EVDetect: A framework for orchestrated and AI-powered detection of cyber-attacks in EV charging networks

EVDetect: A framework for orchestrated and AI-powered detection of cyber-attacks in EV charging networks | Research Square window.SnipcartSettings = { analytics: { enabled: false } }; (function() { var accessVector = localStorage.getItem('access_vector') || ''; window.dataLayer = window.dataLayer || []; if (accessVector) { window.dataLayer.push({ user: { profile: { profileInfo: { snid: accessVector } } } }); } })(); (function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);})(window,document,'script','dataLayer','GTM-K279D39R'); Browse Preprints In Review Journals COVID-19 Preprints AJE Video Bytes Research Tools Research Promotion AJE Professional Editing AJE Rubriq About Preprint Platform In Review Editorial Policies Our Team Advisory Board Help Center Sign In Submit a Preprint Cite Share Download PDF Research Article EVDetect: A framework for orchestrated and AI-powered detection of cyber-attacks in EV charging networks Kosmas Lazaridis, Ioannis Topouzelidis, Ioannis Vagionas, Alexios Lekidis This is a preprint; it has not been peer reviewed by a journal. https://doi.org/ 10.21203/rs.3.rs-9177269/v1 This work is licensed under a CC BY 4.0 License Status: Posted Version 1 posted You are reading this latest preprint version Abstract E-mobility has gained significant attention in recent years due to its contribution to reducing greenhouse gas emissions and the technological advancements introduced by digital interfaces. However, these interfaces also expose the grid to an expanded threat landscape, including attacks such as spoofing and Denial-of-Service. In this article, we propose EVDetect, a comprehensive anomaly detection framework capable of training and performing inference over various unsupervised and supervised Machine Learning (ML) models for detecting attacks in Electric Vehicle (EV) charging networks. Our methodology introduces a decoupled logging architecture that prevents logging noise and enables the retrospective use of historical models, ensuring full reproducibility for any tabular security dataset. Crucially, the method identifies the optimal model based on a trade-off between functional (i.e., F1-score) and non-functional (i.e., inference latency, memory footprint, CPU constraints) characteristics. The framework is validated on a widely adopted realistic dataset containing a diverse set of attacks (CICEVSE2024), using a newly developed library of both unsupervised and supervised models. Ultimately, this work provides a robust, data-independent approach for securing the rapidly expanding network of EV infrastructure. Electric Vehicle Supply Equipment (EVSE) Machine Learning Operations (MLOps) Anomaly detection Network traffic classification Internet of Things (IoT) security Cyber-physical systems Full Text Additional Declarations No competing interests reported. Cite Share Download PDF Status: Posted Version 1 posted You are reading this latest preprint version Research Square lets you share your work early, gain feedback from the community, and start making changes to your manuscript prior to peer review in a journal. As a division of Research Square Company, we’re committed to making research communication faster, fairer, and more useful. We do this by developing innovative software and high quality services for the global research community. Our growing team is made up of researchers and industry professionals working together to solve the most critical problems facing scientific publishing. Also discoverable on Platform About Our Team In Review Editorial Policies Advisory Board Help Center Resources Author Services Accessibility API Access RSS feed Manage Cookie Preferences © Research Square 2026 | ISSN 2693-5015 (online) Privacy Policy Terms of Service Do Not Sell My Personal Information {"props":{"pageProps":{"initialData":{"identity":"rs-9177269","acceptedTermsAndConditions":true,"allowDirectSubmit":true,"archivedVersions":[],"articleType":"Research Article","associatedPublications":[],"authors":[{"id":629732509,"identity":"79a769f1-582e-4414-8d66-8ec2c1a43e42","order_by":0,"name":"Kosmas Lazaridis","email":"","orcid":"","institution":"Hellenic Open University","correspondingAuthor":false,"prefix":"","firstName":"Kosmas","middleName":"","lastName":"Lazaridis","suffix":""},{"id":629732521,"identity":"06818c47-7e15-4246-ac89-45a008720ca8","order_by":1,"name":"Ioannis Topouzelidis","email":"","orcid":"","institution":"Hellenic Open University","correspondingAuthor":false,"prefix":"","firstName":"Ioannis","middleName":"","lastName":"Topouzelidis","suffix":""},{"id":629732523,"identity":"ceec84af-a3fb-4026-b33e-6275198c9dbd","order_by":2,"name":"Ioannis Vagionas","email":"","orcid":"","institution":"Hellenic Open University","correspondingAuthor":false,"prefix":"","firstName":"Ioannis","middleName":"","lastName":"Vagionas","suffix":""},{"id":629732530,"identity":"0ed25acb-319b-4fdb-8216-8bea0f23fcc4","order_by":3,"name":"Alexios Lekidis","email":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAZAAAAAyAQMAAABI0h/eAAAABlBMVEX///8AAABVwtN+AAAACXBIWXMAAA7EAAAOxAGVKw4bAAAAvElEQVRIiWNgGAWjYDACdgZmhgQ2CQZ+BgY2IrUwQ7VINjCTogVkvsEBYrXwNzMfNnhQZmFvfCP/2AOGX/cIa5E4zJackHBOInHbjWR2A8a+YiKsOcxjfCCxTSLB7EYymwRjTwJhHfKH+T+DtNgbzyBWi8FhHuYEoBbGDRJALQw/iNBieJjN2ADklxlnHptJJDYQoUXuePNjyR9ldfb87YnPJD78IUILKkhsI1UHA8Mf0rWMglEwCkbB8AcAq3Iz0xcDaFAAAAAASUVORK5CYII=","orcid":"","institution":"University