A Hybrid Anomaly Detection Method for Electric Vehicle Identification from Smart Meter Recordings

The increasing adoption of electric vehicles (EVs) and rooftop photovoltaic (PV) systems is reshaping residential electricity demand and creating new challenges for demand-side management (DSM), tariff design, and low-voltage network planning. Much of the existing literature examines EV charging or PV generation in isolation, leaving the behavioral dynamics of household co-adoption less understood. We develop an integrated, two-part workflow to analyze advanced metering infrastructure (AMI) data. A discovery component applies dynamic time warping (DTW) k-means with DTW barycenter averaging to cluster daily import or export profiles into interpretable behavioral archetypes, while a predictive component trains a bidirectional long short-term memory (BiLSTM) model on 21-day windows and benchmarks it against tabular baselines for PV/EV activity detection. The EV activity labels are inferred from charging-like load signatures because charger measurements are unavailable. Using half-hourly AusNet residential data from Victoria, Australia, the clustering uncovers distinct patterns across PV-only, EV-only, co-adoption, and neither cohorts; for co-adopters, a midday-centered weekday export archetype accounts for approximately 50% of days. At validation-tuned thresholds, both BiLSTM and XGBoost achieve strong discrimination. BiLSTM obtains 0.991 for the area under the receiver operating characteristic curve (AUROC), 0.906 for macro-F1, and the highest recall on the most difficult class (0.836 for EV-only recall). Tree-based baselines remain competitive. Performance remains stable across plausible labeling rules (macro-F1: 0.894--0.914) and strictly forward temporal splits (macro-F1: 0.894--0.906).

The increasing adoption of electric vehicles (EVs) is expected to place significant additional demand on residential distribution networks, creating a need for realistic charging datasets for planning and simulation studies. However, access to real-world EV charging data is often limited due to privacy constraints, incomplete records, and restricted availability. This paper proposes a conditional variational autoencoder (CVAE) for the generation of synthetic EV charging sessions from real transaction-level charging data. The model is trained on engineered session features describing plug-in duration, charging duration, delivered energy, charging delay, and cyclical time-of-week, while conditioning on day of week and managed charging status. A Gaussian negative log-likelihood (NLL) reconstruction loss is employed to model feature-wise heteroscedastic uncertainty, and the latent space is regularised using a Kullback-Leibler (KL) divergence term. The statistical fidelity of the generated data is evaluated using distributional metrics and downstream task performance through the Train-on-Synthetic-Test-on-Real (TSTR) protocol. Results demonstrate that the proposed approach produces synthetic EV charging sessions that preserve key statistical properties of the original dataset while supporting predictive modelling tasks.

Cyberattack detection in electric vehicle charging infrastructure is complicated by legitimate post-activation revisions to requested energy and departure time. Charging manipulation attacks can exploit the same interface and variables; therefore, detecting a request change alone does not establish malicious intent. This paper develops a leakage-controlled session-level benchmark that preserves the ordered inputs of real Adaptive Charging Network (ACN) sessions and models legitimate revisions as normal behavior. A fixed pool keeps each generated attack in its source session's split and contains six physically motivated attacks and their coordinated variants. We compare 22 profile-only, transition-aware, and context-stratified model families under common source-grouped folds, attack data, and operating constraints. The proposed Dual-Branch Masked-Autoencoder (Masked-AE) Transition Boost model evaluates whether the current request is normal and whether its producing transition resembles an observed benign update. Its state branch combines masked reconstruction with a radial-basis-function one-class support boundary, while its transition branch combines masked reconstruction with shrinkage covariance distance. Source-grouped five-fold cross-validation selects complete configurations under explicit overall-normal and benign-update acceptance constraints; disjoint normal data then calibrate the final threshold before one test evaluation. The developed dual-branch model provides the strongest robust validation performance while detecting malicious request manipulations without learning to reject legitimate user choices.