arXiv CS open access

Benchmarking Cyberattack Detection in Electric Vehicle Charging Infrastructure with Benign User Updates

2026 · arxiv_cs

arXiv CS · Papers · 2026

cryptography cybersecurity privacy security

Conceptio Open Archive

Analyze & explore related research in Conceptio

Connect this record directly into your research workflow or AI agent. Explore citations across open repositories, query full text, and export structured proof bundles.

Explore in Search →Connect via MCP / API ↗

Benchmarking Cyberattack Detection in Electric Vehicle Charging Infrastructure with User Updates

arXiv:2608.11286v1 [cs.CR] 11 Aug 2026

Hannan Chen, Graduate Student Member, IEEE, Roshni Anna Jacob, Member, IEEE, and Jie Zhang, Senior Member, IEEE

Abstract—Cyberattack detection in electric vehicle charging infrastructure is complicated by legitimate post-activation revisions to requested energy and departure time. Charging manipulation attacks can exploit the same interface and variables; therefore, detecting a request change alone does not establish malicious intent. This paper develops a leakage-controlled session-level benchmark that preserves the ordered inputs of real Adaptive Charging Network (ACN) sessions and models legitimate revisions as normal behavior. A fixed pool keeps each generated attack in its source session’s split and contains six physically motivated attacks and their coordinated variants. We compare 22 profile-only, transition-aware, and context-stratified model families under common source-grouped folds, attack data, and operating constraints. The proposed Dual-Branch MaskedAutoencoder (Masked-AE) Transition Boost model evaluates whether the current request is normal and whether its producing transition resembles an observed benign update. Its state branch combines masked reconstruction with a radial-basisfunction one-class support boundary, while its transition branch combines masked reconstruction with shrinkage covariance distance. Source-grouped five-fold cross-validation selects complete configurations under explicit overall-normal and benign-update acceptance constraints; disjoint normal data then calibrate the final threshold before one test evaluation. The developed dualbranch model provides the strongest robust validation performance while detecting malicious request manipulations without learning to reject legitimate user choices. Index Terms—Electric vehicle charging infrastructure, cyberattack detection, charging manipulation attack, unsupervised anomaly detection, masked autoencoder.

I. I NTRODUCTION The growing adoption of electric vehicles (EVs) introduces critical cybersecurity vulnerabilities to the power grid, highlighting the vital role of secure smart charging infrastructure. Smart charging coordinates users, charging points, chargingstation management systems (CSMSs), and grid operators to optimize charging times and rates according to mobility requests, grid conditions, and electricity prices. Charging stations exchange requested energy, connection time, departure time, and operating status with back-end systems, commonly through the Open Charge Point Protocol (OCPP) [1]. This connectivity also enlarges the cyber-physical attack surface. User applications, charging stations, and back ends can be exposed to message manipulation and man-in-themiddle attacks [2], [3]. Secure channels and authentication Hannan Chen and Roshni Anna Jacob are with the Department of Mechanical Engineering, The University of Texas at Dallas, Richardson, TX 75080, USA. Jie Zhang is with the Department of Mechanical Engineering and (Affilated) Department of Electrical and Computer Engineering, The University of Texas at Dallas, Richardson, TX 75080, USA (e-mail: jiezhang@utdallas.edu).

are necessary, but a compromised authorized component can still submit syntactically valid yet malicious charging requests. Such requests can increase peak demand, shift aggregate load, interfere with demand response, and affect grid operation. Runtime behavioral detection is therefore required in addition to communication security. A. Literature Review Smart EV charging depends on continuous communication between EV supply equipment and CSMSs. Prior OCPP studies identify message manipulation, fraudulent transactions, reservation or transaction interference, and man-in-the-middle threats [3]. Secure channel establishment and stronger authentication and authorization reduce these risks [4]; nevertheless, practical demonstrations of denial-of-service, man-inthe-middle, and code-injection exploits show why operational monitoring remains necessary [5]. Within this ecosystem, charging manipulation attacks (CMAs) are especially consequential because they alter requested start time, expected departure, and/or requested energy to reshape aggregate demand. Jahangir et al. [6] formalized CMAs against smart EV charging stations and analyzed how coordinated request manipulation can shift an aggregator’s load across the day. They also evaluated deep-learning detection mechanisms on real charging-session data, establishing both a physically motivated threat model and an important data-driven baseline. The present study retains that central attack logic and its peak-shifting objective, but makes the normal-data model more realistic: every qualifying ordered user input is preserved, attacks may originate from the request state currently in effect, and a detector must distinguish malicious changes from recorded benign energy and departure revisions. In practice, labeled field attacks are scarce, while normal charging is heterogeneous. A variety of methods have been explored in the literature to address such challenges [7]–[11]. Autoencoders (AEs) learn nonlinear normal representations through reconstruction [12], [13]; denoising objectives infer corrupted features from the remaining coordinates [14], motivating the masked AEs used here. Gaussian Error Linear Unit (GELU) activations smoothly process standardized continuous requests [15]. One-class support vector machines (OCSVMs) estimate nonlinear normal support [16], while local outlier factor (LOF), Gaussian mixture model (GMM), k-nearestneighbor (KNN), and covariance heads test local, density, and distance assumptions [17]. Deep Support Vector Data

Description (SVDD), deviation networks (DevNet), and realvalued non-volume-preserving (RealNVP) normalizing flows (NFs) provide neural center, deviation, and invertible-density alternatives [18]–[20]. The preceding methods play two roles in this study. Masked AEs, the RBF OCSVM, and shrinkage covariance estimation form the proposed detector, whereas LOF, GMM, KNN, Deep SVDD, DevNet, and RealNVP NF models serve as benchmark comparators. In particular, the proposed detector in this paper contains no NF block. Existing single-profile detectors generally assess the current request without separately modeling the transition that produced it, although benign updates and CMAs modify the same demand and timing variables. To address this gap, Dual-Branch Masked-AE Transition Boost is developed to evaluate two complementary forms of evidence. For every activation or update, its state branch uses a masked AE and an RBF OCSVM to determine whether the current request lies within normal support. For post-activation updates, its transition branch uses a second masked AE and Ledoit–Wolf covariance distance to determine whether the change from the preceding request resembles an observed benign update [21]. Standardized branch scores are combined through an update-gated, low-weight transition correction, while activation events remain state-only. Thus, an abnormal transition can promote an individually plausible attack, whereas a normal transition can reduce suspicion for a rare legitimate revision.

