Anomaly Detection Using Bi-Directional Long Short-Term Memory Networks for Cyber-Physical Electric Vehicle Charging Stations

With the increasing integration of electric vehicles (EVs) into the distributed energy resources (DER) system, the security of EV charging stations (EVCS) from cyber-attacks is paramount. Utilizing deep learning and recurrent neural networks (RNNs) presents promising advantages in anomaly detection within power systems. Bi-directional long-short-term memory (Bi-LSTM) emerges as a viable choice for anomaly detection, offering distinct advantages that learn from both the forward and backward sequences of the data compared to conventional deep neural networks, RNNs, and basic LSTMs. This study proposes data-driven anomaly detection (DDAD) techniques using a Bi-LSTM network. Seven statistical features are extracted from the passive parameters (voltage, current, frequency, and SoC). Then, the wrapper feature selection method is used to identify the most relevant features, enhancing the accuracy of the proposed DDAD model. We generate a dataset of normal events such as line faults, load switching, capacitor switching, and cyberattack events, including denial-of-service (DoS), spoofing, replay, and data manipulation attacks, using an extended API integrated with RT-LAB to automate the process. We demonstrated the DDAD model on a DER-integrated EVCS microgrid model on a Hardware-in-Loop (HIL)-based intelligent Cyber Physical System (iCPS) testbed environment. Comprehensive experiments are conducted to evaluate the performance of our proposed DDAD model's accuracy, precision, recall, and F1 score with the testing dataset. We compared our results against LSTM, multi-layer perception (MLP), support vector machine (SVM), and linear regression (LR) techniques. This study emphasizes the development of an efficient approach for detecting anomalies on EVCS, and our results underscore the effectiveness of our proposed methodology, achieving an average testing accuracy of 99.42%, thereby reinforcing the cyber-physical security of EVCS.