The deployment of electric vehicles (EVs) requires the integration of information and communication technologies, making power grids prone to cyber threats from EV cyber-infrastructure. On this basis, this paper studies the impact of a new family of EV-based load-altering attacks (EV-LAA) against the subsynchronous stability of the power grid. First, the cyber-physical connections between the EV ecosystem and the power grid are discussed to represent a threat model for coordinated electric vehicle switching attacks (EVSAs) that can excite torsional modes of the system. Then, it will be demonstrated that a traditional proportional-integral (PI)-based subsynchronous resonance damping controller (SSRDC) cannot stabilize the power grid. With the help of a customized unknown input observer (UIO), an adaptive control framework is developed based on a model predictive control (MPC). This framework can generate online control signals and add them to the internal control framework of the synchronous generators (SGs). A modified IEEE Second Benchmark (M-IEEE-SBM) is used to demonstrate the EV-LAAs' consequences and evaluate the effectiveness of the developed adaptive technique. The proposed strategy is also studied through real-time simulations under a testbed that integrates a virtual sphere (vSphere) for an EV ecosystem with power grids simulated in a real-time simulator (i.e., OPAL-RT 5650). To demonstrate the feasibility of this switching attack vector in an actual power system and its impact on SSR stability, the Palo Verde Nuclear Generating Station (PVNGS) is also simulated in this real-time simulator, and the effectiveness of the proposed adaptive control framework is validated under the EV-LAAs.

Recently, there has been a surge of interest in analyzing and modeling emerging cyberattacks resulting from supply chain vulnerabilities in smart grids. These vulnerabilities are deliberately injected into devices before shipment by a malicious or trustworthy but compromised vendor during supply chain attacks. As a result, those vulnerabilities possess unique characteristics, such as stealthiness. Such characteristics, together with the limited number of vendors, demand new techniques for measuring the security posture of smart grids in the presence of those vulnerabilities. On this basis, this article first defines a supply chain risk metric to measure the risks of different devices containing those vulnerabilities based on several risk factors. Afterward, we enhance the previously defined$kSupply$metric and propose a new metric, namely$kSupplier$to include vendors in the risk assessment. Finally, we evaluate the proposed metrics and models through simulations conducted on IEEE 14 and 39-bus systems.

The Electric Vehicle (EV) charging infrastructure has been rapidly expanding to keep up with the increased demands of EV consumers. This government-backed infrastructure expansion resulted in the rushed integration of a significant number of insecure EV Charging Stations (EVCS), which are vulnerable to cyber-attacks. Motivated by the uncovered vulnerabilities in different components of the EV charging infrastructure, in this paper, we study the security of the EVCS Cloud Management System (CMS). Specifically, we focus on the (in)security of the Open Charge Point Protocol (OCPP) backend communication with the EVCS. We verified the prevalence of such security weaknesses by discovering 6 zero-day vulnerabilities in each of the 16 representative live EV charging management systems. Our findings highlight the insecurity of the OCPP backend, which is widely deployed on existing EVCSs in the wild. Indeed, we discuss various attack scenarios that lead to man-in-the-middle, denial of service, firmware theft, and data poisoning, to name a few. We also leverage the developed testbed to demonstrate the feasibility of launching switching attacks against the power grid using compromised EVCSs. Finally, we contribute to the security of the EV charging ecosystem by also recommending countermeasures to mitigate/prevent future cyber-attacks.

Electric Vehicles (EV) have experienced a tremendous rise in popularity as they offer a sustainable alternative to conventional vehicles. However, the EV ecosystem is a complex system consisting of many interconnected components such as the EV Charging Station (CS) and the EV Charging Station Management System (CSMS). Given its connection to the smart grid and its direct impact on the transportation sector, securing the EV ecosystem is essential and requires the design of novel monitoring solutions. Previous studies proposed single-component detection mechanisms that cannot detect all potential anomalies across the system. Our work addresses this issue through the combination and correlation of monitoring data collected from the different EV ecosystem components. Our objective is to develop a real-time monitoring platform for attack detection in the public EV charging ecosystem that is based on the extension of the IEC 62351-7:2017 Network and System Management (NSM) standard. By adopting an international security standard, we ensure the monitoring platform is compatible with international power systems. To validate the utility of the approach, we integrate the monitoring framework with a real-time EV charging cosimulation testbed and discuss how it can be used to detect EV-based cyberattacks.