B. Contributions

II. C YBERATTACK S CENARIO G ENERATION A. Multi-Input ACN Data The study uses 1,213 valid Caltech ACN sessions [22]. Each record includes connection and disconnect times, station metadata, and an ordered ‘userInputs’ list. Let un,ℓ be input ℓ of session n. Input zero defines activation. For ℓ > 0, an observed update is retained when cn,ℓ = 1(|dn,ℓ − dn,ℓ−1 | > ϵchg ∨ etn,ℓ ̸= etn,ℓ−1 ) .

(1)

Here ϵchg is a fixed numerical tolerance that removes no-op energy records. Its event time and request state are: tin n,ℓ = modifiedAt(un,ℓ ), stn = modifiedAt(un,0 ), etn,ℓ = requestedDeparture(un,ℓ ),

(2)

dn,ℓ = kWhRequested(un,ℓ ). Among the 1,213 valid sessions, 73 contain more than one ‘userInputs’ record. Duplicate/no-op records are not events; only 45 sessions contain a qualifying consecutive change in the two studied decision variables. The resulting 1,264 normal states comprise 1,213 activations and 51 updates: 13 demandonly, 14 departure-only, and 24 joint updates. For example, one ordinary initial input requests 38.87 kWh from 14:29 to 22:29, corresponding to an implied rate of 4.86 kW. Table I gives three observed consecutive updates. It shows that benign revisions can move in either direction and can be substantial; these values are read directly from ACN ‘userInputs’, not synthetically perturbed.

This work makes four contributions: It formulates multi-input CMA detection as joint assessment of the current request and the transition that produced it, making correct acceptance of recorded benign updates an explicit objective rather than treating every post-activation change as anomalous. • It constructs a source-bound benchmark from all qualifying ordered Adaptive Charging Network (ACN) inputs, retains recorded energy and departure updates as normal behavior, reproduces their piecewise scheduled-power effects, and applies six physical CMA transformations and six coordinated variants once to eligible request states. • It develops Dual-Branch Masked-AE Transition Boost, whose state branch learns pooled normal-request support and whose transition branch learns the geometry of observed normal updates; gated continuous fusion preserves sensitivity to attacks while allowing legitimate revisions. • It evaluates 89 profile-only, transition-aware, and contextstratified configurations using source-grouped five-fold cross-validation (CV), equal-weight attack-family scoring, and explicit overall-normal and benign-update acceptance constraints before final testing.

•

The remainder of this paper is organized as follows. Section II presents the multi-input data and CMA generation. Section III develops the unsupervised models and evaluation protocol. Section IV reports the results, followed by discussion, limitations, and conclusions.

Table I E XAMPLES OF OBSERVED BENIGN USER UPDATES . T IMES ARE LOCAL . Source ID Kind 75 1108 546

Energy (kWh)

Departure

Demand 68.0 → 34.0 (−50%) 18:49 (unchanged) Departure 35.0 (unchanged) 10:58 → 11:58 Joint 28.6 → 42.9 (+50%) 11:47 → 12:09

The five request features are: Tn,ℓ = (etn,ℓ − stn )/3600,

Chn,ℓ = dn,ℓ /Tn,ℓ ,

xn,ℓ = [dn,ℓ , Chn,ℓ , stn − tpeak , etn,ℓ − tpeak , Tn,ℓ ]⊤ ,

(3)

where Tn,ℓ and Chn,ℓ are request duration and implied rate, and tpeak = 18:30 local time. Thus, tin n,ℓ triggers a state change but never restarts charging: every observed input retains stn . In each fold, feature means and standard deviations estimated only from training-normal states are applied unchanged to all downstream data. All states and attacks from a source remain in one split and one fold. B. Charging Manipulation Attacks The six CMAs increase or concentrate charging in the 16:00–21:00 peak interval. For an ordinary Type-i attack on session n, the attack is launched at ta = stn + dt, where dt = 5 min, and changes one eligible request state. The suffix “-ta” denotes the coordinated version, which applies the same

Table II E XACT TRANSFORMATIONS FOR T YPE -1–6; EACH IS ALSO USED IN T YPE -i- TA . Type

Manipulation

Transformed settings

1 2 3 4

Demand Earlier departure Later start Demand + earlier departure

Demand + later start

Demand + both times

dta = dn (ta− ) + ∆datt stta = stn , etta = etn (ta− ). 1 (n, ta), n,2 n,2 n,2 n,2 n,2 n,2 rem Chta = Chn (ta− ) + ξ2 ACRatt , T ta = En (ta)/Chta , etta = ta + T ta , dta = dn (ta− ). n,3 n,3 n,3 n,3 rem − − T ta = En (ta)/(Chn (ta ) + ξ3 ACRatt ), stta = etn (ta ) − T ta , dta = dn (ta− ). n,4 n,4 n,4 rem − dta = dn (ta− ) + ∆datt Teta = [En (ta) + ∆datt etta = ta + 4 (n, ta), 4 (n, ta)]/[Chn (ta ) + ACRatt ], n,4 e Tta . n,5 n,5 n,5 rem − = [En (ta) + ∆datt dta = dn (ta− ) + ∆datt Teta stta = 5 (n, ta)]/[Chn (ta ) + ACRatt ], 5 (n, ta), n,5 . etn (ta− ) − Teta n,6 n,6 n,6 rem − = = [En (ta) + ∆datt ∆Tta dta = dn (ta− ) + ∆datt Teta 6 (n, ta)]/[Chn (ta ) + ACRatt ], 6 (n, ta), n,6 n,6 n,6 n,6 n,6 Hn (ta) − Teta , etta = etn (ta− ) − κn ∆Tta , stta = ta + (1 − κn )∆Tta .

n,1

Algorithm 1 Source-bound multi-input CMA pool Require: Ordered normal inputs, source roles, CMA controls, seed 66. 1: for each validation or final-test role do 2: for each eligible input state and Type-1–6/singlecoordinated mode do 3: Apply Table II; recompute (3). 4: Save attack, source, input, type, and role identifiers. 5: end for 6: end for 7: Reuse the saved pool for every detector configuration.

