Evaluating 5G-enabled EV Charging Infrastructure's Resilience Through Stealthy Cyber-Attacks

Evaluating 5G-enabled EV Charging Infrastructure’s Resilience Through Stealthy Cyber-Attacks Dimitrios Psaltis∗, Konstantinos Ntouros†, Alexios Lekidis‡, Sotirios Brotsis§, and Nicholas Kolokotronis¶ Department of Energy Systems, University of Thessaly, Larissa 41500, Greece Email: ∗[email protected], ‡[email protected] Department of Informatics and Telecommunications, University of the Peloponnese, 22131 Tripolis, Greece Email: †[email protected], §[email protected], ¶[email protected] Abstract—The adoption of Electric Vehicles (EVs) over the last years has gained increased attention due to the technological, financial, and environmental gains they offer. However, it has also introduced a vast and exponentially growing threat landscape, which is also complex to analyze. The complexity is even increased when considering the current integration of EV chargers in 5G-oriented network slices and architectures. Hence, the threat landscape analysis becomes crucial to derive the Tactics, Techniques, and Procedures (TTPs) that are applicable to the EV-oriented ecosystem as well as their impact on the underlying charging infrastructure. This paper proposes a framework for conducting stealthy attack scenarios and validating their impact on the EV charging infrastructure. In the current version of the framework, two prominent attack types are included: the Denial of Charge when legitimate users are using the EV charging stations and the False Data Injection, tampering with the meter values during and at the end of the charging transaction. For these scenarios, we describe the testbed that is used to conduct the cyber-attacks, provide a detailed overview of the TTPs, and demonstrate their impact on the charging infrastructure. Index Terms—EV charging, cyber-attacks, OCPP, False Data Injection, Denial of Charge I. INTRODUCTION E-mobility is a technological advancement that has been widely adopted over the last years since it provides environmental and financial gains aside from the digitization aspects [1]. The main pillar for the e-mobility ecosystem is the Electric Vehicle (EV) infrastructure with multiple connectivity interfaces to exchange charging data, as well as operational status information, like notifications and diagnostics. With the increase in the acceptance of EVs, the underlying charging infrastructure has evolved as a significant part of smart mobility and energy distribution [2]. As charging systems are significantly relying on internet-connected and cloud-based systems to offer intelligent monitoring, charging, and billing information, but also provide automation and convenience to EV users. The authors D. Psaltis and K. Ntouros have equally contributed. This work is partially funded by the European Union. Views and opinions expressed are, however, those of the author(s) only and do not necessarily reflect those of the European Union or Smart Networks and Services Joint Undertaking. Neither the European Union nor the granting authority can be held responsible for them. The XTRUST-6G project (GA no. 101192749) is supported by the 6GSNS and its members. Nevertheless, the increased presence of different interfaces comes with new forms of cyber-attacks that are targeting the EV infrastructure. The risk is even greater when considering that such attacks may propagate even further towards the electricity grid with catastrophic consequences. Examples of such risks include the exposed vulnerabilities for Volkswagen EVs, which resulted in a massive leakage of 800,000 EV drivers’ sensitive data1. Furthermore, such attacks can also lead to financial impact, as the recent attack against a known EV infrastructure provider2, which resulted in withdrawing $2000 on average from each EV driver using the service. The attack surface is even expanded since the EV chargers are using cellular connectivity and are gradually integrated in 5G and beyond towards 6G networks [3]. In such networks, there are multiple attack vectors originating from the multitenant and multi-domain architectures [4]. To better understand, however, the means that adversaries employ to perform cyber-attacks against the EV infrastructure, as the initial access through, for instance, the cellular infrastructure or the impact that may be caused to the EV infrastructure components, a thorough analysis of the TTPs has to be conducted. To the best of our knowledge, such an analysis is not present up to this point in relevant literature work. Hence, in this paper, we propose a new EV charging framework that is used for the design and implementation of cyber-attack scenarios. Concretely, this paper provides the following contributions: •Design and implementation of a framework for conducting cyber-attack scenarios against the EV charging infrastructure. •Development of a testbed for