A federated learning framework for anomaly detection in electric vehicle charging networks

Charging networks for electric vehicles (EVs) are also coming under attack from cyber threats such as Denial-of-Service (DoS) attacks, unauthorized access, load balancing the network, and sudden charging network disruptions. The traditional centralized anomaly-detection and authentication schemes are not suitable for large-scale, geographically distributed and privacy-focused charging infrastructure, as they include SPOF, high communication overhead and limited adaptability to the changing threats. This paper proposes a federated-learning (FL) framework, which is composed of (i) a dual-layer authentication architecture, namely a Global Authentication Protocol (GAP) using TLS with a fallback Local Authentication Protocol (LAP), and (ii) a heterogeneous pipeline of anomaly detections, such as supervised models (Random Forest, Decision Trees), unsupervised models (Autoencoders, Principal Component Analysis), and regression-based normal-behavior forecasters (Linear Regression, Support Vector Regression), with BERT-based log preprocessing. To ensure the parameters of the neural-network part of the model can be meaningfully aggregated, only the Autoencoder and the BERT-based log encoder are being aggregated using Federated Averaging. To achieve this aggregation for the other models, either the tree-based model or the PCA model are replaced by the global model after each round, which is referred to as a model-replacement strategy. A combined real-world dataset (ACN (Caltech and JPL sites) and ElaadNL (snapshot) was used together with a simulated dataset of 500 K events generated using ACN-Sim. DoS, unauthorized-access, load-balancing and abrupt-charging-disruption events were synthesized using a formal threat model and attack-injection procedure. To compare the baselines, all baselines (Hybrid IDS, System used in and a protocol-compliance reference implementation of ISO 15118) were re-implemented and tested using the same data splits, preprocessing and hardware. Across five repeated runs, the proposed framework achieved a mean detection accuracy of 95.4% (95% CI: 94.6–96.2%) on ACN, 92.1% (91.2–93.0%) on ElaadNL, and 90.3% (89.2–91.4%) on the simulated set, with mean latency of 205 ms (ACN), 223 ms (ElaadNL), and 248 ms (simulated). The framework has been tested to support an average of 1,500 concurrent charging sessions and achieved a measured 28.7% decrease in communication costs from a centralized baseline. We further study the framework’s ability to resist model-poisoning attacks through a secure aggregation mechanism (coordinate-wise median, with a fallback to a trimmed-mean algorithm). We also discuss the question of compatibility of the framework with Distributed Ledger Technologies (DLTs) for auditable federated updates. There are clear specifications and open discussion regarding the limitations of dataset diversity, real-time live-network validation, and lack of differential privacy.