Security of Terminals: AI Against Cyber Threats

AI Agents to Secure Electric Charging Stations

At the University of Malaga, researchers have developed an innovative system of AI agents to protect electric charging networks. These agents are capable of monitoring their local environment in real-time and sharing their observations with other agents to establish a collective diagnosis. The goal is to detect energy theft and cyberattacks before they spread.

In France, the number of public charging stations reached nearly 195,000 as of April 30, according to the Avere barometer, compared to 168,000 a year earlier. Many stations have migrated to cloud systems, often via the Open Charge Point Protocol (OCPP), an open standard that manages authentication, billing, and remote charging management. However, the majority of stations still operate under version 1.6J, which has vulnerabilities. An attacker can hijack a session, interrupt a charging process, or siphon off energy without physical contact with the station. Two years ago, over 116,000 records of European users were compromised following the hacking of several poorly secured operators.

Limitations of Centralized Monitoring

Currently, OCPP networks use a centralized system to collect data from charging stations and detect anomalies. Cristina Alcaraz, a researcher in infrastructure security at the NICS laboratory of the University of Malaga, published her work in the International Journal of Critical Infrastructure Protection. She emphasizes that this system does not allow for precise identification of which component is compromised or the extent of the attack.

The NICS laboratory's device adopts a decentralized approach. Each charging station or critical component of the network is equipped with an autonomous AI agent. These agents analyze their local environment and share their observations with neighboring agents. They assess the status of chargers, communications, and connected devices to detect anomalies, failures, or potential security incidents.

The agents compare their local readings with those of nearby stations and build a contextualized picture of the situation across the network. To decide on the nature of an anomaly, the system employs a consensus mechanism based on opinion dynamics theory. This principle allows the AI agents to gradually refine their common diagnosis. During tests in a simulated environment, the system demonstrated a significant reduction in false positives and effective detection of behavioral anomalies affecting multiple stations simultaneously. An immutable blockchain ledger archives all transactions of the agents, ensuring complete traceability.

Risks of Destabilizing Electrical Networks

An attacker who controls a sufficient number of stations on the same network node can manipulate the aggregated electricity demand, creating artificial consumption peaks or troughs. Such coordinated attacks can destabilize local distribution networks. Traditional monitoring systems, designed to detect incidents station by station, cannot identify these cross-cutting anomalies.

Thanks to the continuous sharing of readings by the agents, abnormal consumption behavior on a group of geographically close stations triggers an aggregated alert, even if each station individually appears to be functioning normally. During simulation tests, the system detected local anomalies and behavioral patterns affecting multiple charging stations simultaneously.

The more secure version 2.0.1 of the protocol has not yet replaced 1.6J on the majority of installed stations. The Malaga laboratory is now working on a deployment in a real-world environment.