of Thessaly","correspondingAuthor":true,"prefix":"","firstName":"Alexios","middleName":"","lastName":"Lekidis","suffix":""}],"badges":[],"createdAt":"2026-03-20 09:23:59","currentVersionCode":1,"declarations":"","doi":"10.21203/rs.3.rs-9177269/v1","doiUrl":"https://doi.org/10.21203/rs.3.rs-9177269/v1","draftVersion":[],"editorialEvents":[],"editorialNote":"","failedWorkflow":false,"files":[{"id":108181152,"identity":"1bc9303b-0458-4256-9ff5-8b40f515e50f","added_by":"auto","created_at":"2026-04-30 08:57:55","extension":"pdf","order_by":1,"title":"","display":"","copyAsset":false,"role":"manuscript-pdf","size":1713927,"visible":true,"origin":"","legend":"","description":"","filename":"Submissionwithchanges.pdf","url":"https://assets-eu.researchsquare.com/files/rs-9177269/v1_covered_1068f309-da81-4c37-94b6-286fa71df624.pdf"}],"financialInterests":"No competing interests reported.","formattedTitle":"EVDetect: A framework for orchestrated and AI-powered detection of cyber-attacks in EV charging networks","fulltext":[],"fulltextSource":"","fullText":"","funders":[],"hasAdminPriorityOnWorkflow":false,"hasManuscriptDocX":false,"hasOptedInToPreprint":true,"hasPassedJournalQc":"","hasAnyPriority":false,"hideJournal":true,"highlight":"","institution":"","isAcceptedByJournal":false,"isAuthorSuppliedPdf":true,"isDeskRejected":"","isHiddenFromSearch":false,"isInQc":false,"isInWorkflow":false,"isPdf":true,"isPdfUpToDate":true,"isWithdrawnOrRetracted":false,"journal":{"display":true,"email":"[email protected]","identity":"researchsquare","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":true,"externalIdentity":"","sideBox":"","snPcode":"","submissionUrl":"/submission","title":"Research Square","twitterHandle":"researchsquare","acdcEnabled":true,"dfaEnabled":false,"editorialSystem":"","reportingPortfolio":"","inReviewEnabled":false,"inReviewRevisionsEnabled":true},"keywords":"Electric Vehicle Supply Equipment (EVSE), Machine Learning Operations (MLOps), Anomaly detection, Network traffic classification, Internet of Things (IoT) security, Cyber-physical systems ","lastPublishedDoi":"10.21203/rs.3.rs-9177269/v1","lastPublishedDoiUrl":"https://doi.org/10.21203/rs.3.rs-9177269/v1","license":{"name":"CC BY 4.0","url":"https://creativecommons.org/licenses/by/4.0/"},"manuscriptAbstract":"E-mobility has gained significant attention in recent years due to its contribution to reducing greenhouse gas emissions and the technological advancements introduced by digital interfaces. However, these interfaces also expose the grid to an expanded threat landscape, including attacks such as spoofing and Denial-of-Service. In this article, we propose EVDetect, a comprehensive anomaly detection framework capable of training and performing inference over various unsupervised and supervised Machine Learning (ML) models for detecting attacks in Electric Vehicle (EV) charging networks. Our methodology introduces a decoupled logging architecture that prevents logging noise and enables the retrospective use of historical models, ensuring full reproducibility for any tabular security dataset. Crucially, the method identifies the optimal model based on a trade-off between functional (i.e., F1-score) and non-functional (i.e., inference latency, memory footprint, CPU constraints) characteristics. The framework is validated on a widely adopted realistic dataset containing a diverse set of attacks (CICEVSE2024), using a newly developed library of both unsupervised and supervised models. Ultimately, this work provides a robust, data-independent approach for securing the rapidly expanding network of EV infrastructure.","manuscriptTitle":"EVDetect: A framework for orchestrated and AI-powered detection of cyber-attacks in EV charging networks","msid":"","msnumber":"","nonDraftVersions":[{"code":1,"date":"2026-04-27 12:35:05","doi":"10.21203/rs.3.rs-9177269/v1","editorialEvents":[{"type":"communityComments","content":0}],"status":"published","journal":{"display":true,"email":"[email protected]","identity":"researchsquare","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":true,"externalIdentity":"","sideBox":"","snPcode":"","submissionUrl":"/submission","title":"Research Square","twitterHandle":"researchsquare","acdcEnabled":true,"dfaEnabled":false,"editorialSystem":"","reportingPortfolio":"","inReviewEnabled":false,"inReviewRevisionsEnabled":true}}],"origin":"","ownerIdentity":"980aecbc-c4e5-435b-85a3-08d1b03652a6","owner":[],"postedDate":"April 27th, 2026","published":true,"recentEditorialEvents":[],"rejectedJournal":[],"revision":"","amendment":"","status":"posted","subjectAreas":[],"tags":[],"updatedAt":"2026-04-27T12:35:11+00:00","versionOfRecord":[],"versionCreatedAt":"2026-04-27 12:35:05","video":"","vorDoi":"","vorDoiUrl":"","workflowStages":[]},"version":"v1","identity":"rs-9177269","journalConfig":"researchsquare"},"__N_SSP":true},"page":"/article/[identity]/[[...version]]","query":{"redirect":"/article/rs-9177269","identity":"rs-9177269","version":["v1"]},"buildId":"XKTyCvWXoU3ODBz1xrDgd","isFallback":false,"isExperimentalCompile":false,"dynamicIds":[84888],"gssp":true,"scriptLoader":[]}