Abstract With the increasing effects of climate change, the urgency to step away from fossil fuels is greater than ever before. Electric vehicles (EVs) are one way to diminish these effects, but their widespread adoption is often limited by the insufficient availability of charging stations. In this work, our goal is to expand the infrastructure of EV charging stations, in order to provide a better quality of service in terms of user satisfaction (and availability of charging stations). Specifically, our focus is directed towards urban areas. We first propose a model for the assignment of EV charging demand to stations, framing it as a maximum flow problem. This model is the basis for the evaluation of user satisfaction with a given charging infrastructure. Secondly, we incorporate the maximum flow model into a mixed‐integer linear program, where decisions on the opening of new stations and on the expansion of their capacity through additional outlets is accounted for. We showcase our methodology for the city of Montreal, demonstrating the scalability of our approach to handle real‐world scenarios. We conclude that considering both spacial and temporal variations in charging demand is meaningful when solving realistic instances.

This work presents an investigation and assessment framework, which, supported by realistic data, aims at provisioning operators with in-depth insights into the consumer-perceived Quality-of-Experience (QoE) at public Electric Vehicle (EV) charging infrastructures. Motivated by the unprecedented EV market growth, it is suspected that the existing charging infrastructure will soon be no longer capable of sustaining the rapidly growing charging demands; let alone that the currently adopted ad hoc infrastructure expansion strategies seem to be far from contributing any quality service sustainability solutions that tangibly reduce (ultimately mitigate) the severity of this problem. Without suitable QoE metrics, operators, today, face remarkable difficulty in assessing the performance of EV Charging Stations (EVCSs) in this regard. This paper aims at filling this gap through the formulation of novel and original critical QoE performance metrics that provide operators with visibility into the per-EVCS operational dynamics and allow for the optimization of these stations’ respective utilization. Such metrics shall then be used as inputs to a Machine Learning model finely tailored and trained using recent real-world data sets for the purpose of forecasting future long-term EVCS loads. This will, in turn, allow for making informed optimal EV charging infrastructure expansions that will be capable of reliably coping with the rising EV charging demands and maintaining acceptable QoE levels. The model’s accuracy has been tested and extensive simulations are conducted to evaluate the achieved performance in terms of the above-listed metrics and show the suitability of the recommended infrastructure expansions.

This work targets enhancing the quality of charging experience in Electric Vehicle (EV) Public Charging Infrastructure (PCI) networks. The estimation uncertainty of waiting times at charging stations (CSs) hinders the proliferation of such networks and, hence, decelerates EV adoption. Currently, most EV owners prefer to use private chargers; thus, overloading the energy distribution network leaving PCIs under-utilized. Consequently, it becomes important for PCI operators to provide customers with accurate waiting time estimates at various CSs; therefore, allowing them to make more informed CS selections. The per-CS EV waiting times reveal possible CS overloads, which, when frequently repetitive, indicate the need for PCI up-scaling to satisfy increasing demands; hence, ensuring elevated customer QoE. This paper leverages recent real-world data to unveil the statistical properties of EV charging times that, unlike existing studies, are found to be best captured by an Erlang-${k}$distribution. Also, the per-CS charging request arrival processes are characterized under various scheduling policies. It is established hereafter that CSs can be accurately modelled as single-server queuing systems. Finally, extensive simulations are conducted to verify the accuracy of the proposed models and provide further insights into the waiting time performance achieved by each of the adopted scheduling policies.

Electric Vehicle Charging Stations (EVCSs) have been shown to be susceptible to remote exploitation due to manufacturer-induced vulnerabilities, demonstrated by recent attacks on this ecosystem. What is more alarming is that compromising these high-wattage IoT systems can be leveraged to perform coordinated oscillatory load attacks against the power grid which could lead to the instability of this critical infrastructure. In this paper, we investigate a previously sidelined aspect of EVCS security. We analyze the deployment security of EVCSs and highlight operator-induced vulnerabilities rendering the ecosystem exposed to remote intrusions. We create an advanced discovery technique that leverages Web interface artifacts to dynamically discover new charging station vendors. As a result, we uncover 33,320 charging station management systems in the wild. Consequently, we study the deployment security of the charging stations and identify that 28,046 EVCSs were found to be vulnerable to eavesdropping, and around 24% of the studied EVCSs are deployed with default configurations exposing the ecosystem to a Mirai-like attack vector. Aligned with this finding, we discover that the EVCS ecosystem has been targeted by nefarious IoT malware such as Mirai and its variants. This demonstrates that further security measures should be implemented by vendors and operators to ensure the security of this vital ecosystem. Consequently, we provide a comprehensive recommendation for securing the deployment of EVCSs.