testing prominent EV cyberattack scenarios, such as Denial of Charge (DoC) and False Data Injection (FDI). The rest of the paper is structured as follows. Section II provides a background on the EV charging infrastructure as well as the communication and security mechanisms that are used, as well as the related work for cyber-attacks in EV charging scenarios. Then, Section III describes the framework 1https://www.darkreading.com/cyber-attacks-data-breaches/volkswagenbreach-exposes-data-of-800k-customers 2https://medium.com/@ekarabatsakis/how-customers-helped-us-survive-acyber-attack-5ddd2729c3f3 architecture and testbed implementation for conducting cyberattack scenarios. The experiments of the conducted attack scenarios on the EV charging infrastructure testbed are described in Section IV. Finally, Section V summarizes the presented work and provides perspectives for future work. II. BACKGROUND This section provides an overview of the infrastructure for EV charging and the communication protocols within, along with the related work for EV charging attack scenarios. A. EV charging infrastructure The main entities that are involved in EV charging communications are the EVs, the EV Charging Stations (EVCS) and the Charging Station Management System (CSMS), which is a central platform allowing to monitor the status of EVCS and perform diagnostics on their operation; moreover, the CSMS allows the Charge Point Operator (CPO) to have an overview on the EV infrastructure availability as well as configuration and maintenance operations on the EVCSs. In terms of connectivity, the EVCS communicates with the EV through a wired cable, which also delivers the required energy to charge the batteries, while the communication is based on the IEC 61851 standard [5]. Additionally, the communication between the EVCS and the CSMS is based on both wired (i.e., Ethernet) and wireless (i.e., WiFi, cellular networks) interfaces and follows the Open Charge Point Protocol (OCPP) [6]. The usual wireless setup of EVCS is based on 3G SIM cards, and recently are also incorporated in 5G-enabled slices [3]. OCPP is widely used as the communication protocol between the EV charging stations and the Charging Station Management System (CSMS). It includes different versions starting from 1.2, then continued to 1.5, and finally to the OCPP version 1.6 that is currently employed. A new version was also released in January 2025, i.e., version 2.1, allowing bidirectional charging and Vehicle-To-Grid (V2G) scenarios [7]. However, all the existing chargers support version 1.6, which is widely considered a de facto standard for the EV infrastructure. OCPP 1.6 protocol supports several commands for managing the EV charging process and for providing status information. The most important amongst these commands include: •StartTransaction and StopTransaction for starting and stopping an EV charging session; •MeterValues for getting real-time current, voltage, and active/reactive power information — which is measured in watt-hours (Wh) — consumed while charging; and •StatusNotification for notifying the CPO through the CSMS system of the EVCS current status (i.e., if it is available or charging). Additionally, an important command for the EVCS operation is BootNotification, which allows the CSMS to understand that the EVCS has performed a reboot and is operational. Finally, amongst the most significant OCPP fields is also meterStop, since it measures the total energy consumed by the EV and provides the foundation for calculating the energy consumed and the associated cost on the utility bill. Hence, a data tampering attack on the meterStop can result in severe financial losses for the EV users [8]. In terms of security mechanisms, OCPP 1.6 allows for HTTP Basic Authentication as a method of verifying the identity of EVCS during initial connection setup. Before starting a charging session, the legitimacy of a user is inspected through the Authorize message, which includes the corresponding Identifier (ID) tag. This tag is compared against the valid ID tags that are stored on the CSMS database. OCPP supports the Transport Layer Security (TLS) protocol, which encrypts communication between the EVCS and the CSMS. Current practices suggest that CPOs shall use TLS 1.2 or higher to provide basic encryption against eavesdropping in the EV charging infrastructure. The security mechanisms of OCPP 1.6 were enriched in OCPP 2.1, and there are also mechanisms for the EV to EVCS communication specified in ISO 15118. However, most CPOs focus on developing the new OCPP 2.1 functionalities rather than investigating its security mechanisms. B. Related work The threat landscape in EV infrastructures is an area of growing interest in the literature, since a potential attack may lead to severe consequences both in the EVs as well as the electricity grid [9]. An initial taxonomy and analysis of the