Development　of　a　cyber　security　strategy　for　the　active　distribution　systems　is　challenging　due　to　the　inclusion　of　distributed　renewable　energy　generations.　This　paper　proposes　an　adaptive　hierarchical　cyber　attack　detection　and　localization　framework　for　distributed　active　distribution　systems　via　analyzing　electrical　waveforms.　Cyber　attack　detection　is　based　on　a　sequential　deep　learning　model,　via　which　even　minor　cyber　attacks　can　be　identified.　The　two-stage　cyber　attack　localization　algorithm　first　estimates　the　cyber　attack　sub-region,　and　then　localize　the　specified　cyber　attack　within　the　estimated　sub-region.　We　propose　a　modified　spectral　clustering-based　network　partitioning　method　for　the　hierarchical　cyber　attack　＇coarse＇　localization.　Next,　to　further　narrow　down　the　cyber　attack　location,　a　normalized　impact　score　based　on　waveform　statistical　metrics　is　proposed　to　obtain　a　＇fine＇　cyber　attack　location　by　characterizing　different　waveform　properties.　Finally,　compared　with　classical　and　state-of-art　methods,　a　comprehensive　quantitative　evaluation　with　two　case　studies　shows　promising　estimation　results　of　the　proposed　framework.