Securing the Electrified Future: A Systematic Review of Cyber Attacks, Intrusion and Anomaly Detection, and Authentication in Electric Vehicle Charging Infrastructure

Abstract

The growing popularity of electric vehicles (EVs) necessitates a robust and secure charging infrastructure. This review article analyzes the current state of cybersecurity challenges within EV charging ecosystems, focusing on vulnerabilities affecting charging stations, communication protocols, and grid integration technologies such as vehicle-to-grid (V2G). Based on a systematic literature review, common cyber threats are categorized, including data manipulation, authentication bypass, infrastructure failures, and attacks on backend systems and the power grid. Furthermore, this paper synthesizes existing and emerging risk mitigation strategies, encompassing intrusion detection systems (IDS), secure communication protocols, authentication frameworks, and anomaly detection techniques utilizing machine learning and blockchain technologies. By analyzing literature published between 2017 and 2024, this study aims to provide a comprehensive overview of cybersecurity issues that are critical to ensuring the resilience and reliability of the evolving EV charging infrastructure. The scope of this review is centered specifically on cyber attacks, intrusion and anomaly detection, and authentication mechanisms within EV charging infrastructures, rather than on the broader cybersecurity domain.

1. Introduction

Electromobility is now a visible pillar of climate policy. In the European Union’s roadmap, internal combustion engine vehicles are expected to be phased out of urban traffic by 2050, with electric vehicles (EVs) taking their place [1]. Beyond the well-known environmental gains, deployment at scale hinges on a charging ecosystem that is not only efficient and interoperable but also secure and resilient [2]. In this context, the review does not cover the entirety of cybersecurity research, but instead emphasizes three core domains: cyber attacks, intrusion and anomaly detection, and authentication.

A central challenge is the tight coupling between charging infrastructure and modern power systems. Vehicle-to-grid (V2G) capabilities expand this coupling by enabling bidirectional energy flows, which improves balancing but also broadens the attack surface of the grid–communication stack [2,3]. References often point to complementary energy topics—such as photovoltaic (PV)-assisted charging and self-consumption optimization—as part of infrastructure planning [3,4], and to energy recuperation gains at the vehicle level [3]. Constraints on batteries, their cost and aging, as well as mass-related impacts on energy use, remain relevant background factors for infrastructure planning and user adoption [1,5,6]. These considerations persist, yet the decisive differentiator for dependable scaling is cybersecurity.

Electric vehicle charging stations (EVCSs), back-end platforms (CSMSs) and the protocols that connect vehicles, stations and aggregators are exposed to data manipulation, authentication bypass, denial-of-service and malware propagation, with operational impacts that range from local downtime to distribution-level instability [7,8,9,10]. Research responds with several lines of defense: authentication frameworks [8], intrusion detection systems (IDS) and anomaly detection in communication streams [9,11], and safeguards for metering and billing integrity [10]. Recent studies strengthen this picture with machine-learning-based anomaly detection—including generative adversarial network (GAN)-based detectors in EV charging data pipelines [8]—and deep recurrent controllers that mitigate sophisticated, time-varying disturbances in EVCS cyber–physical loops [12]. Work on the ISO 15118 family underscores both its role in secure, interoperable V2G handshakes and concrete vulnerability classes that demand careful engineering and conformance testing [11,13]. Models of large-scale coordinated attacks, including stochastic distributed denial of service (DDoS) traffic, aimed at stations and their networks, quantify service delays and stability risks and motivate robust protective capacity [14]. Parallel efforts explore decentralized authentication and settlement using blockchain to remove single points of failure and enhance privacy in V2G transactions [15,16,17,18]. Additionally, studies on price-signal manipulation demonstrate how adversaries could steer charging/discharging behavior and stress distribution feeders if defenses are weak [19]. Emerging EVCS stacks that rely on 5G connectivity further raise the bar for traffic inspection and learning-based IDS to spot covert false data injection (FDI) and DDoS patterns in near real time [20].

Against this backdrop, the aim of this review is to consolidate current knowledge about cybersecurity in EV charging ecosystems with an emphasis on communication protocols, cryptography, anomaly and intrusion detection, and grid integration risks. The review synthesizes literature from 2017–2024 and maps threats and countermeasures across charging points, back-end systems and V2G interfaces. It highlights where defenses are mature and where evidence still rests on simulations rather than field data [2,11]. To keep the discussion grounded in deployment realities, the article also retains the broader infrastructure context referenced above—PV integration, operational constraints and user-level factors—while treating them as boundary conditions for secure design rather than as the primary focus [3,6].