C. Observed Benign Updates Observed updates are normal because they are exact successive ACN inputs, not generated perturbations. At tin n,ℓ , the recorded dn,ℓ and etn,ℓ replace the current request while stn remains fixed. Each kWhRequested is a revised total target, not an added increment. Equation (3) recomputes the request features. Physical power follows the implemented piecewise charging semantics rather than the implied-rate feature. At activation t0 = stn , dn,0 , Endel (t0 ) = 0, Pn (t+ 0)= (etn,0 − stn )/3600 bn (t+ en (t+ (6) 0 ) = t0 , 0 ) = min(etn,0 , discn ).

transformation to multiple states active at a common ta. The attack charging rate (ACR) is:

Here Pn is scheduled power, Endel is cumulative delivered energy, bn and en bound a power segment, and discn is the recorded disconnect time. For a later event at t, let bn (t− ) and en (t− ) delimit the preceding constant-power segment. The delivered energy and new segment are:

ACRatt = Catt Chav = 0.15(30) = 4.5 kW.

(4)

Here Catt is the attack coefficient and Chav is the reference charging rate. Their product balances physical impact and stealth: it changes aggregate load while keeping many individual requests plausible and below the simulator’s per-session power limit Pl = 24 kW. For an attacked source, define the input active immediately before the attack as: ℓn (ta) = max{ℓ : tin n,ℓ ≤ ta}, and abbreviate its request state by dn (ta− ) = dn,ℓn (ta) , etn (ta− ) = etn,ℓn (ta) , and Chn (ta− ) = Chn,ℓn (ta) . With time differences expressed in hours, Hn (ta) = etn (ta− ) − ta,

Enrem (ta) = Chn (ta− )Hn (ta),

(5)

∆datt i (n, ta) = ξi ACRatt Hn (ta). These quantities are the remaining time, remaining requested energy, and Type-i demand increment. Table II gives the exact transformations; omitted settings are unchanged. Types 1–3 isolate demand, departure, and start-time changes; Types 4–6 combine demand growth with time compression. The factor ξi ∈ (0, 1) randomizes strength, with standard deviation 0.1 and means 0.9 for Types 1–3 and 0.8 for Types 4–6; κn allocates the Type-6 reduction between start delay and departure advance. Algorithm 1 summarizes the one-time, source-bound generation with seed 66. CV attacks originate only from validation sources and final attacks only from final-test sources. Figure 1 shows the fixed aggregate effects.

Endel (t) = Endel (bn (t− )) + Pn (t− ) [min(t, en (t− )) − bn (t− )]+ , × 3600 dn (t+ ) − Endel (t) , Pn (t+ ) = [etn (t+ ) − t]/3600 bn (t+ ) = t, en (t+ ) = min(etn (t+ ), discn ).

(7)

Thus, energy delivered before an attack or user update is retained; disconnect truncates the active interval but does not replace the requested departure in the power denominator. Benign and malicious events differ by their parameter updates, not by power accounting. ACN does not guarantee a complete interface-level edit history; the 51 events are therefore an observed subset, not a population-rate estimate. III. D ETECTION M ETHODOLOGY A. Multi-Input Unsupervised Protocols Figure 2 summarizes the leakage-controlled experiment from ordered ACN inputs to final testing. The three protocols answer progressively different questions. Profile-only models ask whether the current request itself is normal and use prof Xn,ℓ = xn,ℓ , pooling activations with updates. Transitionaware models additionally ask how the request changed and use: tr ⊤ ⊤ Xn,ℓ = [x⊤ n,ℓ , ∆xn,ℓ , cn,ℓ ] ,

∆xn,ℓ = xn,ℓ − xn,ℓ−1 , (8)

Power (kW)

Normal inputs

Manipulated inputs

Type-1

Type-2

Type-3

Type-4

Type-5

Type-6

Type-1-ta (ta=18:55)

Type-2-ta (ta=15:55)

Type-3-ta (ta=15:55)

Type-4-ta (ta=15:55)

Type-5-ta (ta=15:55)

Type-6-ta (ta=18:55)

400 200

Power (kW)

400 200

Power (kW)

400 200

Power (kW)

400 200 0

12 16 Local hour

Figure 1. Aggregate charging profiles for the twelve fixed CMA settings. Power follows Table II and (6)–(7); shading marks the 16:00–21:00 peak-price period.

1a. Ordered normal inputs

1b. Fixed CMA pool

1,213 ACN sessions; 1,264 request states 51 recorded benign user updates

12 attack settings, generated once Source IDs and split roles retained

2. Source-level split before fitting 970 development sources | 243 untouched test sources Each source, request state, and derived attack stays in one role

held out

3. Five-fold multi-model optimization 22 model families | 89 configurations | common folds and attacks Fit on normal data; validation attacks rank equal-weight macro-F1 TNRall ≥ 0.95, TNRupdate ≥ 0.90, Jcv = F1macro − 0.5 SDf old

4. Freeze the pre-test winner Dual-Branch Masked-AE Transition Boost maximizes Jcv

5a. Refit

5b. Calibrate

5c. Test once

776 normal sources 811 request states

194 normal sources threshold from 201 states

243 untouched sources 252 normal states + 1,505 attacks

6. One-time reporting and reproducibility Formal model: F1 = 0.823, update TNR = 1.000 Metrics, confusion matrices, fixed attacks, splits, and executed notebooks Figure 2. Workflow from ordered ACN inputs and a source-bound CMA pool to source-grouped selection, normal-only calibration, and final testing.

with zero change for activation. Context-stratified models instead learn separate normal models for activations and updates, then put their scores on a common scale before applying one threshold. These protocols test whether explicit update context helps or whether scarce update samples make a pooled currentstate model more stable.

