The paradigm shift towards highly distributed renewable energy integration has exponentially increased the topological complexity of Smart Grids. Consequently, the tight coupling between operational and information networks exposes these systems to severe cyber threats, including data breaches and malicious intrusions. Conventional centralized dispatch paradigms struggle with delayed responses, suboptimal coordination, and opaque design lifecycles. To overcome these limitations, this study introduces an innovative Multi-Agent System architecture engineered via Model-Based Systems Engineering methodologies. By employing SysML, we established a comprehensive digital twin encompassing system requirements, functional layouts, and logical boundaries. The proposed framework deploys a decentralized hierarchy of four specialized agents—perception, decision making, execution, and collaboration—to execute collaborative defense protocols strictly bounded by electrical safety constraints. Validation through IEEE 33-node distribution network simulations confirms that the framework rapidly identifies and mitigates Denial of Service, data falsification, and unauthorized device access. This MBSE-MAS paradigm demonstrates exceptional scalability and resilience, offering a highly practical blueprint for safeguarding next-generation power infrastructure.

Complex cyberattacks on electric power networks traverse communication links, control objects and power-service processes, making it difficult to explain how network evidence propagates to operational impact. This paper proposes an explainable cyber range-to-MATLAB co-simulation framework that couples traffic-oriented security emulation with power service simulation. The cyber range generates security events, traffic records, alarms and asset topology evidence, while MATLAB models calculate distribution network states, line power flows, switching states, energy-storage PCS states and service-impact indicators. A unified clock, event-mapping function, asset topology and evidence graph connect cyber events with business disturbances and observable power outputs. Mathematical descriptions are developed for event sets, service-state vectors, coupling functions, attack intensity, service-impact score, synchronization error, evidence completeness and metric improvement. Validation focuses on distribution network and energy storage scenarios. At the mapped switching disturbance at t = 180 s, 23 of 33 nodes are de-energized, and 2.235 MW (60.16% of feeder load) is unsupplied. Five repeated trials with plus or minus 3% load perturbations give a mean load loss of 2.243 plus or minus 0.008 MW. Integrated defensive retesting reduces attack intensity from 0.60 to 0.08, alarm latency from 12.4 s to 2.8 s, and recovery time from 240 s to 60 s. The framework, therefore, links cyber-range evidence to direct, auditable power-service quantities for attack-chain interpretation and defensive assessment.

Power industrial control systems (ICSs) have evolved into tightly coupled cyber-physical systems, which enlarges the attack surface and makes online vulnerability verification risky for critical infrastructure. Existing software-only simulators usually abstract firmware, industrial protocols, and device-specific behavior, whereas purely physical testbeds are costly and difficult to scale. To address this gap, this paper proposes a multi-agent-driven hybrid digital twin framework for adaptive cybersecurity vulnerability verification in power cyber-physical systems. The core of the framework is a high-fidelity three-in-one verification environment that integrates physical entities, network emulation, and power-process simulation. The framework complements physical testbeds rather than replacing them: fidelity-critical controllers and source-grid-load-storage devices are retained in controlled hardware loops, while larger communication topologies and power-process contexts are virtualized. Red-team and blue-team agents then orchestrate vulnerability triggering, attack-chain replay, intrusion detection, mitigation, and impact assessment. A virtual–real cross-verification mechanism calibrates the virtual models using physical measurements and validates candidate vulnerabilities in controlled hardware loops. A wind-turbine PLC near-source attack case demonstrates how the framework links cyber events, controller behavior, and physical operating states, and the reported quantitative indicators are interpreted as scenario-specific verification logs rather than universal statistical guarantees. The framework therefore provides a safe, scalable, and evidence-driven path for vulnerability verification and resilience enhancement in power critical infrastructures.