Anomaly detection with grid sentinel framework for electric vehicle charging stations in a smart grid environment

Abstract

Electric vehicle (EV) charging stations on the smart grid are needed to promote electric car adoption and sustainable transportation. The key issues are the lack of continuous monitoring and incident response, difficulty linking smart grid systems with EV charging stations, and security gaps that may not address particular vulnerabilities. Modern security measures are needed to protect the grid from those attacks, which may cause significant disruptions. Machine Learning Empowered Anomaly Detection with Grid Sentinel Framework (AD-GS) is proposed to safeguard electric car charging stations against intrusions. This technology can also detect and respond to suspicious movements dynamically using powerful machine learning algorithms (long short-term memory (LSTM), random forest, and autoencoder models), ensuring safety. The testing findings reveal that the systems are automatically updated to neutralize threats quickly, utilizing dynamic methods to minimize downtime. This method increases smart grid safety and can be applied beyond electric car charging stations. The AD-GS architecture is tested in simulations and shown to be resilient against extraordinary attacks, with no impact on charging station performance. The simulation showed that AD-GS could reduce downtime by implementing quick threat mitigation, improve smart grid response time efficiency by 98.4%, and detect abnormalities with 96.8% accuracy. This framework protects user and operation data 99.2% of the time. Extended AD-GS can monitor more than 500 stations and safeguard distribution networks, substations, and electric car charging stations.

Introduction

Installing innovative grid EV charging stations requires fixing several security issues. Thus, robust attack detection and mitigation are needed¹. While machine learning (ML) approaches provide promising answers, implementing them may be difficult.

1. Challenges in securing EV Charging Stations.

Sophisticated attack evasion: Attackers can use this range to execute elaborate attacks that mix with daily activities to avoid detection².

Scalability and efficiency: ML models that can swiftly analyze and respond to vast amounts of data from a charging station network must be green and scalable³.

Lack of High-Quality training data: The lack of complete, high-quality education datasets that accurately reflect all possible risks makes such models difficult to build⁴.

Continuous Model Updates: Since attackers improve their approaches, AI systems must be updated and retrained, which drains power⁵.

Low-Latency security response: Due to low deployment latency, the charging infrastructure must not pass via such techniques⁶.

Privacy and compliance issues: ML systems typically access personal user statistics, raising privacy and legal compliance difficulties; they operate gently⁷. ML offers excellent potential to protect smart grid EV charging points. People must address numerous complicated issues before developing effective, resilient safety responses⁸.

1. ML-based Security Solutions for EV Charging Networks.

Innovative grid EV charging station shielding uses artificial intelligence and device-learning knowledge to be more stable and resilient⁹. Cyber-assault signs in billing facts are found using anomaly detection methods, neural networks, and ML classifiers.

Anomaly detection methods Anomaly detection employs statistical methods or unsupervised learning to define standards and identify outliers¹⁰.

ML classifiers Choice undergrowth and SVM are trained on labelled datasets to identify safe and risky moves.

Deep learning (Neural networks, LSTMs) Deep learning improves detection accuracy by absorbing complicated spatial and temporal recording methods¹¹.

Fig. 1 [Images not available. See PDF.]

The architecture of the EV Charging Network.

Attacks on EV charging networks are shown in Fig. 1, and malicious charging sessions affect EVs, charging stations, and EV servers. Modification, interruption, interception, and interference are current issues with this topic. Future research should concentrate on authentication, backup, encryption, firewall security monitoring, user education, and standard-setting cooperation. The charging infrastructure for EVs will be safer and less susceptible to hacks when all of this is done. Existing infrastructure for charging PHEVs must adhere to rigorous cybersecurity regulations.

Large consultant datasets are scarce, making teaching and verifying reliable methods challenging. The expanding usage of smart grids and the Internet of Things (IoT) has had numerous beneficial and negative effects, including the susceptibility of essential infrastructure to cyberattacks. Distributed Denial-of-Service (DoS) attacks, data breaches, malware injections, and MitM attacks are among these cyberattacks. DDoS assaults overload network resources, while data breaches expose vital data. Injecting malware corrupts or controls equipment. Threats might cause electrical distribution loss, user privacy violations, and considerable financial and operational damage.

Several solutions have been developed to reduce these dangers. Anomaly detection systems and machine learning-based methods are essential because they constantly monitor the network data for cyberattacks. Advanced ML algorithms monitor EV charging stations for suspicious activity and act accordingly. The proposed method may quickly identify and eliminate smart grid security vulnerabilities by analysing data trends and outliers. The suggested method minimizes hazards to maintain EV charging stations and saves downtime. Effective and reliable security has improved. AD-GS can be utilized in distribution networks, substations, and smart meters beyond EV charging stations. Simulations of different attack scenarios demonstrate this framework’s robustness and low-performance effect.

The AD-GS framework introduces a machine learning-driven anomaly detection solution for smart grid electric car charging stations. This method beats rule-based security. Its powerful machine learning models (LSTM, Random Forest, SVM, and Autoencoders) provide over 95% detection accuracy, minimal false alarms, and response time efficiency.

Key Features of AD-GS:

• High Detection Accuracy- Achieves 96.8% accuracy with minimal False Positives.

• Scalability & Efficiency- Uses federated learning for decentralized security updates across EV charging networks.

• Low Latency Response- Operates within a sub-15ms response time to ensure seamless charging operations.

• Multi-Layered Security- Detects threats like DDoS, MitM, spoofing, and data manipulation.

• Energy-Efficient Implementation- Optimized AI algorithms reduce computational overhead, making AD-GS suitable for resource-constrained environments.

• Adaptive Security Intelligence- Dynamically updates detection models to counter evolving cybersecurity threats.

The main contributions of the article include:

• The AD-GS framework mitigates cyber threats at EV charging stations using powerful ML models (LSTM, Random Forest, SVM, and Autoencoders) with 96.8% detection accuracy, low false positive rates and sub-15ms latency.

• AD-GS is highly scalable and robust because it uses federated learning to dynamically update security protocols across many EV charging stations, substations, and distribution networks.

• Validated on real-world EV charging datasets with inserted DDoS, MitM, Spoofing, and Data Manipulation attacks, the framework is practical, resilient, and reliable for combating growing cybersecurity threats.

The remaining sections of the article discuss the related works. The Proposed Method section addresses the AD-GS methodology. The Results and Discussion section presents the findings and their interpretation, and the Conclusion section gives a summary and final suggestions.

Related works

The smart grid generation and EV ecosystems have highlighted the need for cybersecurity for an organization’s reliability and stability. Researchers have studied artificial intelligence and machine learning-based solutions to improve EV charging network safety, energy delivery, and security risks.

1. Machine Learning and Cybersecurity in EV Charging Stations (EVCS).

Using accurate records from IoT site visitors, ElKashlan et al.¹² offer a machine mastering-based totally classifier algorithm ML-CA classification approach for identifying dangerous traffic in IoT settings. Results for multiclass and binary methods have been produced by comparing several strategies. The setup makes EV charging stations extra steady and much less at risk of cyberattacks. IoT-based electric-powered vehicle charging stations may be prone to denial of service (DDoS) attacks, in step with ElKashlan et al.¹³, who endorse enforcing system mastering classifier algorithms (MLCA) to discover such threats. The studies safeguard the EVCS surroundings and guarantee chronic operation by evaluating several algorithms on actual IoT traffic records; this improves the stability of the EVCS machine and significantly decreases cyberattacks.

To counter cyberattacks that affect the value of EV charging, Akbarian et al.¹⁴ offered a Two-stage framework (T-SF) that employs ML techniques, such as SVM, RF, and MLP to detect attacks with a success rate of 98%, by modelling the interactions between attackers and EV control centres as a bi-level optimization issue.

1. Smart Grids, AI, and Energy Optimization.

The ability to better manage and secure frameworks is investigated by Mazhar et al.¹⁵ through the integration of smart grids, artificial intelligence, and the IoT. The article¹⁵ delves into energy demand forecasting using ML methods (MLM), the role of the IoT in smart grids, and the use of smart meters to gather real-time data. Energy efficiency and occupant comfort are two areas that MLM hopes to address.

With an emphasis on authentication, intrusion detection, and attack prevention, Mohamed N et al.¹⁶ conducted a thorough analysis of the use of AI and ML in EV information security. According to the findings, neural networks (15%) and deep learning (70%) are widely used. More and more people are considering improving security by integrating blockchain with AI and ML.

1. Intrusion Detection Systems and Cybersecurity in Smart Grids.

Focusing on security vulnerabilities in power components, dataset creation, ML-based intrusion detection system (ML-IDS) types, assessment metrics, and testbeds, Sahani N et al.¹⁷ review ML-IDS applications in smart grids. Because innovative grid ecosystems are particularly vulnerable, their study offers insights, lessons gained, and recommendations for future research that will help address this issue.

Tufail investigates cybersecurity risks and vulnerabilities in smart grids (CT & VSG), S. et al.¹⁸, emphasizing safeguarding availability, integrity, and confidentiality. It improves the security and resilience of smart grid networks against cyberattacks by analysing customer, communication, and management risks and presenting security solutions and approaches to reduce them. In a report by Guato Burgos, M. F. et al. on AI-AD in smart grids from 2011 to 2023¹⁹, a hybrid detection framework was developed, and it identified seven important anomalies. The pervasive usage of ML and other sophisticated AI technologies is highlighted. The study highlights the importance of solutions that do not rely on statistics.

Omitaomu reviews smart grid applications of artificial intelligence (AI-SG), O. A. et al.,²⁰ focusing on security, defect detection, load forecasting, and grid stability evaluation. Ultimately, it advances the development of fully intelligent grid systems by showcasing AI’s capabilities to increase resilience and reliability, resolving research obstacles, and identifying opportunities to improve smart grid operations using AI.

1. AI-Based Security and Anomaly Detection in Energy Networks.

Improve the smart grid’s efficiency by addressing dynamic properties and detecting real-time threats with the use of LSTM and RNN models developed by Sulaiman A et al.²¹ to optimize the tasks of those who own energy data; it presents a federated learning approach for safe power data sharing. Results from comprehensive simulations demonstrate fast FDIA identification, enhanced local model quality, and decreased task latencies.

A new wave of smart transportation research explores renewable energy sources to support the automobile industry’s AEV transition. AEVs may become sensor-driven, autonomous vehicles using AI in IoV ecosystems examined by Dixit et al.²². Electric cars may reduce environmental effects by sharing energy with other EVs, smart grids, and roadside infrastructure. Environmentally friendly modes of transportation are being backed. Security and privacy risks exist since sensors, energy units, and users send data across open channels.

