EVDetect: a framework for orchestrated and AI-powered detection of cyber-attacks in EV charging networks

E-mobility has gained significant attention in recent years due to its contribution to reducing greenhouse gas emissions and the technological advancements introduced by digital interfaces. However, these interfaces also expose the grid to an expanded threat landscape, including attacks such as spoofing and Denial-of-Service. In this article, we propose EVDetect, a comprehensive intrusion-detection framework supporting exploratory unsupervised analysis and supervised Machine Learning (ML) for Electric Vehicle (EV) charging networks. Our methodology introduces a decoupled logging architecture that prevents logging noise and enables the retrospective use of historical models, supporting reproducible experimentation with tabular security data. Candidate models are evaluated using both functional (i.e., F1-macro) and non-functional (i.e., inference latency, CPU utilization, and model size) characteristics, with the latter providing relative computational comparisons on common reference hardware. The framework is evaluated on the CICEVSE2024 dataset. In the full-dataset binary experiment, the leading ensembles achieved F1-macro values of 0.87 - 0.88, with XGBoost providing the most favorable relative-efficiency profile. The full multiclass experiment achieved an F1-macro of approximately 0.66, highlighting the difficulty of distinguishing attack categories with overlapping power-consumption patterns. Overall, EVDetect supports reproducible comparison of functional and computational model characteristics, while deployment performance on EVSE-class hardware remains to be validated.