With increasing installations of grid-connected power electronic converters in the distribution
network, there is a new trend of using distributed control in a cyber layer to coordinate the operations of
these power converters for improving power system stability. However, cyber-attacks remain a threat to
such distributed control. This paper addresses the cyber-attack detection and a countermeasure of distributed
electric springs (ESs) that have emerged as a fast demand-response technology. A fully distributed modelbased
architecture for cyber-attack detection in the communication network is developed. Based on a
dynamic model of ES with consensus control, a local state estimator is proposed and practically implemented
to monitor the system. The estimator is fully distributed because only local and neighboring information
is necessary. A countermeasure for the distributed ESs to ride through the cyber-attack and maintain
regulatory services in a microgrid is demonstrated successfully. Experimental results are provided to verify
the effectiveness of the proposed cyber-attack detection method and its ride-through capability.