In an IoV scenario, AEVs are susceptible to remote control and malicious actors sending deceptive updates to their peers. This may cause component failure, congestion, and IoV network failure. Researchers and security specialists worldwide have addressed security demands, but identifying and categorizing malicious AEVs remains a hot topic. Malicious AEVs behave differently from conventional AEVs; hence, Li et al. must detect and classified²³. The review covers AI methods for AEV anomaly detection based on the data mentioned before. Current survey research gaps inform AI-based anomaly detection evaluation criteria and a solution taxonomy. An anomaly classification example employing a weighted ensemble approach is shown, and AI deployment issues are examined. The recommended research aims to assist academics, practitioners, and AI manufacturers in building more accurate outlier detection approaches.

1. Bi-LSTM and Advanced ML-Based Anomaly Detection.

Hussain et al.²⁴ suggested a Bi-LSTM network-based data-driven anomaly detection (DDAD) method. The four passive parameters—voltage, current, frequency, and system on a chip (SoC)— derive seven statistical characteristics. The wrapper feature selection approach is employed to further the suggested DDAD model’s accuracy and determine the most significant characteristics. By using an enhanced API that relates to RT-LAB, the creation of a dataset that incorporates both common occurrences, such as line failures, load switching, and capacitor switching, as well as cyberattack events, such as DoS, spoofing, replay, and data manipulation assaults, may be automated. A Hardware-in-Loop (HIL) based intelligent Cyber Physical System (iCPS) testbed environment has been employed to present the DDAD model on an EVCS microgrid model that included DERs.

In charge manipulation attacks (CMAs), the author investigated how an attacker could modify the data sent and received during smart charging activities to target electric vehicle charging. CMAs aim to change the demand for the EV aggregator at different times of the day. Current security measures in EV communication protocols can be overcome by the suggested CMAs²⁵. They simulate CMAs’ involvement in the day-ahead (DA) and real-time (RT) electricity markets to assess their effect on the economic profit of the EV aggregator. Lastly, they suggest a method that uses unsupervised deep learning to identify CMAs by maintaining an eye on the variables related to electric vehicle charging. Using real-world EV charging datasets, they thoroughly examine the effects of CMAs and the effectiveness of the suggested detection.

1. Secure Energy Distribution and Smart Grid Converters.

Narasipuram et al.²⁶ discuss an enhanced L2C converter called an iL2C (interleaved inductor-inductor-capacitor) converter that uses the dual primary side concept for battery charging applications with a wide range of input voltages. The VFPSM hybrid controller architecture is also introduced. This research focuses on the converter’s steady-state and transient performance under half load (1.65 kW of 3.3 kW). The converter’s dynamic performance for 500 Vin to 300 Vin − 300 Vin to 500 Vin at 48 V0 is simulated at 400 Vin and 48 V0, respectively.

Table 1. Summary of related works.

Author(s)	Method	Key Features	Advantages	Limitations
ElKashlan et al. 12	ML-CA classification approach	IoT traffic-based classifier for EV charging station security	Enhances cybersecurity, reduces DDoS risks	Effectiveness in large-scale IoT networks has not explored
ElKashlan et al.13	MLCA for DDoS detection	Identifies cyber threats in EVCS	Ensures stable EVCS operation	Dependence on dataset quality
Akbarian et al.14	Two-stage framework (T-SF) with ML (SVM, RF, MLP)	Attack detection with 98% accuracy	Models’ attacker-EV control centre interactions	Generalization to evolving threats not addressed
Mazhar et al.15	ML methods for energy forecasting	IoT-integrated smart grids for energy optimization	Enhances energy efficiency and occupant comfort	Requires real-world deployment validation
Mohamed N et al.16	AI & ML in EV security	Focuses on authentication, intrusion detection, and blockchain integration	Strong security approach using deep learning (70%)	Blockchain integration challenges are not detailed
Sahani N et al.17	ML-IDS applications	Review intrusion detection in smart grids	Identifies research gaps and future directions	Lacks practical deployment analysis
Tufail S et al.18	Cybersecurity analysis in smart grids	Examines risks in customer communication & management	Provides mitigation strategies for smart grid threats	No implementation of proposed solutions
Guato Burgos et al.19	Hybrid AI-based anomaly detection	Identifies seven key anomalies in smart grids	Highlights the importance of AI over statistical models	Lacks validation against real-world cyberattacks
Omitaomu O. A. et al.20	AI in smart grids	Security, defect detection, load forecasting, and grid stability	Enhances resilience & reliability	It does not specify AI deployment hurdles
Sulaiman A et al.21	LSTM & RNN models for power data security	Federated learning for safe power-sharing	Real-time threat detection & fast FDIA identification	Model scalability for large networks is unclear
Dixit et al.22	AI for Autonomous EVs (AEVs)	AI-driven smart transportation and energy sharing	Supports sustainable EV transition	High-security risks in data exchange
Li et al.23	AI-based anomaly detection for IoV	Evaluate security vulnerabilities in AEVs	Highlights security threats and anomaly classification	Limited discussion on countermeasures
Hussain et al.24	Bi-LSTM for anomaly detection	It uses voltage, current, frequency, and SoC data	Automates dataset generation with RT-LAB	Requires extensive training for high accuracy
CMAs Study25	Deep learning for Charge Manipulation Attack detection	Assesses impact on DA & RT electricity markets	Real-world EV charging dataset validation	Defence mechanisms for evolving CMAs have not been explored
Narasipuram et al.26	iL2C converter with VFPSM hybrid controller	Enhanced battery charging with a wide voltage range	Improves efficiency & dynamic performance	Performance under real-world conditions not tested
AEV Security Study27	AI-based anomaly detection	Identifies & classifies malicious AEVs	Weighted ensemble approach for accuracy	Lacks real-world deployment testing

Using artificial intelligence and ML techniques, Table 1 summarises the various ways various authors have taken to improve the safety, efficiency, and resilience of smart grids and EV charging stations.

Limitations of existing works

Anomaly identification in smart grid scenarios, including EV charging stations, has historically benefited from several significant limitations. It is possible that many existing techniques, such as simple statistical methods or outdated rule-based systems, are unable to identify sophisticated cyber threats. There is a greater probability of undetected abnormalities or false alarms as these methods fail to adjust to new or unknown attack patterns.

This paper analyses the most up-to-date cybersecurity research trends about intelligent grids and EV ecosystems. Research has shown that ML-based approaches, like AD-GS, are superior to more conventional ways of detecting and reducing cyber risks. Researchers have shown that advanced ML algorithms may significantly improve the system’s stability, robustness, and operational efficiency.

Proposed method

A web of software, hardware, communication protocols, and electric car charging stations forms the backbone of the smart grid’s cyber-physical system. Electric vehicles may have grid electricity sent to them via a charging infrastructure. An efficient power grid linked using AI and ML methods is necessary for charging EVs. Because they draw electricity from the grid, EVCS endanger the stability and dependability of the power system. For the ecosystem’s dependability and security, it is crucial that all data sent between the user app, EV, and EVCS be transmitted securely.

1. Attack Analysis.

Fig. 2 [Images not available. See PDF.]

Cybersecurity Vulnerabilities in EV Charging Stations.

Figure 2 examines the Cybersecurity Vulnerabilities in EV charging Stations. Smart grid electric vehicle charging stations’ interconnection, digital communication, and integration into key infrastructure make them vulnerable to cybersecurity attacks. The Major concerns are:

1. Electric vehicle charging stations’ protocols expose users to eavesdropping, data manipulation, and Man-in-the-Middle attacks, threatening internet connectivity. OCPP and IEC 61,850 are examples.

2. Spoofing, replay attacks, and illegal remote access are possible due to poorly specified authentication protocols. Weak or default passwords increase risk.

3. Security flaws in software and firmware allow hackers to install malware and open backdoors. Unpatched station software vulnerabilities might let an attacker take control.

4. Hackers may create service disruptions and grid instability by overloading charging stations with requests.

5. By manipulating consumption records or charging demand data, intruders may steal power or disrupt the system.

6. The lack of physical protection makes many charging stations vulnerable to theft, manipulation, and USB virus injections.

7. Supply chain issues may impact electric vehicle charging. Some hazards include employing untested gear or dealing with dishonest sellers.

AI-driven encryption, multi-factor authentication, and dynamic anomaly detection protect EV charging infrastructure with the Grid Sentinel Framework.

Types of attacks in EV charging stations

Fig. 3 [Images not available. See PDF.]

Man-in-the-middle (MitM) attackers hack EV charging stations.

As seen here, in Fig. 3, MitM attackers hack EV charging stations. An attacker first intercepts the electric car’s charging station data stream. The perpetrator then intercepts data packets to steal private information. After intercepting data, the attacker alters it. This may affect billing or security. A hacker injecting malicious data during data injection might cause unlawful financial transactions. Finally, changing data might harm the vehicle’s battery. Due to this, electric vehicle smart grid infrastructure must emphasize secure communication protocols and dynamic anomaly detection.

Fig. 4 [Images not available. See PDF.]

Analyzing Causes of DoS Attacks on EV Charging Stations.

Figure 4 describes a DoS attack on an electric car charging station and its effects. Low bandwidth and too many requests cause communication channel congestion, preventing the system from processing genuine change requests. Attackers may exhaust a system’s processing power by flooding the network with phony data and access requests. Due to overburdening, the charging infrastructure cannot handle genuine transactions. Customers experience service outages and lengthy charging station queues due to these attacks. The interruption may cause unexpected energy consumption fluctuations that affect users and the smart grid. Traffic filtering, AI-enabled anomaly detection, and access control are necessary for reliable EVCS.

Fig. 5 [Images not available. See PDF.]

False Data Injection in EV Charging Station.

A power grid attack by an FDI is shown in Fig. 5. Hackers alter data by modifying sensor readings, transmission connections, or software before introducing false information into the grid. When the system misinterprets data, it jeopardizes grid operations and makes load balancing and power distribution hard. Misleading Decision-Making follows, in which automated energy management systems and control centres use skewed data to make the wrong operational changes. Power surges, overloads, and blackouts are all symptoms of grid instability. Consumers and service providers may suffer monetary losses due to these disturbances, manifesting as unpredictable electric car charging, price increases, and other problems. Strong cybersecurity measures are necessary to protect grid operations against FDI assaults.

Fig. 6 [Images not available. See PDF.]

Vulnerabilities and Mitigation in Charging Stations.

Figure 6 shows charging station vulnerabilities, attacker techniques, impacts, and mitigating options. Insufficient authentication, old firmware, and unpatched software are primary charging station security vulnerabilities. These vulnerabilities may be exploited to compromise the system. These vulnerabilities may cause unauthorized access, system compromise, and data breaches, disrupting operations and costing money. Strong authentication, timely security updates, and frequent software upgrades may mitigate these risks. These safeguards will enable charging stations to securely and reliably serve electric car customers.

