Detecting false authentication attacks in smart grid EV charging systems

Abstract

As the adoption of Electric Vehicles (EVs) increases, the risk of cyber threats to their charging infrastructure also increases. We introduce a machine-learning framework to detect false authentication behavior that induces denial-of-service-like load patterns at Charging Stations and Grid Servers. Using system-level features from Charging Station and Grid Server traffic, our baseline model achieves a weighted average F1 score of 0.88 (88%) across sixteen attack scenarios. However, this baseline relied on simplified hash-and-XOR authentication rather than ISO 15118 and provided only binary labels, limiting the realism of the simulated authentication workflow and preventing fine-grained attack identification. To establish a more realistic baseline, we first released the CICEV2023 dataset, a binary-labeled dataset generated by this hash-and-XOR simulator.

CICEV2023, however, still lacks standards-based ISO 15118 and Open Charge Point Protocol (OCPP) communication and remains restricted to a single binary label. To address these specific constraints, this dissertation presents the CICEV2025 dataset, which reproduces Electric Vehicle-to-Charging Station-to-Grid-Server communication under normal conditions and eight malicious variants, while collecting low-overhead hardware traces using perf. The dataset enhances widely used benchmarks such as KDD99 and UNSW NB15 by adding CPU-level metrics and timing anomalies that better reflect real-world conditions.

We adopt a two-phase detection pipeline. Phase one performs a memory-aware multi-GPU grid search for deep learning hyperparameters. Phase two applies a skip-factor sampling scheme that compactifies the training set while capping validation degradation at the elbow point. This scheme reduces the hyperparameter training data by up to 99.5% on UNSW NB15 and by 49.9% on KDD99, while matching the full-data model at the elbow. In CICEV2025, most binary settings also exhibit an approximately 99% reduction, with a small loss. Final scores are KDD99 multiclass F1 of 0.99 (99%), UNSW NB15 multiclass F1 of 0.85 (85%), and CICEV2025 binary F1 of 0.99 (99%). This work integrates simulation data reduction and GPU-accelerated learning to provide a practical foundation for securing future charging infrastructure.