## 5 Discussion and Future Outlook  
Our work has certain limitations. Nonetheless, we believe it can serve as a foundation for reaffirming our commitment to real-world validation in future projects. While this study primarily uses a simulation-based approach, we acknowledge the essential role of actual field testing. In conclusion, we emphasized that our upcoming efforts would incorporate testing with field data on a physical energy island or microgrid setup, or through hardware-in-the-loop (HIL) simulations.  
Figure 14: Estimated value of DC bus voltage for supporting the demand side.  
Figure 13: In the third case, different types of attacks are injected and tested. (**a**) The PV mission profile and output power, (**b**) the capacitor voltage and inductor current, and (**c**) the logic state of the attack are displayed.  
The significance of ANN-based SML in cybersecurity, its short-term prospects, and the challenges it faces can be summarized as follows: It is crucial to recognize that ANN-based SML provides much faster analysis and response mechanisms than traditional methods due to its rapid detection and response capabilities. By nature, ANN-based SML adapts to new and unknown threats through continuous learning and self-updating. It offers adequate protection in large, complex infrastructures and is especially critical for RESs with extensive networks, providing both flexibility and scalability. If ANN-based SML algorithms are not trained with optimal data or inadvertently memorize the dataset, they may generate false alarms and fail to perform adequately under varying conditions, complicating operational processes. While big data may help mitigate this confusion, the requirement for substantial data for effective ANN-based SML operation can also introduce data security risks. Moreover, developing and implementing advanced AI systems involves high costs and complex procedures.  
Among the precautions that can be implemented for future studies in general terms are elaborated as follows: The measures proposed for future studies emphasize network and communication security, intrusion detection, anomaly analysis, as well as physical and hardware security. Regarding network security, it is advisable that sensor data and control signals be encrypted using algorithms, such as AES or RSA, unauthorized access be thwarted through certificate-based authentication or blockchain-supported access control, secure communication protocols (like MQTT-TLS) be employed instead of Modbus and DNP3, and the network be segmented into control and monitoring sections. For intrusion detection, it is crucial to monitor voltage, current, and frequency variations in PV systems in real-time, identify anomalies using ML techniques, and analyze sudden voltage spikes and communication delays through time series analysis. Regarding physical and hardware security, it is essential to implement hardware protection with FPGA or secure microcontrollers, shield critical loads by switching the system to island mode during an attack, and ensure redundancy through alternative communication paths and control systems, thereby enhancing the system's resilience.  
Furthermore, cyber-attack types can be diversified, or additional variations can be introduced to existing types of attacks, thereby increasing the complexity and uncertainty in the system by rendering them a more realistic version. One of the important future studies is to implement this detection and defense mechanism on a hardware basis.