## 1 Introduction  
Information and Communication Technology (ICT) plays a crucial role in significantly enhancing the communication efficiency of distributed photovoltaic (PV) microgrids. It not only enables the real-time monitoring of energy production through sensor devices [1] but also facilitates the efficient transmission and execution of commands, as well as the implementation of optimized control strategies via computing centers. However, behind this progress lie significant challenges, particularly as the reliance of distributed PV microgrids on ICT deepens, making network security issues increasingly prominent [2]. The high degree of informatization has led to more tightly interconnected distributed photovoltaic (PV) microgrid systems, while also exacerbating their vulnerability to diverse network threats [3]. In particular, sensors and actuators, which form the foundation for data acquisition and operational execution, are essentially embedded computing devices and have become frequent research focuses in recent years due to their high susceptibility to cyberattacks [4]. Additionally, commonly used industrial communication protocols in power systems, such as DNP3, MODBUS, and IEC 61850, have been revealed to contain significant security vulnerabilities, making them prone to network attacks [5]. Through these avenues, attackers can effectively target distributed PV microgrids to alter energy output data or even damage critical infrastructure [2]. There have been numerous discussions on network attack detection techniques for photovoltaic microgrids, which can generally be categorized into two main types: model-based strategies and data-driven approaches. The core of model-based strategies lies in building system models to perform state prediction. When the deviation between the actual monitoring data and the model prediction exceeds a preset threshold, an attack alarm is triggered. For instance, in reference [6], Kalman filtering technology is used to create a state-space model of the photovoltaic converter, identifying potential network attacks through a statistical analysis of residual variations. To further enhance detection accuracy, some studies have introduced a Harmonic State Space (HSS) model based on power electronic induction, which can effectively detect attack activities even with a limited number of sensors [7]. Reference [8] employs synchronized compressed wavelet transform to construct an attack detection framework suitable for rooftop photovoltaics. Additionally, active defense strategies have also gained attention. For example, in [9], dynamic watermarking technology, utilizing detailed model estimation algorithms, can monitor and counteract malicious tampering attempts on photovoltaic system sensors.While model-based detection methods have demonstrated some value in photovoltaic microgrids, they struggle with the complex and dynamic nature of real-world conditions. Nonlinear relationships, external disturbances, and incomplete data can make it difficult for simple models to accurately describe system behavior, leading to reduced detection accuracy. Data-driven approaches have made significant progress in the field of anomaly detection and network attack identification. Initially, some classical algorithms were proposed, such as the Local Outlier Factor (LOF) introduced by [PERSON] et al. [10], which measures the degree of anomaly in data objects and evaluates their performance in local neighborhoods. They further explored the formal properties of LOF, proving that objects within a cluster tend to have LOF values close to 1, while providing tight upper and lower bounds, as well as more precise non-tight limits for other objects. Additionally, the authors proposed a heuristic ranking method based on the maximum LOF value, effectively identifying local anomalies that were difficult to detect with previous methods. One-Class Support Vector Machine (OC-SVM) [11] is another important method used to estimate the support set of high-dimensional distributions.