Due to the distributed architecture and extensive reliance on communication infrastructures, cybersecurity has become a critical challenge for the secure operation of modern microgrids. Among various cyber threats, false data injection (FDI) attacks and malicious setpoint manipulation can significantly degrade system stability and operational reliability. This paper proposes a three-layer intelligent framework for cyberattack detection and adaptive mitigation in AC microgrids. The proposed framework integrates multi-sensor data fusion and validation, Kalman filter-based state estimation, and machine-learning-assisted adaptive corrective control to enhance the resilience of the investigated microgrid against corrupted measurements and coordinated cyberattack scenarios. Unlike conventional approaches that rely on fixed corrective actions, the proposed method generates adaptive control responses according to the estimated attack severity while enforcing safety constraints to prevent excessive corrective actions. In addition to representative FDI scenarios, benign operating conditions including load variations, capacitor switching events, and renewable generation fluctuations are considered during dataset generation to evaluate the classification performance and false alarm behavior. Simulation results obtained in MATLAB/Simulink demonstrate an overall detection accuracy of 98.35%, with a precision of 98.89%, recall of 97.80%, F1-score of 98.34%, false alarm rate of 1.10%, missed detection rate of 2.20%, and an average detection delay of 0.40 ms. The results demonstrate that the proposed framework can effectively distinguish the investigated cyberattack scenarios from the considered normal operating conditions while limiting unnecessary corrective actions through bounded adaptive control. Therefore, the proposed method provides a promising approach for cyber-resilient microgrid control applications.