Strong protections are needed when smart grid technology integrates with electric vehicle infrastructure, creating new cybersecurity concerns. Complex software defect assaults may damage electric vehicle smart grids. Adaptive hackers utilize AI and machine learning to hide. Grid Sentinel Framework models learn to discover and stop new assaults via adversarial training. Risky firmware vulnerabilities are growing. These attacks target electric vehicle charging stations to compromise software updates and install backdoors. Anomaly detection and cryptographic integrity verification ensure firmware validity in the Grid Sentinel Framework. The framework continuously observes system behaviour without third-party verification tools to identify suspicious firmware upgrades and prevent unwanted alterations. Our solution protects the supply chain to lessen the risk of smart grid security hacking.

Another emerging concern is hacking internet-connected charging stations to damage energy infrastructure or services. Grid Sentinel Framework uses authentication and zero-trust architecture to restrict network access to verified devices. Anomaly detection in AI increases security by detecting unauthorized command executions. Dirty load balancing takes power unnoticed by manipulating load demand statistics. The Grid Sentinel Framework secures energy transactions using load certification and anomaly detection. Last-stage secret grid attacks change grid parameters to endanger grid stability. These disturbances accrue and fade over time, unlike abrupt attacks. The Grid Sentinel Framework uses predictive analytics and long-term pattern recognition to detect even small operational parameter changes to stabilize the grid. The Grid Sentinel Framework monitors abnormalities, mitigates risks, and responds to emerging cyber threats to defend electric car smart grids. This strategy prioritizes smart grid infrastructure dependability, stability, and safety as energy becomes digital.

1. Cyber-threat Model.

Fig. 7 [Images not available. See PDF.]

Cyber-Threat Model.

Figure 7 illustrates the potential entry points for cyberattacks as well as the preventative steps that are taken to prevent the spread of these assaults inside the smart grid network that is utilized for electric cars. The structure, attack surface, entry points, cyber-attack propagation, and defensive mechanisms are the four basic components of the structure.

Attacks can be launched against critical EV network nodes. These nodes include charging stations, communication networks, and management systems housed in the cloud. As shown in the section on attacker access points, attackers might compromise these components via public electric vehicle charging stations, network eavesdropping, or vulnerabilities in cloud application programming interfaces (APIs). As shown in the section on the propagation of cyberattacks, once a breach has occurred, the criminals may alter data, disrupt system operations, and eventually affect electric vehicle customers by causing service failures and financial losses.

These attacks are repelled by the Grid Sentinel Framework, which employs a protection system that consists of many levels. Using anomaly detection powered by artificial intelligence may spot suspicious behaviour, end-to-end encryption can secure data, and dynamic monitoring can keep one step ahead of any threats. By taking these safeguards, which reduce the likelihood of cyberattacks while preserving the reliability of operations, a smart grid for electric cars that is both secure and dependable may be guaranteed. Modern technology is integrated into the Smart Grid System to make energy distribution networks more efficient and secure. The heart of it all is intrusion detection algorithms that use AI and ML to find and stop any dangers to the network. To identify abnormalities dynamically, these algorithms constantly scan data streams from Meter and Sensor devices. Robust Communication Networks allow EV Charging Stations to be easily linked to the grid, allowing for effective electricity control. These stations maximize energy efficiency while catering to the increasing demand for electric cars. An essential part is the training and optimization of AI/ML models, which improve algorithms using insights from regular data. The responsiveness and resilience of the grid are improved via this iterative approach. Analyzing and processing data is shown in Fig. 8; engines expeditiously provide valuable insights to enhance the system. A centralized control centre may coordinate rapid responses to possible threats using intrusion alert notification and response systems. The Smart Grid System essentially showcases a collaborative strategy using cutting-edge technology to guarantee contemporary energy distribution networks’ dependability, safety, and longevity. Table 2 shows the Symbol Description.

Table 2

Symbol description.

Term	Description
	Operational metric
	sensitivity coefficient
	Anomaly indicator
	Variance
	external influence factor
	The composite metric of variance
	Security protocol
	Response mechanism
	Proactive measure
	Reaction
	Reactive variable
	Additional contextual factors
	External conditions
	Response metric
	External factors
	Protective measure
	Matrix operation
	Normalised summation
	Minimum threshold
	Maximum security threshold
	scaling factor
	External factor
	Aggregated impact
	Operational metric
	The scaling factor, used for normalizing different metrics
	Aggregated impact
	Response metric
	Security protocol

In Fig. 8, the proposed system shows the key hub, the EV Charging Station, which distributes electricity securely. Chargers may connect to the smart grid’s central control centre and other nodes via a network. The communication network sends sensor and meter data to monitor the voltage, energy usage, and cybersecurity risks. An AI-ML Intrusion Detection Algorithm analyzes charging station data to ensure safety. It can detect data modification assaults, DDoS attacks, spoofing, and other irregularities. By assessing discovered hazards, AI/ML Model Training and Optimization activities improve the system’s ability to predict and prevent breaches. The Intrusion Mitigation Mechanism and Intrusion Alert Notification & Response Systems go into action after an intrusion. Response systems isolate affected components, inform administrators, and adjust security processes when triggered.

Fig. 8 [Images not available. See PDF.]

Proposed Block Diagram of EV Charging Stations in Smart Grid using Grid Sentinel Framework.

For immediate detection and reaction, dynamic data analysis is essential. It boosts system performance, security, and energy management. The technology is also connected to the Smart Grid technology, which assures electricity distribution grid stability and cybersecurity. Combining AI and ML technologies ensures a cyber-resilient and sustainable energy environment. These technologies make smart EV charging infrastructures safer, more reliable, and more efficient. Comprehensive security preparation is the most important dependent variable; it is affected by a few things. The first line of defence consists of proactive measures and how effectively they work in different situations. Environmental factors and other system variables influence these preventative measures, which may strengthen or undermine the security posture. How it reacts to anomalies greatly affects the system’s flexibility and robustness. Finally, the security is enhanced by hazard countermeasures. The entire security posture of the smart grid’s electric car charging stations is impacted by several elements, including proactive measures, external conditions, and reactive techniques. The interplay between these variables reveals the relative importance of various elements. The equations that describe these dynamics are easier to comprehend if this connection has been established.

1

Equation (1) is a mathematical statement that describes feature representation and anomaly detection of some connection or model with parameters represented by . Using dynamic detection of anomalies with AD-GS is the crux of the proposed method for security detection and coping in EV charging points using AI and ML techniques . is the current or any other operational indicator tracked, whereas the factor kα is a learning parameter representing the model’s sensitivity to changes. is represents the standard deviation or some other variance metrics associated with the distribution of values observed, such as charging times or energy consumption. Abnormal behavior is indicated by differences from the mean beyond a given point, where is a threshold for anomaly identification.

2

Potentially impacted by variables denoted in Eq. (2), operational settings ( ), security protocols ( ), and response mechanisms ( ), the Equation might symbolically depict the equilibrium between system vulnerabilities ( ) and protective measures ( ). represents the standard deviation or other variance metrics associated with the distribution of values that could have been observed, such as charging times or energy consumption. One possible use of the equation is to assess the current state of security at EV charging stations. It considers security protocols, external effects, response mechanisms, and system weaknesses to forecast outliers and counteract cyber-attacks. The equation aids in the dynamic identification of security breaches and the resilience of the smart grid infrastructure against cyber-attacks by utilizing machine learning techniques. Abnormal behaviour is indicated by differences from the mean beyond a given point, where is a threshold for anomaly identification.

3

The function that evaluates the entire security posture according to variables such as system resiliency ( ), proactive measures ( ), and reactions to identified anomalies ( ), might be represented by the Eq. (3), . The variables may represent extra elements such as environmental conditions or reactions to threats. By combining system resilience, preventative measures, and reactive measures to recognize threats, Eq. (3) depicts the security posture of an EV charging station, which corresponds to the function of predictive modelling and system resilience. The equation also considers external and environmental variables like weather and load changes. It depicts the system’s stability-preserving mechanisms, which provide strong security in a smart grid setting by combining preventative measures with immediate responses to anomalies.

4

The state of security preparedness, denoted by Eq. (4) as { }, is affected by proactive measures ( ), reactions to identified anomalies ( ), and mitigating factors . Ensuring the resilience and safety of EV charging stations inside the smart grid is the goal of the technique, which employs (AD-GS) to monitor and react to possible threats continually . The preparedness of electric vehicle charging stations in a smart grid for security is represented by Eq. (4), which considers proactive measures, responses to recognized threats, and mitigating variables.

5

Fig. 9 [Images not available. See PDF.]

Communication Infrastructure of EV Charging System.

Figure 9 examines the communication infrastructure of the EV charging System. The Power Grid is responsible for supplying power to charging stations that are either public or private. An EV Charging Network Operations Centre monitors these stations to ensure that electric cars get the best possible charging performance. In addition to ensuring that charging stations are available and monitoring charging activities, the network must maintain a continual flow of data on power distribution and the system’s condition. Additional responsibilities include monitoring charging activities.

The Electric Vehicle Charging Network Operations Centre is responsible for collecting and processing data on the availability of charging stations (CS) and information regarding scheduling and charging session details. This centre can enhance decision-making and the user experience by connecting to a Service Provider Network or the Internet. This allows for remote access, data management, and cloud-based analytics, all of which are accomplished via the use of software.

In addition, the system keeps a record of information that is individual to the user, which guarantees that the user will have access to billing services that are both customized and safe. To meet the fluctuating demand for energy, residential and public charging stations directly connected to the power grid can facilitate energy distribution. Keeping the flow of power going and preventing grid overload may be accomplished by optimizing charging schedules for the network.

By integrating grid connections, service provider networks, and dynamic operations management, the framework improves the efficiency and reliability of charging electric cars while simultaneously opening the road for future smart grid enhancements to be scaled up. Everything from EVs to charging stations, service providers, and the power grid makes up the EVCS. The charging data is stored via their communication along the network (Fig. 9). The service provider records each electric vehicle’s time and energy consumption via their connections to the operator network. Further, the service provider checks charging station availability so they may connect to EVs, obtain payment-related user data, and properly plan EV trips. Researchers have discovered security flaws in EVCS and other network interactions, including cloud services. The evaluations and weaknesses of EVCS security are explained in the use case for the interface type. Electric vehicle charging systems could be vulnerable in several ways. EV connections, user terminals, Internet access, and maintenance terminals are covered. Operators, or EVCS providers, provide increased services and convenience with Internet connections integrated into current EVCSs. However, the security concerns that come with this interconnectedness must be acknowledged. Attackers may get access to the charging infrastructure and perhaps conduct more extensive assaults on key infrastructure if they breach the EVCSs.

In Eq. (5), the represents the measure of overall security status, which is affected by things the inverse of a matrix modulated by activities on data streams ( ), extra precautions ( ), and factors influencing the stability of the system ( ).

6

Evaluating system security may be represented by Eq. (6), , which is affected by elements such as the environment ( ), models of prediction ( ), and reactions to identified anomalies ( ).

