Cyber-resilient automatic generation control against false data injection attacks under unknown load variations

False Data Injection Attacks (FDIAs) pose a serious cyber-physical threat to systems that rely on sensor-actuator communication. Automatic Generation Control (AGC) is particularly vulnerable because it adjusts generator outputs using frequency and tie-line power measurements. If these measurements are corrupted, the resulting control actions can cause power imbalances, equipment damage, and widespread blackouts. Conventional Bad Data Detection (BDD) methods may fail to identify stealthy FDIAs before their physical effects become significant. This paper proposes a robust state-estimation framework for resilient AGC operation under stealthy FDIAs and unknown load variations. The framework is built on an unbiased minimum-variance estimator, with unknown load variations and injected attacks modeled as separate unknown-input channels. This formulation decouples their effects and enables attack reconstruction without load measurements or forecasts. Detection is performed in real time using residual-based indicators, while mitigation is applied when attacks can be reconstructed reliably. An admissibility analysis determines the protection level for each measurement-attack subset. Admissible subsets satisfy the conditions required for convergent and unbiased attack reconstruction; attacks on these channels are detected, reconstructed, and mitigated in real time. Attacks outside the admissible set are not reconstructed. For the non-admissible measurement attacks and control-channel attacks evaluated, cross-model residual inconsistency triggers a safe fallback that disables AGC and returns generators to local frequency control. The proposed method is benchmarked against an Unknown Input Observer (UIO) and a Kalman-filter-based detector using two-area and three-area AGC systems, and is validated on a real-time co-simulation platform.