SummaryThis paper proposes a new detection, reconstruction and mitigation scheme for nonlinear cyber‐physical systems experiencing deception attacks in controller‐actuator channel. For early detection of attacks, an anomaly detection unit based on the diagnostic observer is designed. After residual generation and evaluation, attack is detected. Upon attack detection, an adaptive fuzzy wavelet network (FWN) as an online nonlinear estimator is activated to reconstruct the detected malicious attack. Then, attack mitigation mechanism based on the command filtered backstepping approach and reconstructed attack is activated to mitigate the adverse effect of the detected attack. Stability analysis of the suggested strategy is presented and simulation results are provided to show the effectiveness of the suggested scheme.