The paper is structured as follows. Section 2 outlines the materials and methods used for the literature selection and classification. Section 3 surveys cybersecurity themes (authentication and cryptography, attacks, intrusion/anomaly detection, blockchain) alongside enabling technologies and infrastructure. Subsequent sections synthesize trends and open gaps, and discuss implications for the secure, scalable integration of EV charging with smart grids [1,2,3,4,7,8,9,10,11,14].

2. Materials and Methods

This study employed a systematic review approach focused on analyzing scientific literature published from 2017 to 2024. The selection of publications was based on search results from the Scopus database, with queries restricted to the fields of engineering, computer science, and energy. A total of 102 publications were included in the final analysis. These documents met our defined language, topical, and formal criteria, while literature from non-technical domains was excluded. The documents were classified manually based on their full content, taking into account the type of methodology used, such as experimental studies, literature reviews, case studies, or conceptual modeling.

Additionally, the publications were assigned to four main thematic categories within the domain of cybersecurity and infrastructural technologies for electric vehicles. For qualitative analysis, keywords and a taxonomy were applied based on the occurrence of concepts such as “intrusion detection,” “authentication,” “charging infrastructure,” and “vehicle-to-grid.” Special attention was paid to the geographical distribution of the publications and the temporal dynamics in the development of specific algorithmic classes.

In the context of the growing popularity of electric vehicles (EVs) and ongoing advancements in the development in modern charging systems, we conducted a literature analysis to address the following seven key research questions:

• Which anomaly detection techniques are most effective in securing EV charging infrastructure?
• To what extent does blockchain enhance the resilience of EV systems against cyber attacks?
• Which authentication protocols dominate vehicle-to-grid communication, and how do they impact overall system security?
• Does the type of infrastructure (public vs. private) determine the level of cybersecurity protection implemented?
• What are the operational consequences of attacks on charging stations, such as tariff manipulation or grid destabilization?
• To what extent are real-world versus simulated data used in EV cybersecurity research?
• Which regions are leading EV cybersecurity research, and what are the driving factors behind this trend?

2.1. Document Retrieval and Selection

The literature review was conducted using the Scopus database, based on a systematic search methodology inspired by the PRISMA guidelines. Publications from the years 2017–2024 written in English were included in the analysis. These works focused on cybersecurity, deep learning (DL), neural networks (NN), and statistical methods in the context of electric vehicles (EVs). Particular emphasis was placed on studies related to energy consumption forecasting, predictive vehicle control systems, battery resource management, and the integration of electric vehicles with smart power grids.

The selection of literature was carried out based on the thematic relevance of the publications included in the source files, taking into account methodological diversity and the noticeable increase in the number of publications between 2021 and 2024, which confirms the growing global interest in this area. The search was based on a logical combination of keywords related to data analysis methods, electromobility, cybersecurity and charging infrastructure. The following search query was applied:

“TITLE-ABS-KEY(Electric AND Vehicles AND (“Charging” OR “Power Grids” OR “Embedded Systems”)) AND PUBYEAR > 2016 AND PUBYEAR < 2025 AND (EXCLUDE (SUBJAREA,“AGRI”) OR EXCLUDE (SUBJAREA,“NEUR”) OR EXCLUDE (SUBJAREA,“BIOC”) OR EXCLUDE (SUBJAREA,“BUSI”) OR EXCLUDE (SUBJAREA,“MULT”) OR EXCLUDE (SUBJAREA,“CHEM”) OR EXCLUDE (SUBJAREA,“ECON”) OR EXCLUDE (SUBJAREA,“MEDI”) OR EXCLUDE (SUBJAREA,“CENG”) OR EXCLUDE (SUBJAREA,“SOCI”) OR EXCLUDE (SUBJAREA,“ARTS”) OR EXCLUDE (SUBJAREA,“PHAR”) OR EXCLUDE (SUBJAREA,“PSYC”) OR EXCLUDE (SUBJAREA,“HEAL”) OR EXCLUDE (SUBJAREA,“EART”) OR EXCLUDE (SUBJAREA,“ENVI”) OR EXCLUDE (SUBJAREA,“MATE”) OR EXCLUDE (SUBJAREA,“PHYS”) OR EXCLUDE (SUBJAREA,“DECI”) OR EXCLUDE (SUBJAREA,“MATH”)) AND (EXCLUDE (DOCTYPE,“cr”)) AND (LIMIT-TO (LANGUAGE, “English”)) AND (LIMIT-TO (EXACTKEYWORD, “Cyber-attacks”) OR LIMIT-TO (EXACTKEYWORD, “Cyber Attacks”) OR LIMIT-TO (EXACTKEYWORD, “Intrusion Detection”) OR LIMIT-TO (EXACTKEYWORD, “Intrusion Detection Systems”) OR LIMIT-TO (EXACTKEYWORD, “Intrusion Detection System (IDS)”) OR LIMIT-TO (EXACTKEYWORD, “Anomaly Detection”) OR LIMIT-TO (EXACTKEYWORD, “Attack Detection”) OR LIMIT-TO (EXACTKEYWORD, “Authentication”))”

