A Hybrid Intrusion Detection System for Electric Vehicle Charging Infrastructure
2026-06-22 • Cryptography and Security
Cryptography and Security
AI summaryⓘ
The authors created a new system to better protect electric vehicle charging stations (EVCSs) from cyberattacks by watching both the network traffic and the activities on the devices themselves. Their system combines two types of intrusion detection methods, one that looks at the overall network and one that looks at individual devices, to catch more types of attacks. Using recent data, they showed their approach works very well, detecting many kinds of attacks with high accuracy. This dual-layer method works better than older systems that looked at only one layer.
Electric Vehicle Charging Stations (EVCS)Smart GridIntrusion Detection System (IDS)Network-based IDS (NIDS)Host-based IDS (HIDS)False Data Injection Attack (FDIA)Denial of Service (DoS)CryptojackingCybersecurityMulticlass Classification
Authors
Charukeshi Joglekar, Chijioke Eze, Danni Xiang, Antonello Monti
Abstract
The integration of Electric Vehicle Charging Stations (EVCSs) into the smart grid necessitates sophisticated digital infrastructure for their management and coordination, which expands the attack surface and makes both the power grid and EVCSs vulnerable to cyberattacks. This research addresses critical gaps in existing EVCS Intrusion Detection Systems (IDS) by proposing a hybrid IDS that integrates attack detection on both the cyber and physical layer of the EVCS ecosystem. The proposed hybrid IDS utilizes a dual-layer integration method, which combines network-based IDS (NIDS) and host-based IDS (HIDS). This approach facilitates for comprehensive monitoring of both network traffic through the NIDS and host-level activities via the HIDS, effectively addressing the unique challenges posed by the interconnected nature of EVCS ecosystems. Utilizing the recent CICEVSE2024 dataset, the IDS presented in this work performs multiclass classification across various attack types, including False Data Injection Attacks (FDIAs), reconnaissance, denial of service, backdoor, and cryptojacking attacks. Experimental results demonstrate that our approach achieves excellent detection accuracy, with the NIDS component reaching 99.99\% accuracy for network-based attacks and the HIDS component achieving 83.47\% accuracy on FDIA, cryptojacking, backdoor, all DoS, all Recon except Slowloris Scan attacks. This dual-layer detection significantly outperforms single-source detection approaches previously presented in literature.