ξ p i − z i ∑ d = 1 n i n i − 1 ξ p i + Ω i , d, and ξ p i , n is the substate of the i-th DG satisfying ξ p i , n = n i − 1 ξ p i + Ω i , n. Moreover, Ω i , n denotes the control input of the n-th substate, and E ̂ i is the reference aggregate communication signal for the secondary frequency controller.

Ω ̇ i = − k 3 Δ ξ p i t k i − k 4 Ω i − ξ p i t k i − k 3 z i − D i ξ p i , 1 t k i + E ̂ i t k i ,

Ω ̇ i , 1 = − k 3 ∑ k = j n i ξ p i , 1 t k i − ξ p i , k t k i + k 3 n i − 1 Δ ξ p i t k i − k 3 1 − z i n i − 1 Φ i ,

Ω ̇ i , n = − k 3 n i − 1 Δ ξ p i t k i + r ω i ξ p i , n t k i − ξ p i , 1 t k i + k 3 z i n i − 1 Φ i ,

Remark 3. Parameter selection: For a given communication Laplacian L and positive definite matrix P v, the controller gains should satisfy k 1 > λ max ( L ) / [ 2 λ min ( P v ) ] and k 2 > σ / 2, with suitable positive margins. Larger values of γ or β increase the triggering threshold and reduce communication updates at the cost of larger sampling errors, whereas a larger α accelerates the threshold decay and may increase the triggering frequency. The parameter σ governs the auxiliary-variable dynamics and should be selected jointly with k 2. Therefore, k 1 and k 2 are first determined from the stability conditions, after which γ, α, β, and σ are tuned to balance control performance and communication efficiency.

4 Simulation results

4.1 Simulation system structure

To verify the effectiveness of the proposed method, an SNLS microgrid system model is established on the Matlab Simulink simulation platform, as shown in Figure 2. The control layer integrates droop control, event-triggered control, and distributed secondary control with privacy preservation. Based on this platform, the dynamic response of the system under cyber-attacks and the recovery performance of the proposed algorithm can be simulated and evaluated.

Meanwhile, to verify the effectiveness of the proposed strategy, a test system consisting of six nodes is established in this paper. The topology of the five-node SNLS microgrid test system is shown in Figure 3.

4.2 Simulation parameters and system settings

The system parameters are selected according to a typical low-voltage microgrid configuration, as listed in Table 2. Meanwhile, the DNN is structured as shown in Table 3.

TABLE 2. Simulation system parameters.

TABLE 3. Detailed parameters of the DNN-based estimator.

Based on the above parameters, the system operates over the interval, and a load step change is introduced at 50 s to test the dynamic response capability. Meanwhile, a FDI attack is injected and superimposed with a DoS attack to verify the resilient compensation performance of the proposed DNN estimator.

1. Frequency Resilient Control: As shown in Figure 4, at the beginning of the simulation, the system frequency responds rapidly and converges to the nominal value of 50 H z, with an overshoot of less than 0.5 %. When load switching occurs at 50 s, the frequency quickly recovers, demonstrating good dynamic performance. Throughout the regulation process, the frequencies of the six DGs remain highly consistent, reflecting the coordination capability of the distributed control strategy.

2. Power Sharing: Figure 5 shows the dynamic active power responses of different nodes, where the initial active powers of the nodes are different. Under the action of the proposed controller, the active powers of the six nodes rapidly converge. When load switching occurs at 50 s, the active powers quickly recover and achieve accurate active power sharing with a ratio of 1 : 1 : 2 : 2 : 4 : 4.

4.3 Performance analysis of the event-triggered mechanism

The performance of the event-triggered mechanism is analyzed through the distribution of triggering instants. As shown in Figure 6, the triggering instants of the first substate of DG-1 are presented, which demonstrates the proposed event-triggered strategy. The step-like profile indicates that DG-1 broadcasts its information only at specific triggering instants t k i when the local error exceeds the prescribed dynamic threshold. During the interval between two consecutive triggering instants, i.e., t ∈ [ t k i , t k + 1 i ), the controller and neighboring DGs continue to use the previously broadcast value. This figure intuitively verifies that the event-triggered mechanism can significantly reduce the number of communication updates without sacrificing control performance, thereby effectively decreasing the communication burden of the system.