Normal-only means that no CMA sample estimates model parameters; simulated validation attacks only select among predefined fitted configurations. DevNet uses artificial tail samples as pseudo-anomalies, but not the fixed benchmark attacks. A model predicts yb(x) = 1[s(x) ≥ sthr ].

(9)

We denote the training, validation, normal-only calibration, and final-test sets by Dtr , Dval , Dcal , and Dte , respectively. B. Model Families For AE models, encoder fθ and decoder gθ minimize normal reconstruction error: z = fθ (e x), εAE = x e−x b,

⊤ ⊤ hAE = [ε⊤ AE , z ] .

x b = gθ (z),

Lrec = ∥εAE ∥22 ,

(10)

The downstream head evaluates latent rarity and signed residuals. To learn conditional feature relationships, a masked AE draws Mp ∼ Bernoulli(ρ), sets masked coordinates to zero, and minimizes PDx (M ) xp − x ep )2 0.1 (M ) p=1 Mp (b + ∥b x −x e∥22 . (11) LMAE = PDx D x max( p=1 Mp , 1)

where Dx is the input dimension and ρ is the masking probability. Here Mp = 1 hides feature p but retains it as a target. The residual records feature-wise error, while the latent code locates the request in the learned normal representation. ⊤ ⊤ ⊤ Its state representation is hstate AE = [εAE , z ] . For an update, the dimensionless compact transition is   ∆d/ max(|d− |, ϵchg )  ∆Ch/ max(|Ch− |, ϵchg )    −  (12) δn,ℓ =  ∆st/ max(3600|T − |, ϵchg ) , ∆et/ max(3600|T |, ϵchg ) ∆T / max(|T − |, ϵchg )

where each difference is current minus preceding input and the factor 3600 converts T − from hours to seconds for the two timestamp coordinates. For activation, δn,0 = 0. For an observed update, the vector compares two successive recorded inputs; for a generated attack, it compares the manipulated request with the legitimate state in effect immediately before the attack. The dual-branch candidate fits a masked-AE+OCSVM state head and a masked-AE covariance transition head on normal data. After standardizing each raw score against its training reference, it uses chg sdual (n, ℓ) = sstate (n, ℓ) + ωtr In,ℓ str (n, ℓ).

(13)

chg Here In,ℓ = 0 for activation and one for an observed update or generated attack. Thus, activations use the state boundary alone, whereas an actual request change contributes graded transition evidence. The gate does not exempt user updates from detection: every event retains its state score, and only events with a genuine change receive the additional transition correction. Support, density, and distance methods test normal-region membership, probability, and distance, respectively. The 89 predefined configurations share source folds, attacks, constraints, and selection score. Table III presents the principal families; the full registry is released with the reproducibility artifacts.

C. Proposed Dual-Branch Masked-AE Transition Boost The proposed model separates two questions that a single pooled representation cannot answer reliably: Is the current request state normal? and Is the change that produced it normal? Figure 3 follows the data path. The state branch fits all training-normal states; the transition branch fits only consecutive observed benign updates. Generated attacks enter no standardizer, AE, one-class head, or score-reference moment; they only compare configurations on validation folds and report final performance. 1) State masked autoencoder: Training-normal current states are standardized by a scaler Ss fitted only on Dtr : x en,ℓ = Ss (xn,ℓ ) ∈ R5 .

(14)

s For every minibatch, the binary mask Mn,ℓ,p ∼ Bernoulli(ρs ) is sampled independently for feature p, with ρs = 0.15. The (M ) s corrupted input is x en,ℓ = x en,ℓ ⊙ (1 − Mn,ℓ ). The encoder and decoder are (M )

s zn,ℓ = fθs (e xn,ℓ ),

fθs : 5 → 64 → 32 → 4,

s x bn,ℓ = gθs (zn,ℓ ),

gθs : 4 → 32 → 64 → 5.

(15)

The hidden layers use GELU(a) = aΦ(a), where Φ is the standard-normal cumulative distribution function. Its smooth response retains weak signed activations from standardized continuous features. The per-sample objective is Ls =

s ∥Mn,ℓ ⊙ (b xn,ℓ − x en,ℓ )∥22 0.1 + ∥b xn,ℓ − x en,ℓ ∥22 . (16) s max(∥Mn,ℓ ∥1 , 1) 5

The first term infers masked coordinates from the remaining variables; the second preserves complete-profile reconstruction. After training, unmasked states form deterministic representations for OCSVM fitting and inference. The signed residual and residual–latent representation are εsn,ℓ = x en,ℓ − x bn,ℓ ,

s hsn,ℓ = [(εsn,ℓ )⊤ , (zn,ℓ )⊤ ]⊤ ∈ R9 . (17)

2) RBF one-class state boundary: A second training-only scaler produces h̄sn,ℓ . The RBF kernel and OCSVM decision function are K(a, b) = exp[−γ∥a − b∥22 ], X dOCSVM (h̄s ) = αq K(h̄sq , h̄s ) − bsvm ,

(18)

q∈SV

where SV is the support-vector set, αq are learned dual weights, and bsvm is the intercept. Here ν controls tolerated training violations and γ controls RBF locality; scale is variance based. The selected head uses ν = 0.05 and γ = scale. Because positive OCSVM distance denotes normal support, the raw state anomaly score reverses the sign: rstate (n, ℓ) = −dOCSVM (h̄sn,ℓ ).

(19)

The RBF boundary can follow a nonlinear, nonelliptical normal-state region without requiring an accurate density for every normal charging mode.

Table III U NIFIED UNSUPERVISED MODEL FAMILIES AND ANOMALY SCORES . Family Raw port/density/distance AE heads

Normal model

Anomaly score

sup- RBF OCSVM, KNN, Ledoit–Wolf covariance, GMM, or LOF on X prof or X tr AE residual-latent feature hAE = [εAE , z] with Mahalanobis or GMM heads RealNVP map Fϕ on hAE

Boundary distance, neighbor distance, squared Mahalanobis distance, negative log likelihood, or local-density deficit. Covariance distance or mixture negative log likelihood.

