Benchmarking Cyberattack Detection in Electric Vehicle Charging Infrastructure with Benign User Updates

2026-08-11

AI Summary

This study addresses the challenge of distinguishing between legitimate user requests and malicious attacks in electric vehicle charging scenarios, where both exhibit highly similar patterns at the interface level. To tackle this issue, the authors construct a session-level benchmark with controlled information leakage, preserving sequential request structures from real-world ACN data and modeling legitimate modifications as normal behavior. They propose the Dual-Branch Masked-AE Transition Boost model, which employs a dual-branch architecture: one branch integrates a masked autoencoder with radial basis function–based one-class boundaries, while the other leverages shrinkage covariance distance to jointly assess whether the current request and its state transition conform to benign patterns. The framework further incorporates source-group five-fold cross-validation and an explicit acceptance constraint mechanism. Experimental results demonstrate that the proposed method significantly enhances detection performance against adversarial manipulations without erroneously rejecting legitimate users, achieving state-of-the-art robustness in validation.

Abstract

Cyberattack detection in electric vehicle charging infrastructure is complicated by legitimate post-activation revisions to requested energy and departure time. Charging manipulation attacks can exploit the same interface and variables; therefore, detecting a request change alone does not establish malicious intent. This paper develops a leakage-controlled session-level benchmark that preserves the ordered inputs of real Adaptive Charging Network (ACN) sessions and models legitimate revisions as normal behavior. A fixed pool keeps each generated attack in its source session's split and contains six physically motivated attacks and their coordinated variants. We compare 22 profile-only, transition-aware, and context-stratified model families under common source-grouped folds, attack data, and operating constraints. The proposed Dual-Branch Masked-Autoencoder (Masked-AE) Transition Boost model evaluates whether the current request is normal and whether its producing transition resembles an observed benign update. Its state branch combines masked reconstruction with a radial-basis-function one-class support boundary, while its transition branch combines masked reconstruction with shrinkage covariance distance. Source-grouped five-fold cross-validation selects complete configurations under explicit overall-normal and benign-update acceptance constraints; disjoint normal data then calibrate the final threshold before one test evaluation. The developed dual-branch model provides the strongest robust validation performance while detecting malicious request manipulations without learning to reject legitimate user choices.

Problem

• cyberattack detection
• electric vehicle charging infrastructure
• benign user updates
• charging manipulation attacks
• adaptive charging network

Innovation

• Dual-Branch Masked-AE
• benign user updates
• charging infrastructure security
• transition-aware detection
• leakage-controlled benchmark