This chapter comprehensively verifies the effectiveness and feasibility of the proposed privacy-preserving event-triggered distributed resilient secondary control strategy through simulation studies on a six-node SNLS microgrid system. As shown in Figures 4, 5, the simulation results clearly demonstrate that the designed distributed secondary controller can ensure that the system frequency and voltage rapidly converge to their nominal values, ω n and V n, while achieving accurate proportional active power sharing among nodes. When disturbances such as load switching at 50 s occur, the system states can quickly recover and maintain high consistency, showing good dynamic robustness. Furthermore, as shown in Figure 6, the performance analysis of the event-triggered mechanism intuitively demonstrates that the proposed strategy can significantly reduce the number of information exchanges among nodes when the system approaches the steady state, thereby effectively reducing the communication burden. These results jointly confirm the superiority of the proposed control strategy in improving system resilience, communication efficiency, and privacy-preserving capability.

4.4 Parameter sensitivity analysis

As shown in Table 4, the investigated parameters affect different aspects of the system. The droop coefficient scale exhibits the strongest overall sensitivity. When the scale is reduced to 0.5, the power-sharing RMSE increases from the nominal value of 0.007812–0.360299, whereas increasing the scale to 1.5 results in a frequency RMSE of 0.18158 Hz. For the controller gains, increasing k 4 from 0.05 to 0.15 reduces the frequency RMSE from 0.05747 Hz to 0.03088 Hz, corresponding to a reduction of approximately 46.3%, while increasing k 3 from 0.005 to 0.015 reduces the frequency RMSE from 0.03790 Hz to 0.03316 Hz. These results indicate that k 3 and k 4 mainly influence the frequency-restoration.

TABLE 4. Parameter sensitivity analysis of the proposed control strategy.

The event-triggering parameter h 4 mainly affects the communication burden. As h 4 increases from 0.4 to 1.2, the total number of triggering events increases from 15,474 to 77,630, approximately 5.02 times the original value, while the frequency and power-sharing errors vary only slightly. In contrast, T f exhibits a clear performance tradeoff. Increasing T f from 0.05 s to 0.15 s reduces the peak frequency deviation from 0.21910 Hz to 0.15252 Hz, but increases the power-sharing RMSE from 0.006204 to 0.009126. Therefore, the sensitivity analysis quantitatively demonstrates the different effects of the key parameters and provides guidance for balancing frequency regulation, power-sharing accuracy, and communication efficiency.

5 Conclusion

This paper addresses the privacy leakage and control security challenges faced by SNLS microgrids under hybrid cyber-attacks, and proposes a distributed resilient secondary control scheme. The proposed scheme effectively prevents sensitive information from being stolen during transmission through state decomposition, and significantly reduces the communication burden by using the event-triggered mechanism. Meanwhile, the designed DNN estimator can reconstruct the attacked neighboring signals online, thereby achieving effective resilient compensation against FDI and DoS attacks. Theoretical analysis based on the Lyapunov method rigorously proves the stability of the closed-loop system under attacks and excludes Zeno behavior. Verification results on the MATLAB/Simulink simulation platform demonstrate that the proposed controller can ensure rapid frequency and voltage restoration to their nominal values, achieve accurate proportional power sharing, and maintain stable operation under cyber-attacks while preserving data privacy. Therefore, the proposed method provides an effective solution for secure and reliable distributed control of microgrids. However, the performance of the DNN estimator depends on the quality and representativeness of the offline training data, and may degrade under unseen operating conditions or cyber-attacks. Moreover, the scalability of the proposed method in larger microgrids with more DGs and communication links remains to be further investigated. Future work will focus on improving the adaptability of the data-driven estimator and extending the proposed framework to unseen cyber-attacks, time-varying communication topologies, and plug-and-play scenarios.

Generative AI statement

The author(s) declared that generative AI was not used in the creation of this manuscript.

Any alternative text (alt text) provided alongside figures in this article has been generated by Frontiers with the support of artificial intelligence and reasonable efforts have been made to ensure accuracy, including review by the authors wherever possible. If you identify any issues, please contact us.

Publisher’s note

All claims expressed in this article are solely those of the authors and do not necessarily represent those of their affiliated organizations, or those of the publisher, the editors and the reviewers. Any product that may be evaluated in this article, or claim that may be made by its manufacturer, is not guaranteed or endorsed by the publisher.

Footnotes

Edited by: Xinxin Lv, Zhejiang Sci-tech University, China

Reviewed by: Yang Xia, Nanyang Technological University, Singapore

Sayyed Talha Gohar, Islamia University of Bahawalpur, Pakistan