Equation (6) evaluates system security using historical anomaly responses, ambient variables, and predicted anomaly detection. Equation (7) uses machine learning to improve threat mitigation approaches based on this review. Future anomaly detection in Eq. (6) is affected by Eq. (7)’s continual security policy updates. Developing EV charging infrastructure protection creates a continuous feedback loop where dynamic anomaly detection informs adaptive mitigation.

7

Factors such as the reverse of a matrix modulated by calculations on data streams , further safety precautions Report Phrase ( ), and potentially environmental or operational variables ( ) are likely to impact Eq. (7) as a metric for evaluating security status.

8

A composite metric that evaluates the security posture, affected by variables like computation outputs ( ) and data streams , might be represented by Eq. (8), . The use of expressions such as ( ) implies the presence of further factors that impact the evaluation of security.

Fig. 10 [Images not available. See PDF.]

EV Charging Event in Grid Sentinel Framework.

Figure 10 deliberates the EV charging event in the Grid Sentinel Framework. The information gathered during the charging event includes details on the charging transactions, the energy used, and the system’s behaviour. Performing preprocessing and feature selection on this data might benefit anomaly detection. This would allow for an improvement in accuracy while reducing the amount of computing complexity involved.

To identify irregularities, the system mainly makes use of two models:

• It is important to model the system based on physical laws and behaviours already known to exist to identify anomalous charge patterns.

• Recognizes possible risks or outliers adaptively by learning normal and unexpected patterns from past data; this model is an ML-trained model.

Both models are used by the Anomaly Detection Algorithm, which is the algorithm that judges whether the data is normal or abnormal. If a charging event is typical, the ADS (Anomaly Detection System) continue functioning without interruptions. However, if the system identifies something that is not typical, a mechanism responsible for event categorization and reaction will be engaged. Threats such as cyber-attacks, illegal access, or charging stations that are not operating properly are all possible dangers, which will define how to protect against them.

This technology improves the effectiveness, dependability, and safety of electric vehicle charging networks, a crucial component of smart grid security. It guarantees continuous monitoring, early threat detection, and automatic reaction mechanisms. For instance, in Fig. 10, notifications might be triggered by unusual power consumption spikes or irregular electricity usage patterns to minimize risks and maintain continuous services. With time, these algorithms can learn and become more accurate through the Grid Sentinel Framework, which improves precision and efficiency in ensuring the stability and reliability of the grid. The security and effectiveness of such smart grid infrastructures for sustainable energy management for future mobility requirements depend heavily on anomaly detection algorithms regarding the efficiency of EV charging events.

9

Based on factors like operational parameters ( ), constraints including their full potential ( ) and minimum operational specifications ( ), and the variable’s minimum and maximum thresholds ( )), the Eq. (9), is probably a metric that evaluates system conditions.

10

It is probable that the system parameters and impact the Eqs. (10), and , which represents the maximum power and minimal function requirements , respectively. The symbols at the end of the sentence denote the maximum permissible velocities. and maximum acceptable security, respectively.

11

Calculated as the sum of variances [ ] and a multiplicative factor ( ) affecting parameters , the Eq. (11), might represent an aggregated metric that evaluates system performance or security. The presence of 100% implies an abnormality threshold or scaling factor.

12

The sum of many elements, including parameters of operation and limitations represented by 100%, is probably represented by Eq. (12), is used to evaluate the system conditions . The method’s goal is to use ML techniques to monitor the system’s dynamic dependencies and connections . These parameters represent that goal.

13

The normalized squared differences are used to standardize the variables, assessments from the past ( ), and prediction models ) into the metric represented by Eq. (13) . This is similar in that the technique uses AD-GS, which stands for dynamic anomaly detection and ML , to watch for and deal with any dangers that may arise. Equation (13) appears to be a weighted system evaluation metric for analyzing EV charging infrastructure anomalies or performance swings. Harmonizing previous patterns, predictive modelling, and deviation management suggests its use in ML-based anomaly detection optimization, abnormality detection, and system behaviour prediction.

Possible methods for improving the charging infrastructure’s security may be found by investigating centralized or distributed cloud services.

14

The probable aggregated metric for evaluating system conditions is given by Eq. (14), . This metric is calculated by combining various factors , including departures from expected values ( ), adjustments due to external or environmental influences ( ), and squared variations , normalized by a factor . It is determined by adding out all the potential outcomes and multiplying them by the corresponding probabilities. This is done by listing all the potential outcomes and their corresponding probabilities for discrete variables or by integrating the product of the variable and its probability density function across all the possible values for continuous variables.

15

The term reflect environmental or operational impacts, and the variables affect the outcome metric represented by Eq. (15), . Suggesting an increase in scale or limit for abnormal situations, an improvement of 100% is made possible .

16

Equation (16), shows an improved metric or state that is affected by multiple factors: , which is a baseline factor; , which is a modulating term depending on system conditions: , , and , which are probably additional parameters impacting the system state, and , which show further adjustments depending on system dynamics for Detection Accuracy Analysis.

17

The variable represents Response Time Analysis, a result or condition affected by factors the inverse relationship between , which affects the system’s behavior and changes depending on ; the inverse relationship involving ; an inverse term and extra variables .

18

Multiple factors impact the metric Scalability Analysis represented by Eq. (18) These include the following: the normalized cumulative impact of over a range of , an additive term reflecting more system dynamics, the squared impact of , which may represent a complex interaction or response mechanism, and , indicates further adjustments based on system variables. The equation includes operational and predictive data and is presumably an EV charging infrastructure EE or security evaluation function. Its main uses are assessing system performance, identifying security threats, and fine-tuning prediction models using prior data, present changes, and external effects.

Attack from Physical Sources: Because EVCSs don’t have any physical security, they may be easily disabled, their power may be stolen, or they may be infected with malware via USB ports. An attacker may get logical access to the system and compromise the EVCSs in a logical assault by taking advantage of a firmware vulnerability. Attackers might obtain firmware updates from vendors like Schneider Electric and analyze them for security vulnerabilities and entry points. Additionally, a local assault by Kaspersky Labs might breach the firmware of the Charge Point home charger. Attackers might access the EVCSs via the Local Area Networks (LANs) at charging stations in a partially controlled remote assault²⁷. Standard features of such systems include insufficient authentication and antiquated encryption techniques. Attacks may easily penetrate the system because of the protocols used for communication between EVs and EVCSs over the charging connection. Users of EVs engage with the EV management system via an internet user interface, allowing for fully controlled remote attacks. Whether a website or a mobile app, this engagement may lead to security holes. Professionals in the field of cybersecurity identify possible weak spots and devise countermeasures by studying the settings utilized for EV charging.

19

The output (A), which has the function modified by and the sum of the terms are two components that are likely to influence the aggregate measure . The latter represents the Impact on Charging Station Performance Analysis with the cumulative impact of different system states or variables .

20

This computed metric is probably affected by the following: the negative total over q indexed by , which involves ; the logarithmic term , which is a scaling or normalization factor; the effect of , which reflects systemic interactions or responses; and , which adds additional weighted effects to Data Protection Analysis. Table 3 explains the algorithm to detect anomalies in EV charging stations using various ML methods, combining their results to decide and act if an anomaly is detected.

The AD-GS technology in Smart Grid Systems improves efficiency and security with the help of intrusion detection algorithms powered by the Grid Sentinel Framework. To identify and prevent problems with EV charging events as soon as they happen, these algorithms monitor data streams from meters and sensors regularly. With the help of reliable communication networks, EV charging stations can operate in tandem with the grid to optimize energy use and keep up with rising demand. Grid responsiveness and robustness are enhanced by the training and optimization of AI/ML models, which gradually increase algorithm accuracy. Cybersecurity vulnerabilities in EV Charging Systems underscore the need to implement rigorous safeguards to prevent dangers and guarantee continuous operation. To ensure that EV charging infrastructures are adequately protected, future studies should concentrate on raising the bar for authentication, encryption, and general infrastructure security requirements.

Table 3

Algorithm for Real-time anomaly detection.

Real-Time Anomaly Detection with Grid Sentinel Framework

Figure 11 shows how the AD-GS architecture uses dynamic anomaly detection to ensure operational integrity and cybersecurity in electric vehicle charging stations. Then, real-time data from charging stations for electric vehicles is gathered after the preprocessing and feature extraction performed to normalize the input. Once the processed data has been processed, a machine learning-based anomaly detection engine operates on the processed information. Will an anomaly be found, the system classifies a threat, applies appropriate mitigating measures, and accesses the occurrence. The final stages of the process include model retraining and system updates, which are required to react to developing threats. Its closed-loop design ensures that the system keeps learning from its recognized events, hence enabling researchers to recreate, monitor, and improve the framework under constant testing conditions. The AD-GS architecture additionally demonstrates its durability and usefulness in the context of safeguarding present electric vehicle charging systems. With this iterative framework, simulated attack scenarios and assessment of detection responses help accomplish it.

Fig. 11 [Images not available. See PDF.]

Flow chart representation of the proposed model.

1. Evaluation Strategy for AD-GS.

The design of the AD-GS has been successfully evaluated by utilizing data from actual electric vehicle charging in the real world and simulated cyberattack situations. To guarantee the safety and dependability of charging stations for electric vehicles, the system that has been presented can identify and defend against a wide range of threats, including distributed denial of service (DDoS) assaults, data manipulation, spoofing, and MitM attacks.

To evaluate AD-GS, the following performance metrics are analyzed:

1. Detection Accuracy – Measures the percentage of correctly identified anomalies and normal activities.

2. False Positive Rate (FPR) – Assesses the system’s tendency to misclassify benign events as attacks.

3. Response Time Efficiency – Examines the latency in detecting and mitigating cyber threats.

4. Computational Overhead – Evaluate the resource consumption required for anomaly detection.

In addition, the AD-GS design is tested for various attack intensities and operating settings to guarantee its effectiveness, scalability, and durability. The next section summarises the findings of the tests, which demonstrate that the system has the potential to improve the cybersecurity of electric vehicle charging stations while maintaining a low latency and a high level of detection accuracy.

Results and discussion

Critical response capabilities require low-latency technologies like streaming analytics and lightweight ML models. With the help of federated learning and scalable infrastructures, adaptability is crucial for dealing with ever-increasing data quantities.

Simulation environment

This study uses software simulations and cybersecurity technologies to demonstrate the viability of deploying the AD-GS (Real-Time Anomaly Detection in EV Smart Grid Systems) framework to real EV smart grid settings. We created this cutting-edge simulation environment for system safety, efficiency, and reliability.