− log pϕ (hAE ), where log pϕ (hAE ) = log p0 (Fϕ (hAE )) + log | det ∂Fϕ /∂hAE | [20]. Masked-AE models Masked reconstruction followed by an OCSVM sup- Boundary distance in the learned residual-latent representation. port head Transition boosts Raw or masked-AE state head plus a normal-only sstate + ωtr I chg str as in Eq. (13). transition head Context-conditioned models Separate activation/update heads or station-shrunk Head-standardized anomaly evidence. masked-AE features Deep SVDD / DevNet Centered neural embedding or neural deviation from Center distance or standardized positive deviation. pseudo-anomaly tails [18], [19] AE+NF

1. Ordered charging-request event chg Current state xn,ℓ ∈ R5 | previous state x− n,ℓ = xn,ℓ−1 | change gate In,ℓ ∈ {0, 1} chg chg I = 0 at activation; I = 1 for a recorded update or generated attack

2a. Current-state view

2b. Within-session transition

x e = Ss (x) ∈ R5 , Mps ∼ Bernoulli(0.15) Normal fitting: all training request states

δe = St (δ) ∈ R5 , Mpt ∼ Bernoulli(0.25) Normal fitting: recorded benign updates only

3a. State masked AE (GELU) Input 5

.. .

Latent 4

.. .

Output 5

3b. Transition masked AE (GELU) Input 5

.. .

Latent 2

.. .

Output 5

mask 15% | reconstruct the complete state e → zs → x b unmasked inference: x

mask 25% | reconstruct the complete transition unmasked inference: δe → z t → δb

4a. Nonlinear state support

4b. Normal-update geometry

[x e− x b, z s ]

= ∈ RBF OCSVM → negative signed distance training-reference standardization → sstate

b z t ] ∈ R7 ht = [ δe − δ, Ledoit–Wolf covariance + Mahalanobis distance training-reference standardization → str

5. Event-gated continuous fusion chg sdual = sstate + 0.15 In,ℓ str Activation: state evidence only Changed request: state evidence + graded transition correction

6. Normal-only calibration and decision Disjoint normal calibration selects sthr with TNRall ≥ 0.95 and TNRupdate ≥ 0.90 ybn,ℓ = 1[sdual (n, ℓ) ≥ sthr ] Normal request

Anomalous request

Figure 3. Proposed Dual-Branch Masked-AE Transition Boost architecture. Circles show explicit input, latent, and output nodes; representative hidden nodes are shown with the exact implemented widths above each layer. The state branch learns current-request support, the transition branch learns normal user-update geometry, and the gate activates transition evidence only after a request change.

3) Transition masked autoencoder and shrinkage distance: Only the compact transitions in Eq. (12) from observed normal user updates fit this branch. A transition scaler gives δen,ℓ = St (δn,ℓ ). With masking probability ρt = 0.25, the transition

AE uses: (M ) t zn,ℓ = fθt (δen,ℓ ),

fθt : 5 → 12 → 6 → 2,

t δbn,ℓ = gθt (zn,ℓ ),

gθt : 2 → 6 → 12 → 5,

(20)

and the same masked/full reconstruction form as Eq. (16). After training, unmasked transitions form deterministic representations for covariance fitting and inference: εtn,ℓ = δen,ℓ − δbn,ℓ ,

t htn,ℓ = [(εtn,ℓ )⊤ , (zn,ℓ )⊤ ]⊤ ∈ R7 . (21)

Let h̄t denote the standardized transition representations, µ bt their normal-update mean, and St their sample covariance. Because the observed-update sample is small, direct inversion of St can amplify estimation noise. Ledoit–Wolf shrinkage estimates b LW = (1 − λLW )St + λLW tr(St ) I7 , Σ (22) 7 where I7 is the 7 × 7 identity and λLW ∈ [0, 1] is estimated from the normal-update data. Shrinkage blends the noisy sample covariance with a stable spherical covariance before inversion. The raw transition score is the squared Mahalanobis distance. b −1 (h̄tn,ℓ − µ rtr (n, ℓ) = (h̄tn,ℓ − µ bt )⊤ Σ bt ). LW

(23)

It measures both change magnitude and whether demand, rate, timing, and duration move in a normally correlated direction. Masking does not synthesize updates; its targets remain observed transitions. Both AEs use AdamW with learning rate 10−3 , weight decay 10−5 , batch size min(96, Ntr ), and 180/160 state/transition epochs. 4) Continuous score fusion and decision: The two raw heads have different units and sample populations. The state reference contains all training-normal states, whereas the transition reference contains only observed training updates. Each score is standardized against its corresponding reference: rtr − µr,t rstate − µr,s , str = . sstate = (24) σr,s + 10−8 σr,t + 10−8 Here µr,s/t and σr,s/t are the corresponding training-reference means and standard deviations, respectively. Equation (13) then applies the selected low transition weight ωtr = 0.15. This is a signed correction rather than a second hard alarm: a normal-looking transition can reduce the score of a rare but legitimate revised state, while an unusual transition can promote a manipulated state that remains individually plausible. The state branch still detects abnormal activations and strong isolated states; the transition branch resolves ambiguity only when a request actually changes. The final decision is ybn,ℓ = 1[sdual (n, ℓ) ≥ sthr ],

(25)

where disjoint normal calibration chooses the smallest threshold satisfying an overall true-negative rate (TNR) of at least 0.95 and an observed-update TNR of at least 0.90. Algorithm 2 summarizes normal-only fitting and event-level inference. D. Source-Grouped CV and Calibration Seed 66 partitions the 1,213 sources into 970 development and 243 final-test sources while stratifying update type. Five source-grouped folds use 776 training and 194 validation sources each. Their validation update counts are 7, 7, 11, 8, and 9. The unified search evaluates 89 configurations in 445 fold tasks; every family is defined before final testing. For

Algorithm 2 Dual-Branch Masked-AE Transition Boost Require: Training normal states and observed normal transitions. 1: Fit Ss ; train the state masked AE by (16). 2: Form hs ; fit its scaler and RBF OCSVM on normal states. 3: Construct (12) for observed updates and fit St . 4: Train the transition masked AE; form ht . b LW . 5: Fit the transition scaler, µ bt , and Σ 6: Record training-reference moments for both raw scores. 7: for each activation, observed update, or generated attack do 8: Compute sstate and, when I chg = 1, str . 9: Fuse by (13); classify by (25). 10: end for every fold and candidate, normal validation scores choose the most sensitive threshold satisfying the TNR constraints. TNRall,val ≥ 0.95,

TNRupdate,val ≥ 0.90.

