## 1 Introduction
The staff were forced to shut down the entire wind farm system, effectively removing 11,000 MW of power from the interconnected power grid. As of 15 March 2022, only 15%--roughly 900 wind turbine generators--had been restored [7]. In this case, no damage was reported to any wind turbine generators. Again, in March 2022, the wind farm operator Nordex SE was hit with a Conti ransomware attack that forced the entire platform offline [7]. The attack only affected the internal IT infrastructure, and no third-party assets were affected [7]. No wind turbine generator damage was reported as a result of this attack. Lastly, on 11 April 2022, the wind farm operator Deutsche Windtechnik AG was attacked by a ransomware attack and lost  
Figure 1: DFIG-based wind turbine generator model. control of 2000 wind turbine generators [7]. The incident forced the responders to switch off the remote data monitoring connections to the wind turbine system, effectively shutting the turbines down for 48 h [7]. To reduce the occurrence and effects of malicious attacks, researchers and engineers must continuously develop advanced control schemes to protect these vital assets to maintain a reliable power supply to consumers and prevent losses of revenue for utility providers. Based on a thorough literature review, very few artificial intelligence (AI)-based control methods have been utilized to both detect and mitigate cyber attacks on wind farms. An event-triggered scheme is proposed in the presence of denial of service (DoS) attacks, which are carried out by a class of periodically detectable jammers [8]. By taking the event-triggered scheme under DoS attacks and deception attacks into consideration, a new model for LFC multiarea power systems is constructed as a switched system. On the basis of the new model, the exponentially mean-square stability of LFC multiarea power systems is obtained by virtue of Lyapunov stability theory. The work [9] proposes a test-bed performance evaluation of attack-resilient control for wind farm supervisory control and data acquisition (SCADA) that detects different cyber attacks on SCADA measurements and provides mitigation using forecast information. In the work of ref. [10], a dynamic model is improved for LFC considering cyber attacks, load disturbance, and the influence of variable wind speeds of a wind farm. A consensus-based distributed control system for modular multilevel converter (MMC) submodules (SMs) was proposed in ref. [11] to prevent bad data attacks. Additionally, a Kalman Filter-based FDIA detection method was introduced. The work of ref. [12] deals with Pearson correlation coefficient data points with an autoencoder/decoder and a time sequence machine learning algorithm approach to find outliers efficiently and to detect false data injection attacks (FDIAs)/bad data injection attacks (BDLAs) and DoS. Although there are many methods used for monitoring and controlling wind turbine generators and a plethora of methods used to detect cyber attacks on wind farms, the clear lack of mitigation methods other than removing the entire wind farm from the power grid leads to room for improvement in the current control methodology. Specifically, a control method that can not only mitigate data injection attacks to controller set-point values but also manage the wind turbine generators during network attacks is lacking. Therefore, more research in this area is necessary to protect wind farm assets. Based on the National Institute of Standards and Technology (NIST) special publication 800-207, new cyber architectures for access control with respect to wind turbine generators are necessary to prevent cyber attacks on the energy management system [13]. This fact motivates the proposed research, and it introduces an important research question on how a cyber-resilient converter control-based wind farms can be developed. Based on the above background, this paper proposes a multi-agent deep deterministic policy gradient (DDPG) controller for cyber attack mitigation in a wind farm.