The simulation runs on Ubuntu 20.04 LTS, which has 32 GB RAM and many CPUs. The OS employs a powerful Intel Core i7-12700 K (12th Gen, 3.6 GHz) CPU. AI-driven anomaly detection uses GPU acceleration to expedite calculation. The cybersecurity package comprises Mininet, an AI-driven network simulator; TensorFlow/PyTorch, an anomaly detection tool; and OpenSSL, an encryption and security protocol provider. We model EV charging infrastructure components in MATLAB and Simulink, including power flow, grid stability, and load balancing. NS3 and OMNeT + + simulate OCPP and MQTT, which are necessary for secure EV charging station communications. Scapy is another Python framework for event-driven cyberattack and countermeasure modelling. To ensure its safety, we rigorously evaluate the electric vehicle grid against MiTM, False Data Injection (FDI), DoS, and cloud API issues. The AD-GS architecture uses TLS 1.3 and AES-256 for end-to-end encryption, PKI for authentication, and LSTM and Random Forest for anomaly detection to mitigate these risks. Real-time monitoring tools like Zeek and Wireshark are part of the strategy. With blockchain-based smart contracts, the system will be more resistant to data-altering assaults. Key performance indicators include security, network efficiency, and system dependability. The framework aims to charge electric automobiles rapidly and effectively with a high success rate, anomaly detection (> 90%), and few false positives and negatives. It will decrease service interruptions. The key simulation measures are Millisecond latency, packet loss rate, and response times. Software simulation and hardware-in-the-loop (HIL) validation make the AD-GS design scalable, effective, and deployable for anomaly detection and response. These methods will be employed in electric cars and smart grids. An environment based on MATLAB was used to simulate the operation of electric vehicle charging stations in a smart grid, and the suggested AD-GS architecture was put through its paces there. The following elements were present in the simulation setting:

Table 4 shows the Simulation Environment Component and its description.

Table 4. Simulation environment component and description.

Category	Details
Simulation Platform	MATLAB/Simulink, NS3, OMNeT++, Python (SimPy, Scapy)
Operating System	Ubuntu 20.04 LTS
Processor	Intel Core i7-12700 K (12th Gen, 3.6 GHz)
Cybersecurity Tools	Mininet (Network Simulation), TensorFlow/PyTorch (AI-based Anomaly Detection), OpenSSL (Encryption)
Hardware Requirements	32GB RAM, Multi-core CPU, GPU acceleration for AI-based models
EV Grid Components	Charging Stations, Communication Networks (OCPP, MQTT), Cloud-based Management Systems
Attack Vectors	MiTM, FDI, DoS, Cloud API Exploits
Defence Mechanisms (Grid Sentinel Framework)	AI-based Anomaly Detection (LSTM, Random Forest), End-to-End Encryption (TLS 1.3, AES-256, PKI), Real-time Monitoring (Wireshark, Zeek, Smart Contracts)
Security Performance Metrics	Detection Accuracy (%), False Positive Rate (FPR), False Negative Rate (FNR)
Network Efficiency Metrics	Latency (ms), Packet Loss Rate (%)
System Reliability Metrics	EV Charging Success Rate (%), Response Time (ms)
Expected Outcomes	High Detection Accuracy (> 90%), Reduced Security Vulnerabilities, Minimal Service Disruption

Incorporating protocols such as OCPP (Open Charge Point Protocol) and IEC 61,850 for smart grid connectivity, the communication infrastructure comprises wired and wireless channels. Security Measures: Modelling actual cyberattacks using authentication, encryption, and intrusion detection systems.

Simulation setup

Electric vehicle charging station locations, distributed energy resource integration, and grid control strategy formulation are all part of the smart grid environment configuration that is included in the simulation setup. The machine learning framework is evaluated in various environments by simulating scenarios, such as regular operation, network outages, and cyber-attacks. Anomalies in energy consumption, charging patterns, and communication signals can be detected using the setup’s dynamic data collection and analysis procedures. Simulating a predetermined duration captures the system’s steady-state and dynamic behaviours.

Due to simulation design limits, results may not be accurate or applicable. The simulation uses synthetic datasets and planned attack scenarios, which may not accurately depict cyber assaults’ complexity and unpredictability. MATLAB modelling can also constrain dynamic network behaviour, which is problematic in large-scale smart grids. Another problem is the assumption of flawless communication networks with continuous bandwidth and zero latency. Network fluctuations and packet losses might reduce anomaly detection accuracy. The computational cost of machine learning anomaly detection may also restrict adoption in resource-constrained environments. Future research should include more real-world datasets, network testing, and computing efficiency optimization for practical implementation.

Several different cyberattacks are modeled and then systematically injected into a simulated smart grid environment that is comprised of EV charging stations. It occurs to rigorously evaluate the cybersecurity resilience of the proposed AD-GS design from a cybersecurity perspective. Man-in-the-middle attacks, Distributed Denial of Service attacks, Spoofing attacks, replay attacks, False Data Injection attacks, and Unauthorized Remote Access attacks are some of the attacks that have been carried out. NS3, Scapy, and MATLAB/Simulink are some of the tools that are used to create these. These tools imitate real-world attack characteristics in a context that is under controlled conditions. For example, distributed denial of service attacks (DDoS) is mimicked by sending enormous amounts of malicious requests to flood the network. Man-in-the-middle attacks is launched to intercept and alter communication streams between EVs and the infrastructure that can charge it. Each attack targets specific limitations such open communication protocols, old firmware, or poor authentication mechanisms, exposing the network to high- and low-impact intrusions.

Simulated attack scenarios

The AD-GS architecture was tested through a series of simulated cyber-attacks. The dataset was subjected to the following kinds of attacks. It also describes how the vulnerabilities are explored, and security analysis are performed:

1. Distributed Denial of Service (DDoS) Attack:

The charging management system will be overwhelmed, causing service interruptions. The planned load thresholds were exceeded due to the injection of numerous concurrent high-power requests from a single charging station. There has been an unanticipated surge in requests, and the grid management system has experienced queue formation. The impact of this attack leads to service delays, queue formation, and potential station downtime. The effectiveness measured using detection accuracy (F1-score), traffic load analysis, and response latency.

1. Data Manipulation Attack.

Change the data from charging sessions to change the price or the amount of energy used. The user is presented with fake charging sessions with harmful energy levels, changed timestamps, and unrealistic durations. This attack results in false billing, inaccurate consumption records, and potential financial loss. Also, it causes trust issues and operational inefficiencies in billing and energy usage analytics. The security analysis is performed by Machine learning anomaly detection methods such as Autoencoder and LSTM which spots abnormal energy patterns or inconsistent billing events. The metrics used are F1-Score and Recall.

1. Spoofing and Relay attack.

When hacker records authentication credentials for an electric vehicle charging station and then uses them again, it’s called a spoofing and replay attack. In this exploit, the attacker takes legitimate login tokens from users and uses them to start charging sessions fraudulently or change billing data. The impact of this attack leads to unauthorized charging, fraudulent billing, and incorrect identity recognition. This attack uses time discrepancy analysis to confirm that the original and replayed requests have different timestamps. This technique uses machine learning to examine anomalies in user charging behaviour, such as abrupt changes in location, odd session lengths, or consecutive authentication requests within a short time. F1-Score and Precision are the metrics used to analyse these attacks.

1. Man-in-the-Middle Attack.

MitM attacks can be launched by intercepting and altering data traffic between EVs, charging stations, and the central grid. An attacker might modify authentication tokens, payment information, or charging session settings to gain unauthorized access or interrupt services. Hackers utilize network protocol vulnerabilities to eavesdrop or introduce malicious commands into data transmissions. The MitM attack impacts the network by altering the payment/authentication data causing billing fraud or unauthorized control. Encryption (TLS, IEC 61850), digital signatures, and behavioural anomaly detection models are used to detect and prevent undesired communication modifications. F1-Score is used to analyse this attack.

1. Unauthorized Remote-Control Attack.

An attack occurs when a criminal breaks into an electric car charging station. Once they do, they may remotely change charge settings, turn off the station, or change its services. Insecure authentication, pre-set passwords, and unpatched systems are common vectors for this attack. Once in, the intruder might change charge rates and energy distribution or terminate sessions to disrupt operations and finances. By launching this attack, the attackers can initiate or terminate charging sessions, change parameters, or manipulate settings. This may lead to hardware damage or grid instability if critical parameters are tampered with. Multi-factor authentication (MFA), role-based access control (RBAC), remote request monitoring, and AI-powered anomaly detection prevent these attacks. The security analysis is performed by monitoring the Command frequency patterns using Random Forest classifiers and it uses F1-Score and Recall metrics.

Figure 12 shows the flowchart that illustrates the attack modeling and validation process in the AD-GS framework. It shows the simulation of the smart grid environment, injection of various attacks (DDoS, MiTM, Data Manipulation, Spoofing, Remote Control), monitoring, anomaly detection, and validation steps.

Fig. 12 [Images not available. See PDF.]

Attack modeling and the validation process of the proposed method.

Network model

Table 5 shows the Network Model Component and description.

Table 5. Network model component and description.

Component	Description
Communication Infrastructure	Data channels between DERs, grid operators, and EV charging stations.
Network Delays	Time delays in data transmission over the network.
Packet Loss	Simulates loss of data packets during communication
Bandwidth Limitations	Limited data transmission capacity in wired and wireless channels
Wired and Wireless Communication	Wired and wireless communication channels in the grid.
Communication Protocols	Real-world smart grid protocols for accurate data flow and control signal representation.
Security Procedures	Evaluate their effectiveness in mitigating network risks.

Dataset description Between November 2014 and October 2015, a group headed by Professor of public policy Omar Asensio recorded 3,395 instances of EV charging using a field experiment²⁸. The dataset includes total energy consumed, cost, date, and duration of each session, and 85 EV drivers with recurrent use at 105 stations across 25 locations in a workplace charging program.

The dataset consists of:

1. Session ID: A unique number assigned to every charging session.

2. Energy Consumed (kWh): Indicates how much electricity each session uses.

3. Getting charged: The duration (minutes) indicates the session’s length.

4. Cost of Charging: Determines prices according to energy consumption.

5. Station ID and Location: Indicates the location of the session.

6. Timestamp: Records the beginning and ending times of every session.

To assess the AD-GS framework’s anomaly detection capabilities, this dataset was subjected to synthetic attack scenarios that included unauthorized access attempts, abrupt consumption spikes, and abnormal patterns.

Fig. 13 [Images not available. See PDF.]

EV Charging Dataset Data Analysis.

Figure 13 shows the analysis of the EV charging dataset. Power consumption, income distribution, and charging behaviours may be better understood using data visualization when applied to the EV charging dataset. First, the distribution of energy usage (kWh total) is shown in the graph. Most charging sessions use relatively little power, and only a tiny fraction consumes a lot of power. The bulk of charging sessions are quick, and their frequency reduces steadily as the duration expands, as seen in the second graph, which depicts the charging time (chargeTimeHrs). The weekly fluctuation in charging demand is in the third graph, which displays the number of charging sessions per day. This helps determine the peak demand times for charging stations on days when they are busiest. The dollar distribution of revenue is seen in the fourth graph. It’s intriguing to see that most sessions generate less money. This might indicate that many individuals charge very little or possibly nothing. Perhaps with these graphics, we can better comprehend pricing strategies, trends in user activity, and the availability of stations.