(26)

“Most sensitive” means the lowest threshold that still attains both normal-acceptance rates. The second constraint makes benign-update discrimination an explicit selection requirement. Fixed validation attacks compute macro-F1 across twelve settings, with each setting contributing one twelfth regardless of its eligible attack count. To reward both average detection and stability across source partitions, the objective penalizes the foldwise standard deviation (SD), and configuration c is ranked by Jcv (c) = F1macro (c) − λstd SDfold [F1macro (c)],

λstd = 0.5, (27) with update TNR and overall TNR as tie breakers. Algorithm 3 summarizes this selection protocol. The best configuration in each family/protocol pair is retained for comparison, and the largest Jcv selects the formal model. It is refitted on 776 sources (811 states), calibrated on 194 disjoint normal sources (201 states, seven updates), and evaluated on 243 untouched sources (252 states, nine updates) and 1,505 attacks. Algorithm 3 Five-fold multi-input model selection 1: for each model, protocol, and parameter configuration do 2: for each source-grouped fold do 3: Fit on fold-training normal states only. 4: Select sthr under (26). 5: Evaluate the twelve source-bound validation attacks. 6: end for 7: Compute Jcv in (27). 8: end for 9: Retain each family/protocol winner and the global winner. 10: Refit, calibrate on normal data, and test each selected model once.

E. Evaluation and Statistical Reporting Table IV gives the exact source-state accounting. Roles are fixed by source before attack generation, and every role includes all qualifying inputs from each assigned source.

Consequently, no later input or attack derived from a test source can enter fitting, validation, or threshold calibration. Table IV S OURCE , NORMAL - STATE , AND OBSERVED - UPDATE COUNTS . Role Session final training Session calibration Final test

Sources

States

Updates

776 194 243

811 201 252

35 7 9

Using true-positive (TP), false-positive (FP), true-negative (TN), and false-negative (FN) counts, the reported metrics are precision, recall, F1, and false-positive rate (FPR). Prec = TP/(TP + FP), Rec = TP/(TP + FN), F1 = 2 Prec Rec/(Prec + Rec),

(28)

FPR = FP/(FP + TN). Accuracy is omitted because attack and normal counts are imbalanced and false alarms have a distinct operational cost. Observed-update FPR is reported separately from activation FPR. For KW successes among NW trials and proportion π b= KW /NW , the Wilson confidence interval (CI) is used because update and attack-origin counts are small: ζ2 ± b + 0.975 CIW = π 2NW s # (29) 2 2 π b(1 − π b) ζ0.975 ζ0.975 1 + . ±ζ0.975 + 2 NW 4NW NW with ζ0.975 = 1.96. Wilson intervals remain valid for small groups and observed rates of zero or one, so they are emphasized for update subgroups. IV. R ESULTS A. Session-Level Model Selection All 445 fold tasks satisfy Eq. (26), and all 22 model families enter CV. Table V reports the 17 families with test F1 of at least 0.60; the complete search remains in the reproducibility artifacts. This presentation cutoff does not affect selection. Dual-Branch Masked-AE Transition Boost has the largest robust CV score and is selected before test evaluation. Figure 4 visualizes the test F1 column of Table V. The outlined Dual-Branch model leads with F1 0.823, followed by Profile-Anchor Transition Boost at 0.785 and raw OCSVM at 0.761. Blue, orange, and green denote profile-only, transitionaware, and context-stratified protocols. Model selection uses Jcv , not this ranking. The selected configuration in Fig. 3 uses state widths (64, 32), latent dimension 4, ρs = 0.15, and an RBF OCSVM with ν = 0.05 and γ = scale; its transition AE uses widths (12, 6), latent dimension 2, ρt = 0.25, Ledoit–Wolf distance, and ωtr = 0.15. Normal-only calibration gives sthr = 1.43054, overall TNR 0.9652, and update TNR 1.000. Final testing yields (TN, FP, FN, TP) = (240, 12, 445, 1060). Its Jcv = 0.671 exceeds Profile-Anchor Transition Boost’s 0.653 and determines the formal selection.

B. Observed-Update Discrimination Table VI isolates the central benign-update requirement. Across the five fold-specific validation thresholds, the selected dual-branch model accepts 41/42 held-out updates (TNR 0.976; Wilson 95% CI [0.877, 0.996]). Its refitted final model accepts every test update, including all demand-only, departure-only, and joint changes; the aggregate 9/9 interval is [0.701, 1.000]. These intervals prevent the small event count from being mistaken for a precise population estimate. Attacks launched from observed-update and activation states have recalls 0.692 (Wilson 95% CI [0.500, 0.835]) and 0.705 ([0.681, 0.727]), respectively. The close rates show comparable coverage for attacks originating before and after a benign update without treating the updates themselves as anomalies. The small 26-attack subgroup nevertheless precludes a strong equivalence claim. C. Attack-Specific Behavior Figure 5 reports the formal dual-branch model; complete metrics are released with the per-attack results. Each panel uses the same 252 normal states. Type-1-ta, Type-2-ta, and Type-4-ta are difficult partly because their per-profile perturbations shrink near requested departure: ∆datt ∝ Hn (ta) i in (5), and Table II likewise scales their timing changes with Hn (ta). Thus, a coordinated attack can alter aggregate load while leaving late-session profiles near normal support. Types 5-ta and 6-ta perturb demand and timing more clearly and reach recalls 0.991 and 0.990. Of 1,505 attacks, 26 originate from observed-update states and 18 are detected. V. D ISCUSSION Three findings follow. First, recorded user updates must be modeled as legitimate transitions. Source grouping, updateTNR constraints, and update-origin reporting prevent recall gains obtained by rejecting authorized revisions. The selected model accepts 41/42 held-out development updates and all nine test updates, with similar recall for activation- and updateorigin attacks. Second, the branches are complementary: the state masked AE and OCSVM learn support for initial and revised requests, while the transition masked AE and shrinkage covariance head learn legitimate demand–timing changes. Gated fusion adjusts ambiguous revised states without removing the stateonly activation path. Its CV gain over profile anchor and raw OCSVM is encouraging, although 42 development updates limit conclusions about larger transition heads. Third, attack physics determines separability. Per-attack analysis explains the resulting failure modes but never selects a detector after observing attack type. VI. L IMITATIONS AND D EPLOYMENT C ONSIDERATIONS The CMAs are physically motivated simulations rather than observed intrusions. The fixed Catt = 0.15 represents one impact–stealth point; adaptive adversaries may use weaker, targeted, or detector-aware changes, so the results support only the twelve defined settings.

