Autoencoder-based Detection of Stealthy Under-billing and Over-billing Attacks via Manipulation of OCPP 2.0.1 Payloads

The rapid growth of Electric Vehicle (EV) charging infrastructure has introduced critical cybersecurity challenges. Particularly, stealthy attacks that manipulate billing data by exploiting the Open Charge Point Protocol (OCPP) 2.0.1 have become a real threat. This paper identifies two novel attack vectors, stealthy under-billing, where the adversaries disguise energy consumption to reduce their payments, and stealthy over-billing, where they inflate costs by falsifying session data. In contrast to the traditional attacks, these exploits mimic legitimate charging behavior, thus, rule-based detection is not applicable. To address this challenge, we propose an autoencoder (AE)-based anomaly detection framework, deploying two specialized models: Under-bill-AE for non-concurrent sessions and Over-bill-AE for concurrent sessions. Our proposed solution is trained on real-world and synthetic datasets. The testing and validation result in exceptional detection performance, with Under-bill-AE attaining a 97.9% F1 score and Over-bill-AE reaching 80.84%. Also, a detailed comparative evaluation of the proposed solution to unsupervised approaches, like Isolation Forest, demonstrates its superiority and robustness in terms of identifying subtle billing manipulations while minimizing false positives.