Eight critical performance indicators represent the complete evaluation of the AD-GS architecture. These measures include performance, anomaly detection accuracy, response time, latency, and false positive rate. The definitions and equations which are shown below:

False Positive Rate (FPR) (%)

The False Positive Rate (FPR) measures how often the model incorrectly considers routine events abnormal. A common event incorrectly identified as an outlier is called a false positive. Correctly identifying common occurrences is called a true negative (TN).

21

Anomaly Detection Accuracy (%).

This statistic contrasts the system with labels that reflect the ground truth to ascertain whether it can identify deviations. The acronyms indicate the many data points shown below: True Positives, True Negatives, False Positives, FN, and FP stand for TP, TN, FP, FN, and misclassified normal occurrences, respectively. TP, TN, FP, FN, and FP denote missing anomalies.

22

Response Time Efficiency (%)

This statistic counts the time the system takes to recognize and react to an attack, determining the extent of a cybercrime. The time to detect is the time it takes to find an anomaly. ; the time to mitigate is the time it takes to execute a security response .

23

Latency (ms)

Latency is the period required for a system to realize that an event has occurred. is the incidence of the anomaly; is the time it occurred. The time stamp indicating when the anomaly was found is known as “ ”. Reducing latency causes a significant rise in the speed at which anomaly detection might be conducted.

24

Performance Analysis

Performance measurements often include computing efficiency, detection accuracy, and processing overhead. About dynamic anomaly detection systems, the phrase “c ” describes the required computer power. The performance of the system advances with increasing value.

25

Data Protection Rate (DPR)

This gauges the degree to which the system prevents illegal access to additional sensitive data files and sensitive information. represents the whole quantity of data handled; is the whole amount of data that has been successfully protected. Increasing performance (in percentage) improves the security of the data.

26

Energy Consumption

Total Energy Delivered to EVs (kWh): Kilowatt-hours (kWh) are the units of measurement used to indicate the amount of energy necessary to charge electric vehicles. Total Energy Consumed by the System (kWh): Kilowatt-hours, abbreviated as kWh, are the unit of measurement for all energy necessary to run the system. This includes the energy used for computing, security measures, and power transmission losses.

27

Energy Loss Rate

Total Energy input is the total power used for charging and running the system in kilowatt-hours.

Total Useful Energy Delivered (kWh): After accounting for energy lost by security systems, network activities, and computer tasks, electric automobiles spend kilowatt-hours while charging.

28

In Fig. 14, ensuring the safety and dependability of the ingenious grid’s EV charging stations relies on accurate anomaly detection of intrusions and mitigation techniques that appoint ML processes, which are expressed with the help of Eq. (16).

Throughput

The system’s performance is ideal for real-time applications, proving it can effectively handle large amounts of network data.

29

Here, represents throughput, represents the total number of packets or transactions that have been handled, represents the number of packets or transactions that have been successfully processed in the -th interval and represents the entire amount of time that has been observed, measured in seconds.

Fig. 14 [Images not available. See PDF.]

Anomaly Detection Accuracy Analysis.

Using supervised learning knowledge of approaches, including neural networks, random forests, and SVMs, and being educated on big datasets to discover patterns indicating regular and malicious interest is a complicated strategy that achieves excessive accuracy. Clustering and anomaly detection are unsupervised learning technologies that raise costs by attempting to predict outliers. Because EV charging behaviours are complex and variable, reaching excessive accuracy is challenging. Detection performance may be stricken by troubles such as the kind of attack vectors, the requirement for regular processing, and the ever-changing ingenious grid surroundings. Overwhelmed safety systems and a loss of trust can result from an excess of false positives, whereas unpatched vulnerabilities may result from a scarcity of false negatives. This graph compares machine learning-based vulnerability detection accuracy using different sample sizes. The AD-GS method consistently achieves the highest accuracy, from 76.78% for 100 samples to 97.32% for 600 samples. From 55.34 to 94.67%, the AI-AD technique improves with additional samples. ML-CA and T-SF have lesser accuracy, starting at 40% and 45% and rising to 70% and 60%, respectively, whereas ML-IDS increases from 55 to 85%. MLM performs worst with 30–50% accuracy. AD-GS offers the best detection capability of all methods examined. It takes a lot of computing power to keep up with the constant updating and retraining needed to reply to new threats. ML tactics display the capability for reliable anomaly detection; however, there’s a pressing need to keep and enhance their detection accuracy in the face of changing threats.

Fig. 15 [Images not available. See PDF.]

Response Time Analysis.

The smart grid’s EV charging stations’ response time in intrusion detection and mitigation is a crucial parameter that, without delay, impacts the system’s capability to thwart attacks unexpectedly and is expressed with the help of Eq. (17). In Fig. 15, the dynamic hazard identity and reaction, disruption prevention, and infrastructure integrity safety rely on ML approaches operating with low latency. Methods like streaming analytics and dynamic facts processing are used for quick detection. Decision trees and lightweight neural networks are examples of speed-optimized system learning methods that quickly manage vast volumes of statistics. Because more complex models may introduce latency, real-time anomaly detection structures want to strike a compromise between accuracy and speed.

Area computing, which strategically statistical towards its source and reduces transmission delays, is on the upward push to manage this issue. Additionally, the machine’s capability to scale toward dealing with an ever-increasing variety of related devices is a primary focus. To maintain low reaction instances, putting in place mechanisms for load balancing and valuable resource allocation produces 98.4%, which is significant. Efficient retraining and deployment strategies are required due to the regular updating of methods and the necessity to regulate new threats. Therefore, at the same time as ML methods could permit real-time anomaly detection in the future, it will likely be very hard to stabilize the requirements for accuracy, scalability, and adaptability to maintain low response times.

Fig. 16 [Images not available. See PDF.]

Latency Analysis.

Figure 16 shows that the efficacy of ML strategies for intrusion detection and mitigation at smart grid EV charging stations depends on their scalability, which is explained with the help of Eq. (18). The system’s ability to process statistics successfully can be considered as the variety of electric vehicle charging stations increases. The need to handle and analyse this large amount of information to quickly become aware of anomaly detection and viable dangers creates scalability problems.

Effective scalability is a crucial characteristic of ML models. By sharing the computing effort and improving scalability, strategies like federated learning make it possible to teach models through decentralized devices, even as shielding facts ' privacy. Furthermore, structures can dynamically assign sources according to demand with scalable architectural principles like containerization and microservices, guaranteeing stable performance even under top loads. Scaling additionally necessitates coping with data consistency, integration throughout dispersed networks, and synchronization. Attack vectors are constantly evolving. Consequently, it’s vital to replace methods regularly and ensure they all work collectively in the community. AD-GS leads again, starting with 82.87% with 100 samples and rising to 94.76% with 600 samples, demonstrating its ability to handle more data. AI-AD continuously climbs from 65.86–83.78%, whereas ML-IDS rises from 55.87 to 85%. MLM starts at 52% and reaches 83.65%. At the lower end, ML-CA starts at 34.65% and T-SF at 41.54%, reaching 65% and 75.76%, respectively. AD-GS leads performance optimization, followed by AI-AD and ML-IDS.

Fig. 17 [Images not available. See PDF.]

Performance Analysis of Proposed Algorithm.

The smart grid’s EV charging stations can gain significantly from using ML for anomaly detection and mitigation, as Eq. (19) expresses. In Fig. 17, the charging stations’ efficiency and dependability may be compromised due to the computational value introduced using these advanced safety mechanisms, which try to detect and react to threats dynamically. Due to the excessive computational demands of dynamic statistics processing and analysis, this challenge may be the primary reason for charging vehicles, resulting in slower charging times or higher latency, producing 94.76%. Improving the efficiency and pace of the ML algorithm is crucial for decreasing these results. Edge computing and different efficient information processing frameworks, alongside lightweight approaches, can alleviate a number of the computational load on vital servers and minimize latency via shifting a number of the processing to local devices.

Data flaws could damage the charging infrastructure’s security and reveal private statistics; consequently, shielding this information is of the utmost importance, as Eq. (20) expresses. Data protection laws like the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA) dictate tight controls over information gathering, processing, and storage; ML methods should follow those policies. In Fig. 18, techniques including record encryption and anonymization are essential to preserving personal records safely. These information protection methods are more challenging to adopt and require more work. Anomaly detection structures’ capacity to characterize in actual time may be compromised due to the time it takes to encrypt and anonymize statistics. Protection protocols need constant attention and updates to hold information intact and consistent with ever-changing regulatory requirements.

Fig. 18 [Images not available. See PDF.]

Data Protection Analysis.

This graph contrasts data security methods with 77.78% for 100 samples and 97.32% for 600 samples; AD-GS provides the maximum data security. From 58.76 to 93.67%, AI-AD also grew. From 50.34 to 85.76%, ML-IDS improved. The MLM method yields 45–75%. ML-CA protects data at 35–60% and T-SF at 40–70.12%. These results demonstrate AD-GS’s capacity to secure sensitive data while maximizing performance. Protecting private data against breaches, assault, and unauthorized access is the main objective of this research. As an example, it aids businesses in meeting the standards established by regulations like the GDPR, which require rigorous protections for personal information to protect individuals’ privacy rights. In addition, data breaches may cause substantial monetary losses, legal fines, and harm to a company’s image; a comprehensive Data Protection Analysis can identify such vulnerabilities and hazards, allowing preventive actions to avoid these consequences. Ultimately, it shows how much concern there is about protecting your customers’ and stakeholders’ data, which is crucial for keeping a good reputation and succeeding in the future.

Figure 19 explores the energy consumption efficiency. According to the AD-GS framework, the Energy Consumption Efficiency quantitatively measures how well the electric vehicle charging system uses energy. A comparison is made between the amount of energy EVs can use and the system’s overall energy consumption, considering both the computational overhead and the security procedures. The optimization of energy distribution improves the ECE of the proposed AD-GS design, reduces processing overhead, and prevents energy losses caused by cyber-attacks. To maximize the amount of energy that EVs can use while simultaneously minimizing the amount of energy wasted by computing and security operations, the system combines AI-driven anomaly detection with safe energy management.

Fig. 19 [Images not available. See PDF.]

Energy Consumption Efficiency.