In line with the global push towards smart cities, the world is increasingly adopting Electric Vehicles (EVs). This increased EV proliferation is putting the Public Charging Infrastructure (PCI) under a large strain. To this end, this work presents a data-driven analysis of the Quality of Service (QoS) on the current EV PCI. This work presents a comprehensive set of metrics that are developed to evaluate the QoS at the current PCI in Quebec, Canada. The analysis is performed on a real dataset covering 5 full years of over 7,000 EV Charging Stations (EVCSs) in Quebec. This data is then used to create a forecast model for predicting future EV charging requests and assessing their impact on the QOS at the current PCI deployment levels. The developed metrics and forecast model are used to recommend new EVCS deployment sites to guarantee acceptable QoS levels in the future based on the current trends in EV adoption.

We present a new model for finding the optimal placement of electric vehicle charging stations across a multiperiod time frame so as to maximise electric vehicle adoption. Via the use of stochastic discrete choice models and user classes, this work allows for a granular modelling of user attributes and their preferences in regard to charging station characteristics. We adopt a simulation approach and precompute error terms for each option available to users for a given number of scenarios. This results in a bilevel optimisation model that is, however, intractable for all but the simplest instances. Our major contribution is a reformulation into a maximum covering model, which uses the precomputed error terms to calculate the users covered by each charging station. This allows solutions to be found more efficiently than for the bilevel formulation. The maximum covering formulation remains intractable in some instances, so we propose rolling horizon, greedy, and greedy randomised adaptive search procedure heuristics to obtain good-quality solutions more efficiently. Extensive computational results are provided, and they compare the maximum covering formulation with the current state of the art for both exact solutions and the heuristic methods. History: Accepted by Andrea Lodi, Area Editor for Design & Analysis of Algorithms–Discrete. Funding: This work was supported by Hydro-Québec and the Natural Sciences and Engineering Research Council of Canada [Discovery Grant 2017-06054; Collaborative Research and Development Grant CRDPJ 536757–19]. Supplemental Material: The online appendix is available at https://doi.org/10.1287/ijoc.2022.0185 .

The adoption rate of EVs has witnessed a significant increase in recent years driven by multiple factors, chief among which is the increased flexibility and ease of access to charging infrastructure. To improve user experience and increase system flexibility, mobile applications have been incorporated into the EV charging ecosystem. EV charging mobile applications allow consumers to remotely trigger actions on charging stations and use functionalities such as start/stop charging sessions, pay for usage, and locate charging stations, to name a few. In this article, we study the security posture of the EV charging ecosystem against a new type of remote that exploits vulnerabilities in the EV charging mobile applications as an attack surface. We leverage a combination of static and dynamic analysis techniques to analyze the security of widely used EV charging mobile applications. Our analysis was performed on 31 of the most widely used mobile applications including their interactions with various components such as cloud management systems. The attack scenarios that exploit these vulnerabilities were verified on a real-time co-simulation test bed. Our discoveries indicate the lack of user/vehicle verification and improper authorization for critical functions, which allow adversaries to remotely hijack charging sessions and launch attacks against the connected critical infrastructure. The attacks were demonstrated using the EVCS mobile applications showing the feasibility and the applicability of our attacks. Indeed, we discuss specific remote attack scenarios and their impact on EV users. More importantly, our analysis results demonstrate the feasibility of leveraging existing vulnerabilities across various EV charging mobile applications to perform wide-scale coordinated remote charging/discharging attacks against the connected critical infrastructure (e.g., power grid), with significant economical and operational implications. Finally, we propose countermeasures to secure the infrastructure and impede adversaries from performing reconnaissance and launching remote attacks using compromised accounts.