Table V R EPORTED SESSION - LEVEL MODELS ON 252 NORMAL STATES AND 1,505 ATTACKS . A LL 22 FAMILIES ENTER CV; THE TABLE RETAINS TEST F1 ≥ 0.60 FOR READABILITY. B OLD MARKS THE CV- SELECTED MODEL . Model family

Protocol

CV F1 CV SD Jcv Prec. Recall Test F1 FPR Update TNR

Dual-Branch Masked-AE Transition Boost Profile-Anchor Transition Boost Raw OCSVM Masked AE+OCSVM AE+NF Context OCSVM DevNet Raw GMM Context Mahalanobis Raw KNN AE-GMM Deep SVDD AE-Mahalanobis Context KNN Raw Mahalanobis Raw LOF Station-Conditioned Masked AE+OCSVM

Transition Transition Profile Profile Profile Stratified Transition Transition Stratified Profile Profile Profile Transition Stratified Transition Transition Stratified

.684 .678 .672 .650 .593 .600 .584 .607 .572 .571 .590 .570 .568 .536 .553 .513 .516

.026 .051 .051 .058 .068 .096 .070 .133 .066 .065 .129 .091 .097 .035 .070 .014 .088

.671 .989 .653 .992 .646 .991 .621 .990 .559 .989 .553 1.000 .549 1.000 .541 1.000 .539 1.000 .539 .987 .525 .983 .525 .994 .519 1.000 .518 1.000 .517 1.000 .506 1.000 .472 .976

.704 .650 .618 .596 .538 .483 .477 .478 .486 .538 .532 .513 .477 .481 .477 .477 .452

.823 .785 .761 .744 .697 .651 .646 .647 .654 .696 .690 .677 .646 .650 .646 .646 .618

.048 .032 .032 .036 .036 .000 .000 .000 .000 .044 .056 .020 .000 .000 .000 .000 .067

1.000 1.000 1.000 1.000 1.000 1.000 1.000 1.000 1.000 1.000 1.000 1.000 1.000 1.000 1.000 1.000 1.000

0.823

Dual-Branch Masked-AE Transition Boost

0.785

Profile-Anchor Transition Boost

0.761

Raw OCSVM

0.744

Masked AE+OCSVM

0.697

AE+NF Raw KNN

0.696

AE-GMM

0.690 0.677

Deep SVDD Context Mahalanobis

0.654

Context OCSVM

0.651

Context KNN

0.650

Raw GMM

0.647

Raw Mahalanobis

0.646

AE-Mahalanobis

0.646

Raw LOF

0.646 0.646

DevNet

0.618

Station-Conditioned Masked AE+OCSVM

0.0

0.2

0.4 0.6 Frozen final-test F1 profile only transition aware

0.8

1.0

context stratified CV-selected global model

Figure 4. Test F1 for the reported session-level model families with F1 ≥ 0.60; colors denote feature protocol. Complete results are available in the reproducibility artifacts.

Group

Count Correct

CV benign updates (out of fold) Test demand updates Test departure updates Test joint updates Activation-origin attacks Update-origin attacks

42 2 3 4 1,479 26

Rate

41 .976 2 1.000 3 1.000 4 1.000 1,042 .705 18 .692

Type-1

Type-2

240

108

True

Table VI F ORMAL DUAL - BRANCH MODEL BEHAVIOR ON OBSERVED UPDATES AND ATTACK ORIGINS . T HE RATE IS TNR FOR BENIGN ROWS AND RECALL FOR ATTACK ROWS .

Type-3

Type-4

240

107

123

Type-5

Type-6

240

174

149

Type-1-ta

Type-2-ta

Type-3-ta

Type-4-ta

Type-5-ta

Type-6-ta

240

106

103

Pred

Figure 5. Formal Dual-Branch Masked-AE Transition Boost confusion matrices for the twelve final CMA settings.

The data expose 51 qualifying updates from 45 sessions, with nine updates and 26 update-origin attacks in the final test. ACN may omit app-level edits not retained in its input history, and the resulting wide Wilson intervals mean that observed update performance is not a precise population-wide rate. Broader sites, dates, and application logs are needed to assess transition-aware generalization. The compact features omit charger rating, vehicle capability, user history, tariffs, feeder state, and power telemetry. Fitting is normal-only, but simulated validation attacks select configurations; the framework is therefore simulation-assisted rather than fully label-free. Thresholds require periodic recalibration as behavior changes. Detection remains decision support: a CSMS must balance grid risk and user inconvenience when confirming, freezing, or escalating an edit. VII. C ONCLUSION This paper benchmarked cyberattack detection for multiinput EV charging while treating recorded user revisions as normal. The source-bound design applies six physical CMAs and six coordinated variants under leakage-controlled roles. Source-grouped cross-validation selects Dual-Branch MaskedAE Transition Boost, which separates current-state support from normal transition geometry. It achieves F1 0.8227 on 1,505 final attacks, accepts all nine test updates, and gives comparable recall for activation- and update-origin attacks. Reliable CMA detection therefore requires authorized revisions to be modeled throughout splitting, learning, selection, and calibration. Potential future work will expand observed updates across sites and seasons, add charger and vehicle context, and test adaptive attacks. A completed causal sliding-window fusion extension addresses synchronized multi-session attacks by combining cross-session temporal evidence with local anomaly scores; details are reserved for a separate study. ACKNOWLEDGMENTS This work was supported by National Science Foundation under grant DMS-2229417. C ODE AND DATA AVAILABILITY The code and dataset repository is available at: https://github.com/Hannan-Chen/ Cyberattack-Detection-in-EV-Charging-Systems. D ECLARATION OF AI-A SSISTED R ESEARCH Generative AI assisted coding, visualization, and writing; the authors verified all AI-assisted content and take full responsibility for the work. R EFERENCES [1] GridX, “Smart charging,” https://www.gridx.ai/knowledge/ smart-charging, Apr. 2025, accessed: Nov. 21, 2025. [2] Z. Garofalaki, D. Kosmanos, S. Moschoyiannis, D. Kallergis, and C. Douligeris, “Electric vehicle charging: A survey on the security issues and challenges of the open charge point protocol (ocpp),” IEEE Communications Surveys & Tutorials, vol. 24, no. 3, pp. 1504–1533, 2022.