In the methodology section, a detailed justification for the original search query was added. It was explained that the query was deliberately constructed with precision to select publications specifically related to EV charging in the context of cyber attacks, intrusion and anomaly detection, and authentication.

The next stage of literature selection was based on the results of the query conducted in the Scopus database, which yielded a total of 102 publications meeting the defined criteria. To ensure high relevance, full-text scientific publications were analyzed for the presence of terms related to electric vehicles and charging infrastructure in the context of cybersecurity and embedded systems.

The time range was limited to publications from 2017 to 2024, written in English and classified under subject areas such as engineering, computer science, and energy. The classification process was supported by exclusion criteria targeting non-technical fields (e.g., medicine, psychology, arts), in accordance with the recommendations of previous review studies.

In the methodology section, the justification for selecting specific subject areas was provided. The restriction to key domains was intended to capture the most relevant and directly related publications. This approach minimized the risk of including articles from fields that were not the focus of the analysis, such as social sciences or psychology, and allowed the study to remain concentrated on technical and engineering literature directly addressing the cybersecurity of electric vehicle charging infrastructure.

Based on keyword analysis, the publications were assigned to two primary thematic categories:

(1)

Cybersecurity, including authentication, cryptography, intrusion and anomaly detection, and blockchain technologies;

(2)

Technologies and infrastructure, focusing on charging systems, integration with the electrical grid (including V2G), and EV onboard systems.

Special attention was also given to research methodology—publications were classified as experimental studies, literature reviews, case studies, or conceptual papers, based on author declarations or content analysis of abstracts.

An additional manual review phase was carried out, covering 196 articles. During this selection, 94 papers were excluded due to not meeting the technical requirements or lacking direct relevance to the research topic, resulting in a final set of 102 publications. In the categorization process, some papers were assigned to more than one group, reflecting the multidimensional nature of the issues addressed in the texts.

The geographical analysis revealed a significant concentration of authors in countries such as China, the United States, India, Germany, and the United Kingdom, with fewer publications from Brazil, Iran, and South Korea. The documents were primarily journal articles or conference papers. Additionally, the analysis incorporated visualizations and data generated using VOSviewer, version 1.6.20 [21], which enabled mapping of keyword relationships and facilitated the identification of key thematic clusters within the analyzed dataset.

A graphical summary illustrating the stages of literature selection, the applied filtering criteria, and the main classification directions is presented in Figure 1, which also depicts the thematic distribution of the analyzed publications.

2.2. Classification Criteria

A total of 102 scientific publications were selected for analysis based on predefined thematic and formal criteria, covering the years 2017–2024 and written in English. These publications were retrieved from the Scopus database using a query that targeted titles, abstracts, and keywords containing terms related to electric vehicles, power grids, charging, and embedded systems. The final list of documents was narrowed down from an initial set of 196 by excluding items that did not meet the subject area, language, or document type criteria. For further analysis, each document was assigned to five main classification categories: (1) Two thematic groups (cybersecurity and technologies and infrastructure); (2) country of author affiliation; (3) document type; and (4) research methodology.

The classification process was conducted manually based on the analysis of metadata, abstract content, and full-text documents available in English. Where applicable, translated versions were also reviewed.

The first classification group referred to the research focus of the publications, identifying two overarching thematic groups: Cybersecurity and technologies and infrastructure.

Within the cybersecurity group, four specific thematic categories were distinguished, as follows:

• Authentication and cryptography (e.g., authentication, cryptography);
• Cyber attacks (cyber attacks, computer crime, denial of service);
• Intrusion and anomaly detection (intrusion detection systems, anomaly detection);
• Blockchain technologies (blockchain).