According to International Electrotechnical Commission (IEC) 61850-90-4, most smart grid substations are designed with redundancy in order to improve their availability in case of failures. Redundancy usually takes the form of having multiple subsystems with identical functionality based on the assumption that failures in one subsystem are isolated from other subsystems. However, this is not necessarily true in the case of failures caused by malicious attacks, because attackers can easily reuse their skills and tools across different subsystems under similar configurations. Taking this into consideration, this article introduces the factor of security (FoS) metrics to quantify the security effectiveness of redundant subsystems in smart grids. Specifically, we first apply the attack graph model to capture various threats in smart grids and substations; we then formally define the FoS metric and the probabilistic FoS metric, and finally we evaluate those metrics through simulations.

The gaining momentum of Electric Vehicles’ (EV) market is hindered mainly due to the range anxiety. Accordingly, a ubiquitous charging station (CS) network is becoming indispensable. However, due to the lack of reservations or check-in policies in EV charging, users and operators are not provided proper information regarding waiting time at public CSs. This renders users reluctant to use public CSs. In addition, this incomplete information, creates difficulties in the deployment and operation of CSs. Evidently, there is a need to improve the Quality-of-Service (QoS) such as minimizing the waiting time or blocking probability. Therefore, CS owners rely during the designing stage on some theoretical distribution for the associated parameters assumption (i.e., battery capacity, charging demand, charging time, waiting time, etc.). To alleviate this situation, instead of depending on theoretical assumptions, real CSs usage data for EV charging are analyzed to acquire data driven distributions. Moreover, since the charging rate is dependent on the State of Charge (SoC), instead of a constant charging rate, a SoC dependent charging model based on real experimental data is proposed and evaluated with real data. Finally, exploiting the acquired distributions and charging model, variations of the$M/G/k$queuing system to approximate the waiting time, reneging probability and blocking probability is implemented. A detailed simulation is placed and the findings provide a direction for CS owners in determining the capacity (i.e., number of outlets) or parking area size to enhance the QoS.

Industrial Control Systems (ICSs) are cyber-physical systems that offer attractive targets to threat actors due to the scale of damages, both physical and cyber, that successful exploitation can cause. As such, ICSs often find themselves victims to reconnaissance campaigns - coordinated scanning activity that targets a wide subset of the Internet - that aim to discover vulnerable systems. As these campaigns likely scan broad netblocks of the Internet, some traffic is directed to network telescopes, which are routable, allocated, and unused IP space. In this paper, we explore the threat landscape of ICS devices by analyzing and investigating network telescope traffic. Our network traffic analysis tool takes darknet traffic and generates threat intelligence on scanning campaigns targeting ICSs in the form of campaign fragments, which we leverage in new ways to get more in-depth knowledge of the cybersecurity threats. We investigate the payloads of the identified campaigns using a custom Deep Packet Inspection (DPI) technique to dissect and analyze the packets. We found 13 distinct payload templates and deduced their purpose, and by extension the campaign goals. We use machine learning to classify the sources behind the campaigns and identify threat actors such as botnets, malicious attackers, or researchers, and establish a methodology to rank our campaigns to prioritize our analysis. To conduct our analysis of the threats targeting ICSs, we have leveraged 12.85 TB (330 days) of network traffic received by our observed darknet IP space. Combining these investigative threads, we provide a thorough overview of the threat landscape targeting ICS systems.

With the growing market of Electric Vehicles (EV), the procurement of their charging infrastructure plays a crucial role in their adoption. Within the revolution of Internet of Things, the EV charging infrastructure is getting on board with the introduction of smart Electric Vehicle Charging Stations (EVCS), a myriad set of communication protocols, and different entities. We provide in this article an overview of this infrastructure detailing the participating entities and the communication protocols. Further, we contextualize the current deployment of EVCSs through the use of available public data. In the light of such a survey, we identify two key concerns, the lack of standardization and multiple points of failures, which renders the current deployment of EV charging infrastructure vulnerable to an array of different attacks. Moreover, we propose a novel attack scenario that exploits the unique characteristics of the EVCSs and their protocol (such as high power wattage and support for reverse power flow) to cause disturbances to the power grid. We investigate three different attack variations; sudden surge in power demand, sudden surge in power supply, and a switching attack. To support our claims, we showcase using a real-world example how an adversary can compromise an EVCS and create a traffic bottleneck by tampering with the charging schedules of EVs. Further, we perform a simulation-based study of the impact of our proposed attack variations on the WSCC 9 bus system. Our simulations show that an adversary can cause devastating effects on the power grid, which might result in blackout and cascading failure by comprising a small number of EVCSs.