[3] C. Alcaraz, J. Lopez, and S. Wolthusen, “Ocpp protocol: Security threats and challenges,” IEEE Transactions on Smart Grid, vol. 8, no. 5, pp. 2452–2459, 2017. [4] J. E. Rubio, C. Alcaraz, and J. Lopez, “Addressing security in ocpp: Protection against man-in-the-middle attacks,” in 2018 9th IFIP International Conference on New Technologies, Mobility and Security (NTMS), 2018, pp. 1–5. [5] D. Elmo, G. Fragkos, J. Johnson, K. Rohde, S. Salinas, and J. Zhang, “Disrupting ev charging sessions and gaining remote code execution with dos, mitm, and code injection exploits using ocpp 1.6,” in 2023 Resilience Week (RWS), 2023, pp. 1–8. [6] H. Jahangir, S. Lakshminarayana, and H. V. Poor, “Charge manipulation attacks against smart electric vehicle charging stations and deep learningbased detection mechanisms,” IEEE Transactions on Smart Grid, vol. 15, no. 5, pp. 5182–5194, 2024. [7] R. A. Jacob, M. J. Uddin, J. Wang, B. Coskunuzer, and J. Zhang, “Cyber attack detection in electric vehicle charging stations using topological data aided learning,” in 2025 IEEE Power & Energy Society General Meeting (PESGM), 2025, pp. 1–5. [8] H. Basumatary, M. Khatua, and S. Nath, “False data injection attack detection in EV charging network using NARX neural network,” IEEE Transactions on Transportation Electrification, vol. 11, no. 4, pp. 9686– 9700, 2025. [9] S. R. Fahim, R. Atat, C. Kececi, A. Takiddin, M. Ismail, K. R. Davis, and E. Serpedin, “Graph autoencoder-based power attacks detection for resilient electrified transportation systems,” IEEE Transactions on Transportation Electrification, vol. 10, no. 4, pp. 9539–9553, 2024. [10] N. Liu, M. Sun, and J. Zhang, “GDGU: A gradient differencebased graph unlearning method for cyberattack localization in electric vehicle charging networks,” 2026. [Online]. Available: https://arxiv.org/abs/2606.19566 [11] D. R. Olojede, M. J. Uddin, R. A. Jacob, B. Coskunuzer, and J. Zhang, “Topology informed transformer for cyber attack detection in gridconnected PV systems,” IEEE Transactions on Sustainable Energy, vol. 17, no. 3, pp. 2365–2377, 2026. [12] G. E. Hinton and R. R. Salakhutdinov, “Reducing the dimensionality of data with neural networks,” Science, vol. 313, no. 5786, pp. 504–507, 2006. [13] M. Sakurada and T. Yairi, “Anomaly detection using autoencoders with nonlinear dimensionality reduction,” in Proceedings of the MLSDA 2014 2nd Workshop on Machine Learning for Sensory Data Analysis, ser. MLSDA’14. New York, NY, USA: Association for Computing Machinery, 2014, pp. 4–11. [14] P. Vincent, H. Larochelle, Y. Bengio, and P.-A. Manzagol, “Extracting and composing robust features with denoising autoencoders,” in Proceedings of the 25th International Conference on Machine Learning, 2008, p. 1096–1103. [15] D. Hendrycks and K. Gimpel, “Gaussian error linear units (gelus),” 2023. [Online]. Available: https://arxiv.org/abs/1606.08415 [16] B. Schölkopf, J. C. Platt, J. Shawe-Taylor, A. J. Smola, and R. C. Williamson, “Estimating the support of a high-dimensional distribution,” Neural Computation, vol. 13, no. 7, pp. 1443–1471, 07 2001. [17] M. M. Breunig, H.-P. Kriegel, R. T. Ng, and J. Sander, “Lof: identifying density-based local outliers,” in Proceedings of the 2000 ACM SIGMOD International Conference on Management of Data, 2000, p. 93–104. [18] L. Ruff, R. Vandermeulen, N. Goernitz, L. Deecke, S. A. Siddiqui, A. Binder, E. Müller, and M. Kloft, “Deep one-class classification,” in Proceedings of the 35th International Conference on Machine Learning, 2018, pp. 4393–4402. [19] G. Pang, C. Shen, and A. van den Hengel, “Deep anomaly detection with deviation networks,” in Proceedings of the 25th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining, 2019, p. 353–362. [20] L. Dinh, J. Sohl-Dickstein, and S. Bengio, “Density estimation using real nvp,” 2017. [21] O. Ledoit and M. Wolf, “A well-conditioned estimator for largedimensional covariance matrices,” Journal of Multivariate Analysis, vol. 88, no. 2, pp. 365–411, 2004. [22] Z. J. Lee, T. Li, and S. H. Low, “ACN-Data: Analysis and Applications of an Open EV Charging Dataset,” in Proc. ACM Int. Conf. Future Energy Systems, ser. e-Energy ’19, Jun. 2019.

Benchmarking Cyberattack Detection in Electric Vehicle Charging Infrastructure with Benign User Updates

Analyze & explore related research in Conceptio

Related documents