threats applicable to EV systems is conducted in [10]. Basnet et al. in [3] performed cyber-attacks against a 5Goriented EV charging infrastructure, focusing mostly on DoC and FDI scenarios and their infrastructure impact. Nevertheless, these attacks are modeled and simulated in the NetSim simulator3, whereas in our work, we focus on a framework and a testbed for conducting real attack scenarios. Other works are only focused on cyber-attacks targeting the EV charging infrastructure. Jeong et al. [11] presented a data injection attack between the EVCS and the EVs in a simulated environment that resulted in financial losses quantified in electricity cost. Tao et al. [12] conducted a simulated Distributed Denial of Service (DDoS) attack on an EVCS without the incorporation of additional stations or the CSMS. However, with the EV charging points to be substantially escalated in residential and public regions, the research on EVCS security has increased as well [13]. III. FRAMEWORK FOR EV CHARGING CYBER-ATTACKS The proposed framework provides a testbed of an EV charging ecosystem able to conduct both legitimate and cyberattack scenarios. The overview of the framework is illustrated in Fig. 1, in which an architectural representation of the EVs, the EVCSs, and the CSMS is presented. 3https://www.tetcos.com/index.html CSMS AC/DC EVCS AC/DC EVCS OCPP 1.6 WebSocket OCPP 1.6 WebSocket OCPP 1.6 WebSocket IEC 61851 IEC 61851 AC/DC EVCS IEC 61851 AC/DC EVCS IEC 61851 Fig. 1: The high-level architectural diagram of the EV charging infrastructure considered within the proposed framework A. Legitimate EV charging scenarios The proposed framework allows for performing legitimate EV charging scenarios in which the charging process is based on the OCPP 1.6 protocol, as illustrated in Fig. 2. The CSMS platform constantly interacts with the EVCSs in a persistent and bidirectional manner via the WebSocket protocol that is used alongside OCPP. A dynamic number of EVCSs, each acting as an OCPP client, can be deployed in the proposed architecture, also linked with a dynamic number of EVs, which can perform charging sessions simultaneously. Currently, an extension for OCPP 2.1 is being developed to support bidirectional charging scenarios and compatible EVCS. The extension includes commands for the TransactionEvent, NotifyEvent for status notifications, as well as SetVariables, and GetVariables to set and get the EVCS configurations. Also, RequestStartTransaction and RequestStopTransaction for starting and stopping the transaction respectively, and setting the charging profile with SetChargingProfile will be supported. Specifically, in the initial step of Fig. 2, the EVCS sends an HTTP request containing the information and its unique ID with which it will be connected in the CSMS database, and upon successful connection, a confirmation message is sent. Then, EVCS sends a message with the BootNotification request and the charger information and waits for the accepted response from the CSMS. If there is no active charging session (or a potential EVCS reservation for a charging session via OCPP [14]), the EVCS sends the StatusNotificationAvailable message to inform the CSMS that it is available and an EV can be connected for charging. After the EV has been connected to the EVCS, the EV user provides authorization details (i.e., through an idTag or in an ad-hoc manner through a credit card payment). In the former case, the idTag is verified against an existing CSMS database, and if it is legitimate, the charging process is initiated. In more detail, the StartTransaction message is sent EV EVCS CSMS GET 101 Switching Protocols() OCPP 1.6 WebSocket BootNotification.req BootNotification.conf StatusNotification.req Available StatusNotification.conf Plug-in cable Charging session StartTransaction.req StartTransaction.conf StatusNotification.req Charging StatusNotification.conf loop MeterValues.req MeterValues.conf StopTransaction.req StopTransaction.conf Unplug cable Transaction invoice StatusNotification.req Available StatusNotification.conf Fig. 2: The message sequence of a legitimate EV charging scenario in the proposed framework (following OCPP 1.6) to the CSMS containing the idTag and a timestamp with the current time that is used for verification. If the given idTag exists and is still active (i.e., has not expired based on the given timestamp), the StatusNotification charging message is sent to inform the CSMS that the charging session has been successfully initiated. While charging, the MeterValues are periodically received by the CSMS. Finally, when charging is complete, the StopTransaction message is sent containing information about the idTag, the transaction id, and the meterStop. B. Attack scenarios As a next step, we present the attacker’s involvement within the framework, facilitating the base to explore the common strategies on EV charging