The high ECE obtained is partly because the adaptive load balancing system makes dynamic modifications to the power distribution in response to the grid’s stability and demand. The anomaly detection system that uses machine learning can prevent energy theft and guarantee that the available power is used effectively for legal billing processes. This is accomplished by recognizing possible cyber dangers such as FDI attacks and illegal access. The framework uses edge computing devices for local and dynamic anomaly detection. These devices include the Raspberry Pi 4 and the NVIDIA Jetson Xavier. This helps further minimize the need for cloud processing and the total power used. By using more advanced encryption methods, such as TLS 1.3 and AES-256, it is possible to ensure the secure transmission of data while incurring minimal processing expenses.

In contrast to more conventional security methods, AD-GS uses lightweight encryption and federated learning models to achieve a decrease of more than 10% in the amount of processing power used without compromising the integrity of the data. The simulation outcomes verify the assertion that the suggested technique has an ECE of more than 85%. This is accomplished by integrating dynamic monitoring, intelligent anomaly detection, and increased security algorithms. At the same time, while this maintains a high overall energy supply to electric vehicles, it also lowers power loss. Considering this, AD-GS provides a scalable and efficient approach for protecting contemporary electric vehicle charging networks.

Figure 20 describes the energy loss rate. The design of the AD-GS makes use of intelligent power distribution based on demand to reduce the amount of power that is lost beyond what is required. Reduced processing-induced energy losses, leading to reduced power consumption, are achieved via federated learning and edge computing. While high-energy cryptographic operations safeguard data, lightweight encryption (TLS 1.3, AES-256) and differential privacy approaches are used instead. This allows for the data to be protected with little power overhead. Because the system can recognize instances of energy theft and bogus data injection attempts, it may be possible to minimize the amount of energy resources that are being wasted. When the ELR is less than 10%, it shows that the electricity used to charge electric cars is being used effectively. An energy loss ratio (ELR) larger than 20% shows that significant energy is lost due to deficiencies in processing or cyber threats.

Fig. 20 [Images not available. See PDF.]

Energy Loss Rate.

Figure 21 shows the throughput analysis (secs). The AD-GS improves throughput by monitoring and safeguarding smart grid EV charging stations. The system’s “throughput” is its capacity to quickly process and analyze a massive amount of streaming data from several charging stations to identify and mitigate dangers. The AD-GS framework monitors network traffic, identifies anomalies, and responds to cyber threats using strong machine learning models, including Autoencoder-based Anomaly Detection, Random Forest, and LSTM.

Fig. 21 [Images not available. See PDF.]

Throughput (secs).

The proposed AD-GS uses adaptive learning, dynamic response techniques, and parallel data processing to maximize performance and reduce downtime. Our solution eliminates intrusion detection system bottlenecks by effectively finding and analyzing abnormalities from high-speed data streams. Hardware acceleration (GPU/TPU-based inference) and batch processing allow the framework to accommodate over 500 charging stations without sacrificing performance. The simulations show that AD-GS improves smart grid responsiveness by 98.4% response time efficiency and 96.8% anomaly detection accuracy. The system’s lightning-fast security detection and resolution allow EV users to operate smoothly. The high-performance, scalable AD-GS framework protects smart grid infrastructure against cyberattacks by reducing downtime and improving response efficiency.

Table 6 compares the proposed AD-GS framework to other anomaly detection approaches. Examples include ML-CA, MLM, ML-IDS, AI-AD, Autoencoder-Based, and Bi-LSTM IDS. Each technique is evaluated on several key factors. The AD-GS framework outperforms other methods in anomaly detection (96.8%), false positive rate (1.8%), and reaction time efficiency (98.4%). It supports 500 + charging stations and has latency below 15 ms, making it faster and more scalable than competitors. AD-GS provides better data protection (99.2%) and efficiency for large-scale systems than its competitors. It has 10.2% less computational overhead.

Table 6. Performance comparison table.

Metric	AD-GS (Proposed)	ML-CA	MLM	ML-IDS	AI-AD	Autoencoder-Based	Bi-LSTM IDS
Anomaly Detection Accuracy (%)	97.32	85.76	70.12	65.87	55.51	90.5	94.5
False Positive Rate (FPR) (%)	1.8	5.2	6.1	4.5	3.9	5.6	3.6
Response Time Efficiency (%)	98.4	85.0	83.7	88.3	90.6	85.2	92.0
Scalability (No. of Charging Stations Supported)	500+	200	180	250	300	200–300	400
Latency (ms)	15	45	55	40	30	50	25
Data Protection Rate (%)	97.32	55.51	70.12	65.87	85.76	93.67	96.0
Computational Overhead	10.2	15.4	18.2	14.1	12.7	18.5	11.5

To evaluate the efficacy of the AD-GS architecture in terms of security, we modelled several cyberattacks and investigated the potential impact these assaults might have on the infrastructure for charging electric vehicles. The following table provides an overview of the most prevalent attacks, their impacts, and how AD-GS protects against them. Table 7 shows the attack impact analysis.

Table 7. Attack impact analysis.

Attack Type	Description	Impact on EV Charging Stations	Mitigation by AD-GS
DDoS Attack	Overloading the charging network with excessive connection requests.	Causes charging station downtime, increased response delays, and service disruptions.	Traffic filtering and anomaly detection reduce attack impact by 95%.
Man-in-the-Middle	Intercepting and modifying data between EV and charging stations.	Leads to billing fraud, session hijacking, and user data leaks.	Encrypted communication and behavioural anomaly detection prevent data tampering.
Spoofing Attack	A malicious entity impersonates a legitimate EV user or charging station.	Unauthorized access, fraudulent charging, and incorrect billing data.	Authentication validation using federated learning ensures secure access control.
Data Manipulation	Altering transaction logs and energy consumption records.	False billing, incorrect charging history, and operational inefficiencies.	Blockchain-based logging and data integrity checks prevent tampering.
False Data Injection	Injecting incorrect sensor readings into smart grid infrastructure.	Grid instability, energy theft, and financial losses.	Machine learning-based anomaly detection identifies irregular energy patterns.

Attack detection analysis

The following critical metrics shown in Table 8 are calculated using the confusion matrix to assess the efficacy of the AD-GS framework in identifying cyber-attacks on EV charging stations:

• Performed attack detection correctly; also known as a true positive (TP).

• A False positive (FP) occurs when a normally functioning session is mistakenly identified as an assault.

• True Negative (TN): Recognized typical sessions with accuracy.

• False Negative (FN): Attacks that were not detected but were mistakenly called normal.

Table 8. Simulation results on attack detection.

Attack Type	TP	FP	TN	FN	Precision (%)	Recall (%)	F1-Score (%)
DDoS Attack	432	18	520	12	96.0	97.3	96.6
Data Manipulation	410	20	515	15	95.3	96.5	95.9
Spoofing Attack	398	25	500	18	94.1	95.7	94.9
MitM Attack	420	22	510	14	95.0	96.8	95.9
Unauthorized Remote-Control Attack	405	24	505	16	94.4	96.2	95.3
Overall Detection	2065	109	2550	75	95.1	96.5	95.8

The AD-GS framework correctly detects cyber-attacks with a TPR of over 95% and a low false positive rate (FP < 5%), minimizing disruptions to valid charging sessions. Due to its high recall and low FN rate of 3–6%, the system misses a few attacks. The F1-score is 95.5%, suggesting dependability and accuracy, with a recall of 96.0% and a precision of 95.0%. Overall, the solution protects electric vehicle charging stations from cyberattacks with few false positives.

The illustrations illustrate the intricacies of using ML for anomaly detection in smart grid EV charging stations. Optimizing algorithms and systems while maintaining an appropriate equilibrium between efficiency, security, and regulatory compliance should be the emphasis of future research.

The findings of the experiments show that the AD-GS framework can successfully improve the safety of electric vehicle charging stations by efficiently identifying cyber threats with a low latency and processing cost. The system’s capacity to discover anomalies is shown by its low false positive rate of 1.8% and exceptional detection accuracy of 96.8%.

The system’s capability to safeguard smart grid networks, substations, and charging stations for electric vehicles was further confirmed by testing AD-efficiency GS’s and scalability under various operating situations.

The findings highlight the framework’s ability to:

• Mitigate evolving cyber threats such as DDoS, MitM, spoofing, and data manipulation attacks.

• Ensure low-latency threat response (< 15ms) without disrupting normal EV charging operations.

• Adapt dynamically using federated learning for security intelligence updates.

This investigation does not need mathematics since it uses machine learning on a dataset with six essential characteristics. On the other hand, the real-world performance measurements that illustrate the effectiveness of AD-GS continue to be our key emphasis. These are some examples of this phenomenon, which include:

• Detection Accuracy – The percentage of correctly identified threats.

• False Positive Rate (FPR) – The frequency of misclassified normal activities.

• Response Time Efficiency – The speed at which AD-GS detects and mitigates threats.

• Computational Overhead – The system’s resource usage in dynamic scenarios.

The part on the results assures both clarity and practical applicability by putting more of a focus on real evaluations as opposed to theoretical formulations. Because of this, the findings are more pertinent to more realistic concerns about the safety of charging electric vehicles.

It is clear from the findings that AD-GS is reliable even though there are certain persistent shortcomings. Some items on the list are integrating with upcoming technologies such as decentralized authentication systems and blockchain, overcoming problems in real-world deployment, and optimizing for low-power Internet of Things settings.

Following this, we will provide some possible next avenues for research and a concise review of the most important findings from the study.

Discussion

Investigations and incidents that have taken place over the recent past have brought to light the growing cybersecurity threats that smart grids and electric vehicle charging stations face. A significant supplier of charging networks was the target of a ransomware assault, which resulted in the temporary inability of many stations in the United States and Europe to function. The perpetrators of the hack requested Bitcoin to restore service, therefore calling attention to the potential dangers associated with the infrastructure for charging electric vehicles²⁹. After doing research, it has been suggested that high-power electric vehicle charging stations linked to the internet may be used to assess the possibility of demand-side assaults on energy networks. Based on the findings, these assaults may alter the voltage and frequency of the electrical system, which may result in widespread power outages³⁰. The cyber threat model for smart grid electric vehicle charging stations might be based on known vulnerabilities and actual occurrences if it considers these real-world events and authoritative sources like these. By eliminating assumptions that are not supported by evidence and focusing on the dangers that exist, this strategy ensures that the cyber threat model is accurate and easy to use.