Driven by the expeditious evolution of the Internet of Things, the conventional vehicular ad hoc networks will progress toward the Internet of Vehicles (IoV). With the rapid development of computation and communication technologies, IoV promises huge commercial interest and research value, thereby attracting a large number of companies and researchers. In an effort to satisfy the driver's well-being and demand for continuous connectivity in the IoV era, this paper addresses both safety and quality-of-service (QoS) concerns in a green, balanced, connected, and efficient vehicular network. Using the recent advances in training deep neural networks, we exploit the deep reinforcement learning model, namely deep Q-network, which learns a scheduling policy from high-dimensional inputs corresponding to the current characteristics of the underlying model. The realized policy serves to extend the lifetime of the battery-powered vehicular network while promoting a safe environment that meets acceptable QoS levels. Our presented deep reinforcement learning model is found to outperform several scheduling benchmarks in terms of completed request percentage (10-25%), mean request delay (10-15%), and total network lifetime (5-65%).

The proper design of a vehicular network is the key expeditor for establishing an efficient Intelligent Transportation System, which enables diverse applications associated with traffic safety, traffic efficiency, and the entertainment of commuting passengers. In this paper, we address both safety and Quality-of-Service (QoS) concerns in a green Vehicle-to-Infrastructure communication scenario. Using the recent advances in training deep neural networks, we present a deep reinforcement learning model, namely deep Q-network, that learns an energy-efficient scheduling policy from high-dimensional inputs corresponding to the characteristics and requirements of vehicles residing within a RoadSide Unit's (RSU) communication range. The realized policy serves to extend the lifetime of the battery-powered RSU while promoting a safe environment that meets acceptable QoS levels. Our presented deep reinforcement learning model is found to outperform both random and greedy scheduling benchmarks.

Vehicular Ad hoc Networks have been receiving significant interest during the past years as they support both safety and non-safety applications for passengers commuting onboard smart vehicles. Vehicles may communicate with each others for the purpose of sharing information. Moreover, they may be privileged by Broadband Internet access as well as other services provisioned by stationary Roadside Units (RSUs) deployed along the roadways. When a vehicle leaves the coverage range of an RSU, it enters a dark area. However, it may still maintain connectivity with the RSU through multi-hop communication with other cooperative vehicles serving as intermediate relays. In this paper, we study the probability of establishing a connectivity path between a far away vehicle residing in a dark area and an RSU deployed along a roadway experiencing free-flow traffic conditions. For this purpose, we establish a stochastic mathematical framework which jointly considers the availability of intermediate relay vehicles as well as their ability to capture the communication channel in a contention-based MAC environment. Extensive simulations were conducted for the purpose of validating the derived expressions and examining the throughput performance of the system.

This paper revolves around the evaluation of the achievable throughput in the context of an IEEE 802.11p-based vehicular subnetwork scenario where a completely isolated source vehicle, S, desires to communicate with a distant stationary Roadside Internet Gateway (RIG), D. Multi-hop inter-vehicular communication is exploited for the purpose of establishing a path between S and D along which downstream cooperative vehicles serve intermediate packet relays. The formation of such a path is governed by the vehicular traffic behaviour as well as the per-hop contention-oriented data forwarding process. Following the formation of a continuous chain of in-range cooperative vehicles between an arbitrary source-destination pair (S,D), a stochastic analytical framework is developed with the objective of determining the probability of successful data transfer from S to D taking into account the per-hop vehicle contentions for channel access. Then, theoretical expressions for the achievable per-hop as well as the end-to-end throughput are presented. Simulations are conducted for purpose of validating the presented analysis and evaluating the considered subnetwork's performance.

Broadband Internet access provisioning in vehicular environments requires establishing on-the-fly connectivity between mobile vehicles and stationary Internet gateways deployed along roadways. The literature encloses various works revolving around vehicle-to-infrastructure (V2I) communication schemes designed to cater for this objective. In this paper, two novel complexity minimal MAC schemes are proposed for drive-thru Internet (DTI) access provisioning systems. The first of these schemes is called the random vehicle selection (RVS) scheme, and the second is called the least residual residence time (LRT) scheme. A mathematical framework is established with the objective of modeling a vehicle's onboard unit's buffer and evaluating its performance under RVS and LRT, in terms of several quality-of-service metrics. Extensive simulations are conducted for the purpose of verifying the proposed models' validity and accuracy.