The increasing digitalization of energy infrastructures, particularly electric vehicle (EV) charging systems, has expanded their vulnerability to cyber threats. This paper presents a modular AI-driven platform for detecting attacks on EV charging infrastructures. The platform combines real-time data collection tools (Tshark, Nozomi Guardian, SNMP/Syslog, Elasticsearch Logstash and Kibana (ELK)) with Long Short-Term Memory (LSTM) Autoencoder-based anomaly detection. Data were gathered from a charging facility at RSE with twelve OCPP-J v1.6 charging stations, including normal and simulated Denial of Service (DoS) scenarios. The model, trained on multivariate time-series traffic data, achieved 97.1% Accuracy and 98.6% Recall, ensuring robust anomaly detection and minimizing false negatives. Although Precision was lower (52%) due to traffic variability, the system effectively detected both cyber-induced and operational anomalies, such as station disconnections. This work demonstrates the value of integrating deep learning with real-time monitoring to enhance the resilience of smart energy systems. Future developments will focus on improving precision, expanding protocol coverage, and addressing advanced threats such as data injection and Man-in-the-Middle attacks.

This work proposes an approach based on dynamic Bayesian networks to support the cybersecurity analysis of network-based controllers in distributed energy plants. We built a system model that exploits real world context information from both information and operational technology environments in the energy infrastructure, and we use it to demonstrate the value of security evidence for time-driven predictive and diagnostic analyses. The innovative contribution of this work is in the methodology capability of capturing the causal and temporal dependencies involved in the assessment of security threats, and in the introduction of security analytics supporting the configuration of anomaly detection platforms for digital energy infrastructures.

SecuriDN v. $0.1$ is a tool for the representation of the assets composing the IT and the OT subsystems of Distributed Energy Resources (DERs) control networks and the possible cyberattacks that can threaten them. It is part of a platform that allows the evaluation of the security risks of DER control systems. SecuriDN is a multi-formalism tool, meaning that it manages several types of models: architecture graph, attack graphs and Dynamic Bayesian Networks (DBNs). In particular, each asset in the architecture is characterized by an attack graph showing the combinations of attack techniques that may affect the asset. By merging the attack graphs according to the asset associations in the architecture, a DBN is generated. Then, the evidence-based and time-driven probabilistic analysis of the DBN permits the quantification of the system security level. Indeed, the DBN probabilistic graphical model can be analyzed through inference algorithms, suitable for forward and backward assessment of the system’s belief state. In this paper, the features and the main goals of SecuriDN are described and illustrated through a simplified but realistic case study.

In order to evaluate the resiliency of architectures supporting teleoperation functions, a laboratory testbed, described in the paper, is being developed by CESI RICERCA in the context of the European Project CRUTIAL. The testbed implements a prototypal but significant power system control architecture with its integrated ICT infrastructure. (4 pages)

The growing decentralization of electro-energetic infrastructures and the consequent need for remote monitoring of bidirectional power flows have expanded the attack surface of modern Cyber Physical Power Systems (CPPSs), exposing them to more sophisticated cyber threats. This work proposes a cyberattack modeling and detection framework based on Dynamic Bayesian Networks (DBNs) to model and analyze causal dependencies between attack steps and detection analytics in power systems. We extend classical attack graph models by incorporating MITRE ATT&CK techniques and we present how this formalism can be converted in the corresponding DBN, enabling both predictive and diagnostic inference. To achieve real-time applicability, we analyze the Boyen–Koller (BK) approximate inference algorithm under multiple clustering strategies, including a heuristic configuration (CL) and a fully factorized baseline (FF), comparing them to exact inference (EX). Our evaluation, performed across simulated attack scenarios, with and without monitoring evidence, examines tradeoffs between inference accuracy and computational efficiency using Kullback–Leibler divergence, computation time and memory utilization metrics. Experimental results show that the CL configuration consistently achieves the lowest approximation error (KL divergence below 1.25 × 10⁻⁴ of the exact solution), while the FF clustering maintains comparable accuracy (within 2×10⁻² divergence) when performing inference on the target variable (‘‘UnstablePS’’) in scenarios without evidence. In terms of resource consumption, both CL and FF configurations reduce average computation time by an order of magnitude (0.03 s per slice vs. 0.22 s for exact inference) and memory usage by more than 95% (tens of MB vs. several GB), making them both a practical and scalable option for real-time cybersecurity inference in critical energy infrastructures.