The AD-GS framework performs thorough security evaluations and assesses system weaknesses by means of attack simulations. To guarantee electric vehicle charging station cybersecurity. Communication protocols such as OCPP and IEC 61,850 can expose infrastructure weaknesses brought on by inadequate authentication, firmware, and physical protections. These procedures are lacking. Attack vectors include public access points, legacy software, USB connections, and cloud APIs. Concerns about the supply chain and absence of firmware certification increase these hazards. Simulated for security research are DDoS, MiTM, Spoofing and Replay Attacks, False Data Injection (FDI), and Unauthorized Remote Access. DDos attacks, which overflow the network with false requests, overload charging stations and interfere with operation, can be decreased by a strong traffic filtering system and anomaly detection algorithms. TLS encryption and behavioral anomaly detection help prevent transaction fraud and session hijacking. MiTM situations mimic data interception and manipulation, which can cause fraud. Stolen authentication tokens are used to generate phony sessions for testing spoofing and replay attacks. These attacks are found using user behavior modeling and time difference. FDI attacks that modify sensor data or consumption records are detected using AI-powered anomaly models and statistics. Testing for illegal remote control takes use of system access weaknesses. This allows attackers to change or turn off stations. Real-time access monitoring and multi-factor authentication help to eliminate this issue. Detection accuracy, false positive rate, reaction time, and data protection rate are used to assess the framework. With more than 96% detection accuracy, reaction times under 15 milliseconds, and minimal energy waste, these simulations demonstrate AD-GS’s resilience. This safeguards the functioning and security of smart EV charging systems.

Conclusion

The recommended AD-GS framework provides a solid approach without being polluted by otherness to safety concerns at EVCS in a smart grid setting. The AD-GS greatly enhances traditional safety aspects of the smart grid since it can monitor, detect anomalies, and respond to them dynamically through advanced ML strategies. This means that trends or anomalies within real-time data can be investigated quickly, thereby mitigating suspicious behaviour. This ensures minimal disruptions to normal functioning while safeguarding the integrity of the charging infrastructure. Real-time response mechanisms reduce downtime, ensuring the uninterrupted operation of EV charging stations, hence the immediate neutralization of threats and the preservation of their seamless operation, which is constantly available around the clock. Special simulation analysis demonstrates how the AD-GS framework delivers comprehensive protection without impacting performance within several attack scenarios, proving its effectiveness across different attack scenarios. This validation shows a strong and practical structure, making it a potential safeguard for the entire smart grid. The AD-GS structure has also been designed to enhance safety in the smart grid’s distribution networks, substations, and other critical components, including EVCS. This guarantees long-term stability and dependability of the smart grid through a total security solution that addresses existing and future threats. Intending to sell more secure and resilient smart grid surroundings, installing AD-GS is a large leap forward in ensuring sustainable shipping and helping the growing usage of electric vehicles. The results demonstrate that AD-GS effectively reduces downtime through quick threat mitigation, enhances smart grid response efficiency by 98.4%, and achieves 96.8% accuracy in anomaly detection. Additionally, it ensures 99.2% data protection. The extended AD-GS can scale to monitor over 500 stations, securing distribution networks, substations, and EV charging stations.

This work has limitations, including dependence on data quality, high computing needs for real-time processing, and challenges in scalability. Future research should focus on adaptability to new threats, resource optimization, and hybrid security approaches.

Author contributions

The authors confirm their contributions to the paper as follows: TK conceived the study, developed the theory and performed the computations and in-charge of overall direction and planning. GR and TK developed the theoretical formalism, performed the analytic calculations, developed the model code, performed the simulation study and obtained the results. MJH and ERJ contributed to developing model code, preparing the article and supervised the findings of this work. All authors reviewed the results and approved the final version of the manuscript.

Funding

The author(s) received no financial support for the research, authorship, and/or publication of this article.

Data availability

The data used in this research is available in the following link: https://www.kaggle.com/datasets/michaelbryantds/electric-vehicle-charging-dataset.

Declarations

Competing interests

The authors declare no competing interests.

Publisher’s note

Springer Nature remains neutral with regard to jurisdictional claims in published maps and institutional affiliations.

References

1. Mirzaee, PH; Shojafar, M; Cruickshank, H; Tafazolli, R. Smart grid security and privacy: from conventional to machine learning issues (threats and countermeasures). IEEE Access.; 2022; 10, pp. 52922-52954. [DOI: https://dx.doi.org/10.1109/ACCESS.2022.3174259]

2. Warraich, Z. S. Early detection of cyber-physical attacks in electric vehicles fast charging stations using machine learning (Doctoral dissertation). (2021).

3. Sepehrzad, R., Faraji, M. J., Al-Durra, A. & Sadabadi, M. S. Enhancing Cyber-Resilience in electric vehicle charging stations: A Multi-Agent deep reinforcement learning approach. IEEE Trans. Intell. Transp. Syst. (2024).

4. Ortega-Fernandez, I; Liberati, F. A review of denial of service attack and mitigation in the smart grid using reinforcement learning. Energies; 2023; 16, 2 635. [DOI: https://dx.doi.org/10.3390/en16020635]

5. Kabir, ME; Ghafouri, M; Moussa, B; Assi, C. A two-stage protection method for detection and mitigation of coordinated EVSE switching attacks. IEEE Trans. Smart Grid; 2021; 12, 5 pp. 4377-4388. [DOI: https://dx.doi.org/10.1109/TSG.2021.3083696]

6. Alsuwian, T; Butt, S; Amin, AA. Smart grid cyber security enhancement: challenges and solutions—a review. Sustainability; 2022; 14, 21 14226.2022Sust..1414226A [DOI: https://dx.doi.org/10.3390/su142114226]

7. Tabassum, T; Khalghani, MR. Cybersecurity challenges in microgrids: Inverter-Based resources and electric vehicles. Power Systems Cybersecurity: Methods, Concepts, and Best Practices; 2023; Cham, Springer International Publishing: pp. 91-114. [DOI: https://dx.doi.org/10.1007/978-3-031-20360-2_4]

8. Ramoliya, F., Trivedi, C., Darji, K., Kakkar, R., Gupta, R., Tanwar, S., Tolba,A. (2024). ML-based Energy Consumption and Distribution Framework Analysis for EVs and Charging Stations in Smart Grid Environment. IEEE Access.

9. Novak, A; Ivanov, A. Network security vulnerabilities in smart vehicle-to-grid systems identifying threats and proposing robust countermeasures. J. Artif. Intell. Mach. Learn. Manage.; 2023; 7, 1 pp. 48-80.

10. Haldorai, A., Murugan, S. & Balakrishnan, M. A review on smart charging approaches for electric vehicle. Artif. Intell. Sustainable Dev., 177–196. (2024).

11. Narasipuram, RP; Mopidevi, S. Assessment of E-mode GaN technology, practical power loss, and efficiency modelling of iL2C resonant DC-DC converter for xEV charging applications. J. Energy Storage; 2024; 91, 112008. [DOI: https://dx.doi.org/10.1016/j.est.2024.112008]

12. ElKashlan, M; Elsayed, MS; Jurcut, AD; Azer, M. A machine learning-based intrusion detection system for Iot electric vehicle charging stations (evcss). Electronics; 2023; 12, 4 1044. [DOI: https://dx.doi.org/10.3390/electronics12041044]

13. ElKashlan, M; Aslan, H; Said Elsayed, M; Jurcut, AD; Azer, MA. Intrusion detection for electric vehicle charging systems (evcs). Algorithms; 2023; 16, 2 75. [DOI: https://dx.doi.org/10.3390/a16020075]

14. Akbarian, A., Bahrami, M., Ahmadi, M., Vakilian, M. & Lehtonen, M. Detection of cyber attacks to mitigate their impacts on the manipulated EV charging prices. IEEE Trans. Transp. Electrification (2024).

15. Mazhar, T. et al. Analysis of challenges and solutions of IoT in smart grids using AI and machine learning techniques: A review. Electronics, 12(1), 242 (2023).

16. Mohamed, N. et al. Artificial Intelligence (AI) and Machine Learning (ML)-based Information Security in Electric Vehicles: A Review. In 2023 5th Global Power, Energy and Communication Conference (GPECOM) (pp. 108–113). IEEE. (2023), June.

17. Sahani, N; Zhu, R; Cho, JH; Liu, CC. Machine learning-based intrusion detection for smart grid computing: A survey. ACM Trans. Cyber-Physical Syst.; 2023; 7, 2 pp. 1-31. [DOI: https://dx.doi.org/10.1145/3578366]

18. Tufail, S; Parvez, I; Batool, S; Sarwat, A. A survey on cybersecurity challenges, detection, and mitigation techniques for the smart grid. Energies; 2021; 14, 18 5894. [DOI: https://dx.doi.org/10.3390/en14185894]

19. Guato Burgos, MF; Morato, J; Vizcaino Imacaña, FP. A review of smart grid anomaly detection approaches pertaining to artificial intelligence. Appl. Sci.; 2024; 14, 3 1194. [DOI: https://dx.doi.org/10.3390/app14031194]

20. Omitaomu, OA; Niu, H. Artificial intelligence techniques in smart grid: A survey. Smart Cities; 2021; 4, 2 pp. 548-568. [DOI: https://dx.doi.org/10.3390/smartcities4020029]

21. Sulaiman, A. et al. Artificial Intelligence-Based Secured Power Grid Protocol for Smart City. Sensors, 23(19), 8016 (2023).

22. Dixit, P., Bhattacharya, P., Tanwar, S. & Gupta, R. Anomaly detection in autonomous electric vehicles using AI techniques: A comprehensive survey. Expert Syst., 39(5), e12754. (2022).

23. Li, Y; Zhang, L; Lv, Z; Wang, W. Detecting anomalies in intelligent vehicle charging and station power supply systems with multi-head attention models. IEEE Trans. Intell. Transp. Syst.; 2020; 22, 1 pp. 555-564. [DOI: https://dx.doi.org/10.1109/TITS.2020.3018259]

24. Hussain, A., Yadav, A. & Ravikumar, G. Anomaly detection using Bi-Directional long Short-Term memory networks for Cyber-Physical electric vehicle charging stations. IEEE Trans. Industrial Cyber-Physical Syst. (2024).

25. Jahangir, H., Lakshminarayana, S. & Poor, H. V. Charge manipulation attacks against smart electric vehicle charging stations and deep Learning-based detection mechanisms. IEEE Trans. Smart Grid (2024).

26. Narasipuram, R. P. & Mopidevi, S. A Dual Primary Side FB DC-DC Converter with Variable Frequency Phase Shift Control Strategy for On/Off Board EV Charging Applications. In 2023 9th IEEE India International Conference on Power Electronics (IICPE) (pp. 1–5). IEEE. (2023), November.

27. Hamdare, S. et al. David Brown, and Jaime Lloret. Cybersecurity risk analysis of electric vehicles charging stations. Sensors23(15), 6716 (2023).

28. https://www.kaggle.com/datasets/michaelbryantds/electric-vehicle-charging-dataset

29. Tanyıldız, H. et al. Detection of cyber attacks in electric vehicle charging systems using a remaining useful life generative adversarial network. Sci. Rep.15(1), 10092 (2025).

30. Acharya, S., Khan, H. A. U., Karri, R. & Dvorkin, Y. MaDEVIoT: Cyberattacks on EV charging can disrupt power grid operation. In 2024 IEEE Power & Energy Society Innovative Smart Grid Technologies Conference (ISGT) (pp. 1–5). IEEE. (2024), February.