ML-based Multiclass Anomaly Detection System for Charge Profile Manipulation Attacks in EV Charging Ecosystem

The rapid growth of Electric Vehicles (EVs) requires expanded charging infrastructure, highlighting the need for a smart EV charging system. However, integrating more smart EV charging systems into existing power grids raises significant cyber-physical system (CPS) security concerns. This is due to interdependencies and reliance on protocols like the open charge point protocol (OCPP). This paper considers the security vulnerabilities in the latest version of OCPP 2.0.1, particularly focusing on communication between the central system (CS) and the EV charging stations (EVCS). We considered a charge profile manipulation attack (CPMA) that stealthily manipulates the charge profile of EV users, resulting in charging schedule disruptions. Large-scale CPMA manipulation alters the expected load distribution on the power grid, potentially shifting in peak demand. To address this, we propose an ML-based anomaly detection system (ML-MADS) that uses multiclass supervised learning to detect and classify different types of CPMAs. Proposed ML-MADS uses statistically derived features to develop machine learning models that effectively distinguish between normal operations and various types of CPMA. To ensure robustness and practical relevance, we considered real-world, open-source datasets (ACN-Caltech, Elaad NL) that offer diverse charging session data. The proposed ML-MADS achieves high detection and classification accuracy while minimizing false positives.