cyber-attacks and their implications. In the proposed framework, two main cyber-attack scenarios exist, namely DoC and FDI. These scenarios are considered to be prominent due to their presence in the relevant literature (see Section II), as well as their impact on the EV charging infrastructure. Specifically, the impact of both cyber-attacks is linked to the financial losses on both the EV user and the CPO, who is responsible for supplying the energy. Furthermore, in EVCS Attacker CSMS Charging session [retried many tim es] Modify Response StartTransaction.req StartTransaction.req StartTransaction.confReset.req Hard Reset Reboot BootNotification.req BootNotification.req BootNotification.confBootNotification.conf StatusNotification.req StatusNotification.req Preparing StatusNotification.confStatusNotification.conf Fig. 3: The DoC attack steps during the charging session the FDI attack, the impact can be more severe, resulting in regulatory issues and reputational impact for the CPO, who needs to ensure continuous compliance with the Measuring Instruments Directive (Directive 2014/32/EU)4in many EU countries. In addition, the tampered electricity values may also cause an electricity grid stress. Algorithm 1 Detection of EVCS and CSMS 1: Require: Kali Linux system 2: Connect to the same network with EVCS and CSMS 3: Run Bettercap 4: Set arp.spoof.fullduplex to true ▷Attack all targets and gateway 5: Set arp.spoof on ▷Enable ARP spoofing 6: Set net.sniff.verbose to true ▷Display all captured packets 7: Set net.sniff.output <filename>.pcap ▷Save captured packets to file 8: Set net.sniff on ▷Enable packet sniffing 9: Open the .pcap file in Wireshark 10: Detect the network IPs sending WebSocket packets 11: Output: IP addresses of EVCS and CSMS Initially, for performing the attack scenarios, the steps of Alg. 1 are followed. Specifically, the attacker gains access to the local network, where the CSMS and EVCSs are located. By identifying the IPs of the CSMS and EVCSs, the attacker launches a MitM attack using ARP spoofing. As presented in Fig. 3, after the MitM attack, all the communication messages are traversing through the attacker. Therefore, to launch a DoC or an FDI attack, the appropriate message needs to be falsified. Each message in the OCPP protocol has two parts, the Request and the Confirmation, starting with the numbers 2 and 3 as 4https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32014L0032 EVCS Attacker CSMS Charging session StartTransaction.req StartTransaction.req StartTransaction.confStartTransaction.conf StatusNotification.req StatusNotification.req Charging StatusNotification.confStatusNotification.conf loop Modify Wh Value MeterValues.req MeterValues.req MeterValues.conf MeterValues.conf Modify StopValue StopTransaction.req StopTransaction.req StopTransaction.conf StopTransaction.conf Fig. 4: The FDI attack sequence during the charging session well as with the following formats “2, UUID, Message” and “3, UUID, message”, respectively. The DoC is initiated based on the steps of Alg. 1. In particular, the attack is launched when a StartTransaction request is sent from the EVCS to CSMS, which would normally lead to the message’s acceptance or rejection. Instead, the attacker transforms this request into another OCPP message for performing a Hard Reset. Specifically, the ‘3,UUID,StartTransaction.conf” message is transformed by the attack to the “2,new_uuid, Reset.req”. Therefore, the EVCS receives a message to perform a reset instead of starting the charging session, and as a result, reboots. On the other hand, the EV driver is attempting to charge, without being aware of the attack, and as soon as the charger is back online, attempts to start the charging session again with the same outcome. Since the attack is launched on all the available chargers in the network, the same result, i.e., a DoC attack, occurs if the driver attempts to charge the EV at any EVCS in the same network. Similarly to the DoC attack, in FDI, the attacker falsifies the appropriate messages exchanged between the CSMS and the EVCSs, where the steps for performing the FDI attack are illustrated in Fig. 4. More specifically, the attacker spoofs the MeterValue.req message sent by the EVCS to the CSMS by maliciously modifying the value of the energy consumed that is measured in Wh. While the active charging session is being finalized through the StopTransaction.req, the attacker falsifies the charging values of the total energy consumed by the EV that is present in the meterStop value. Thus, the uniformity of the total consumed energy with the intermediate MeterValues makes the attack more difficult to detect. The detailed steps of the FDI attack are explained in Alg. 2, which is discussed in detail in Section IV. CSMS OCPP 1.6 WebSocket OCPP 1.6 WebSocket Attacker ARP Spoofing ARP Spoofing OCPP 1.6 WebSocket KEBA EVCS KEBA EVCS ABB EVCSKEBA EVCS 