A Novel OCPP-Centric Hybrid Testbed and Dataset for EV Charging Infrastructure Security Threats Feasibility Testing

The rapid adoption of Electric Vehicles (EVs) has intensified demands on the Electric Vehicle Charging Infrastructure (EVCI), where operational security is critical to ensuring confidentiality, availability, integrity, and consumer trust. The Open Charge Point Protocol (OCPP) 1.6, central to EVCI interoperability, remains vulnerable to authentication spoofing, man-in-the-middle (MiTM) interception, and protocol manipulation attacks when deployed without robust security extensions. However, there is a notable lack of publicly available protocol-centric datasets that capture realistic EVCI traffic under benign and adversarial conditions. Therefore, this paper addresses this gap through the design of a novel hybrid testbed that combines virtual and physical components, including real OCPP-compliant chargers, EV Supply Equipment (EVSE) testers, and simulated EVs, to produce a semantically rich and attack-inclusive dataset. The dataset contains over 55 features spanning semantic message fields, finite-state machine (FSM) transitions, timing metrics, payload complexity, and network-level characteristics, derived from the official OCPP 1.6 and 2.0 specification. Comparative analysis with the important and widely used internet of things (IoT) and EVCI datasets highlights the superior semantic depth, FSM structure, and realistic stealth attack representation of our dataset. This work provides a reproducible foundation for developing protocol-centric intrusion detection and prevention systems to detect sophisticated and context-driven anomalies in EV charging ecosystems.