Dual-Layer Intrusion Detection for EVSE Networks: A TinyML-Driven Security Framework

As Electric Vehicle (EV) charging stations become more prevalent to fuel the growing EV infrastructure, the Open Charge Point Protocol (OCPP) has become essential for connecting these chargers with their central management systems. Despite its popularity, OCPP version 1.6 lacks critical security features, making the charging infrastructure vulnerable to a range of cyberattacks, including Denial of Charging, Charging Profile Manipulation, Unauthorized Access, and Heartbeat Flooding. To tackle these issues, our work introduces a lightweight, Dual-Layer Intrusion Detection System (IDS) designed specifically for OCPP 1.6-enabled EV chargers. Our approach is built and validated using the Federated OCPP 1.6 Intrusion Detection Dataset. It relies on a neural network architecture that looks at both Application-level and Network-level data to detect suspicious behavior. For performance evaluation, we compared our neural network with a Random Forest (RF) baseline. Ultimately, the fully quantized INT8 Multi-Layer Perceptron (MLP) model was deployed to an ESP32 microcontroller, confirming that it can deliver robust performance on resource-constrained hardware. Testing showed that our dual-layer IDS provides high detection accuracy, achieving 96-98% post-deployment accuracy across protocol layers with low latency of 0.19 ms, and consuming only 14.77 μJ per inference. By comparing pre-deployment (on PC) and post-deployment (on-device) results, we tracked how the TinyML model's performance shifts from development to real-world edge deployment.