192.168.201.135 192.168.201.144 192.168.201.145 192.168.201.146 192.168.201.142 192.168.201.138 Fig. 5: The experimental testbed that was used for carrying out the cyber-attacks against the EV charging infrastructure IV. EXPERIMENTS This section aims to evaluate the adversarial interference on the proposed framework with a DoC attack and a manipulation of the reported meter values within the scope of an FDI attack. In both attacks, the communication between the EV charger and the CSMS is intercepted to modify the OCPP messages, where different messages are modified in each attack. A. EV charging testbed The testbed architecture is presented in Fig. 5 and is built on top of SAP’s e-Mobility charging stations simulator5, which simulates the behavior of the EVCSs and the charging EVs. The CSMS in the architecture is based on the Steve project6, a smart charging system for EVs that is responsible for the collection of real-time data from distributed charging stations. These data are linked to energy consumption, session metrics, users’ activities, and stations’ status, thus enabling CPOs to monitor systems’ performance and respond to possible issues promptly. The SteVe CSMS also allows the authentication of users’ sessions, which is performed via secure identifiers as Radio Frequency Identification (RFID) cards (or simply ID tags), but also the secure preservation of logs about each user’s interactions and session data. SteVe’s adoption in the proposed framework offers additional services for remote management, allowing CPOs to initiate or terminate charging transactions, reset hardware, and conduct firmware updates. Such functionalities not only depict valuable insights for billing, but also provide information about the system’s analytics and optimization, as well as efficient maintenance and diagnostics for CPOs [15]. B. Cyber-attack scenario implementation The conducted experiments were based on three KEBA AC and one ABB DC charging stations, that is, four EV charging 5https://github.com/sap/e-mobility-charging-stations-simulator 6https://github.com/steve-community/steve stations in total. Nevertheless, the proposed framework is built having scalability in mind, and therefore, the experiments can be conducted in a more extensive environment. The attacks are launched using Kali Linux7Operating System (OS), along with the mitmproxy tool8for conducting the MiTM attack and the Bettercap tool9for network layer monitoring. Initially, the attacker connects to the same local area network as the EVCS and CSMS systems, detects the IP addresses to spoof, and initiates the cyber-attack (Alg. 1). With the command set arp.spoof.fullduplex, the attacker performs ARP spoofing on both targeted systems and the gateway to monitor network activity. Then, using net.sniff.verbose and net.sniff.output records each packet sent to identify the WebSocket packets, while all the traffic is saved in a Packet Capture (i.e., .pcap) file. Finally, the Wireshark protocol analysis tool10 allows to detect which IP addresses exchange WebSocket packets. Depending on the WebSocket message that is transmitted in the network, the attacker detects the IP address of the CSMS and those of the EVCSs (from Alg. 1). Then, using mitmproxy as a transparent proxy, the traffic is redirected to a proxy server at the network layer, requiring no configuration at the (targeted) client side. Algorithm 2 Falsification of meter values 1: Require: Algorithm 1 2: Run mitmproxy as a transparent proxy 3: ARP spoofing between EVCSs, CSMS 4: if packet contains WebSocket messages then 5: Get last message →latest_msg ▷Decode as UTF-8 6: if identify MeterValues and Wh then 7: Value of unit Wh ←Reduce value by 50% 8: Modified value ←Value of unit Wh 9: else if identify StopTransaction and 10: meterStop then 11: meterStop ←Reduce value by 50% 12: Modified meterStop ←meterStop 13: end 14: end 15: Convert msg to JSON string →updated_msg ▷Encode as UTF-8 16: Output: Modified energy consumption data At the same time, the attacker performs an ARP spoofing attack between the EVCSs and the CSMS (as mentioned in Alg. 1) and configures the way to launch the data falsification attack (steps 4-15 of Alg. 2). Therefore, when a WebSocket packet containing an OCPP message is detected, mitmproxy decodes it as UTF-8 and if the keywords MeterValues and Wh are identified, modifies the Wh by reducing it by a 7https://www.kali.org/ 8https://mitmproxy.org/ 9https://www.bettercap.org/ 10https://www.wireshark.org/ Fig. 6: Original and falsified meter values of the FDI attack that targets the charging session custom value, which for this experiment is set to 50%. Then, the modified message is encoded into a UTF-8 JSON string and is sent back to the CSMS. The same happens when the keywords StopTransaction and meterStop are also detected. The mitmproxy modifies the value of MeterStop by reducing it by 50% and then encodes it back to UTF-8 JSON string and sends it to CSMS. Therefore, by falsifying the intermediate MeterValues and the final Stopvalue by the same percentage, the attack detection becomes challenging. The result of this attack is presented in Fig. 6. As depicted in the figure, the energy consumption during the charging session reaches almost 2.4 kWh, while the consumption received by the CSMS is reduced to half of the original value, i.e., 1.2 kWh, as a consequence of the FDI attack. In particular, Fig. 7 presents the logs from the mitmproxy environment where the cyber-attack is performed. The messages containing the original meter values are marked with a green bounding box, whereas the modified messages received by the CSMS are marked with a red one. Fig. 7: Log fragment from mitmproxy tool during the FDI attack with parts of an exchanged OCPP 1.6 message V. CONCLUSIONS This paper presented a newly introduced framework for conducting EV charging attack scenarios in a 5G-enabled infrastructure, to aid in understanding the attackers’ TTPs and their impact on the EV infrastructure. Future work aims at extending the attack scenarios considered as part of the framework. To this end, prominent attack scenarios that also relate to manipulating legitimate RFID tags and their associated timestamps to invalidate them and prevent a charging session from starting will be considered. Moreover, the charging profile manipulation and the parameters that should be used to stress the energy grid are also planned to be demonstrated. Finally, we will also consider introducing malware to cause DDoS attacks against multiple EVCSs located at different network segments, and we will investigate their impact on the EV charging service along with the cascading effects on the electricity grid. REFERENCES [1] A. Adib, K. K. Afridi, M. Amirabadi, F. Fateh, M. Ferdowsi, B. Lehman, L. H. Lewis, B. Mirafzal, M. Saeedifard, M. B. Shadmand et al., “E-mobility—advancements and challenges,” IEEE access, vol. 7, pp. 165 226–165 240, 2019. [2] A. Lekidis, “Anomaly detection mechanisms for in-vehicle and V2X systems,” in Proceedings of the 19th International Conference on Availability, Reliability and Security, ser. ARES ’24. New York, NY, USA: Association for Computing Machinery, 2024. [3] M. Basnet and M. H. Ali, “Exploring cybersecurity issues in 5G enabled electric vehicle charging station with deep learning,” IET Generation, Transmission & Distribution, vol. 15, no. 24, pp. 3435–3449, 2021. [4] T. Aljohani and A. Almutairi, “A comprehensive survey of cyberattacks on EVs: Research domains, attacks, defensive mechanisms, and verification methods,” Defence Technology, vol. 42, pp. 31–58, 2024. [5] P. Van Den Bossche, “IEC 61851-1: Electric vehicle conductive charging system-part 1: General requirements,” in 2. Iec, 2010, pp. 1–99. [6] J. Schmutzler, C. A. Andersen, and C. Wietfeld, “Evaluation of OCPP and IEC 61850 for smart charging electric vehicles,” World Electric Vehicle Journal, vol. 6, no. 4, pp. 863–874, 2013. [7] A. Lekidis, “E-mobility transition overview and insights from the greek market,” in 2024 International Conference on Renewable Energies and Smart Technologies (REST). IEEE, 2024, pp. 1–5. [8] M. A. Sayed, R. Atallah, C. Assi, and M. Debbabi, “Electric vehicle attack impact on power grid operation,” International Journal of Electrical Power & Energy Systems, vol. 137, p. 107784, 2022. [9] E. U. Soykan, M. Bagriyanik, and G. Soykan, “Disrupting the power grid via EV charging: The impact of the SMS phishing attacks,” Sustainable Energy, Grids and Networks, vol. 26, p. 100477, 2021. [10] T. Aljohani and A. Almutairi, “A comprehensive survey of cyberattacks on EVs: Research domains, attacks, defensive mechanisms, and verification methods,” Defence Technology, 2024. [11] S. I. Jeong and D.-H. Choi, “Electric vehicle user data-induced cyber attack on electric vehicle charging station,” IEEE Access, vol. 10, pp. 55 856–55 867, 2022. [12] Z. Tao, R. Fu, H. Shen, Y. Gu, and L. Qi, “Voltage regulation defense strategy for electric vehicle charging system under DoS attacks,” in 2023 35th Chinese Control and Decision Conference (CCDC), 2023, pp. 4272–4278. [13] D. Ronanki and H. Karneddi, “Electric vehicle charging infrastructure: Review, cyber security considerations, potential impacts, countermeasures, and future trends,” IEEE Journal of Emerging and Selected Topics in Power Electronics, vol. 12, no. 1, pp. 242–256, 2024. [14] S. Liu, X. Xia, Y. Cao, Q. Ni, X. Zhang, and L. Xu, “Reservation-based EV charging recommendation concerning charging urgency policy,” Sustainable Cities and Society, vol. 74, p. 103150, 2021. [15] D. Elmo, G. Fragkos, J. Johnson, K. Rohde, S. Salinas, and J. Zhang, “Disrupting EV charging sessions and gaining remote code execution with DoS, MITM, and code injection exploits using OCPP 1.6,” in 2023 Resilience Week (RWS), 2023, pp. 1–8.