The second thematic group addressed technological and infrastructural aspects of electromobility. It included three main subcategories, as follows:

• Electric vehicle charging (electric vehicle charging, charging infrastructure);
• Grid integration (smart grids, V2G, energy transfer);
• Vehicle systems (battery management, embedded systems, vehicular networks, internet of things).

The second classification axis concerned the country of author affiliation. This information was obtained from the bibliographic metadata provided by the Scopus database. Eleven countries were identified as having the highest number of affiliations: United States, China, Canada, Germany, India, Australia, Italy, United Kingdom, Brazil, South Korea, and Turkey. The remaining countries were placed in the “Other” category.

The third classification referred to the document type, which included the following:

• Journal articles (48 studies);
• Conference papers (52 studies);
• Other (e.g., reviews, book chapters; 2 studies).

The fourth classification dimension was based on the research methodology, which was assessed by analyzing the substantive content of the documents and the nature of the conducted studies. Four methodological approaches were identified, as follows:

• Experimental studies, based on original measurements and testing procedures;
• Literature-based analyses, including systematic reviews and meta-analyses;
• Case studies, focusing on implementations and practical applications;
• Conceptual works, involving mathematical models and proposals for new system architectures.

The assignment of categories was conducted according to a predefined classification framework. The data structure was validated using a graphical model representing individual research aspects and their subdivisions. This structure enabled a multi-dimensional and comparative analysis of scientific studies in the field of electromobility, with particular emphasis on cybersecurity threats and integration aspects related to energy infrastructure.

This detailed classification allowed for an in-depth, multi-perspective analysis of the current body of scientific literature concerning energy consumption forecasting and control in electric vehicles.

2.3. Data Processing and Analysis

The bibliographic data, which included 102 scientific publications that met the predefined thematic, linguistic, and temporal criteria, were standardized and prepared for further analysis. First, a manual verification of titles, abstracts, and keywords was performed. Each publication was then assigned to one or more classification categories based on the structure outlined in the source documents. These categories were associated with two primary thematic areas: Cybersecurity and technologies and infrastructure.

For data analysis, the Python 3.12 programming environment was used and the following libraries were applied: Pandas 2.2.2 for tabular data processing, Matplotlib 3.8.4 and Seaborn 0.13.2 for data visualization, and NumPy 1.26.4 for numerical operations. To streamline data filtering and aggregation, all records were imported into a local PostgreSQL 16.2 relational database. Dedicated tables were created to manage bibliographic information, including authors, affiliations, keywords, year of publication, and DOI. The use of structured SQL queries enabled cross-sectional thematic analyses and comparisons across classification categories.

Publications were classified according to the following criteria:

• Technology of infrastructure (cybersecurity, deep learning, neural networks, statistical methods);
• Application area (battery systems, charging infrastructure, power grids, predictive control);
• Research methodology (experimental study, literature review, case study, conceptual work);
• Country of author affiliation;
• Document type (journal article, conference paper, other).

Particular attention was given to geographical analysis, which made it possible to determine the distribution of publications by country and identify the most active research centers. According to the classification framework, the most frequently represented countries included the United States, China, Canada, Germany, India, Australia, Italy, the United Kingdom, Brazil, South Korea, and Turkey.

A temporal analysis was also conducted, covering the years 2017–2024, allowing for the identification of trends and research dynamics related to data-driven approaches in the context of electromobility and energy management. To visualize relationships between key concepts, network graphs were generated using the VOSviewer tool.

By integrating programming tools, database systems, and manual classification, a deeper understanding of the structure and research directions concerning the security and integration of electric vehicle charging infrastructure with smart energy grids was achieved.

2.4. Review Protocol and Publication Quality

To ensure transparency and reproducibility, the literature review was conducted following a structured protocol inspired by the Preferred Reporting Items for Systematic Reviews and Meta-Analyses (PRISMA) guidelines. The diagram outlines the four main stages of the systematic review process, as follows:

• Identification: 196 records identified in the Scopus database.
• Screening: After removing duplicates (n = 0), the remaining 196 records were screened, with 94 being excluded by applying an additional keyword filter: “LIMIT-TO (EXACTKEYWORD, “Electric Vehicles”).” To ensure the robustness of the screening process, the Scopus query was extended to include a broader set of synonyms related to electric vehicles and charging infrastructure (EVSE, PEV, EVCS, charge point, CSMS), in addition to the term electric vehicles. The extended query took the following form:
  • AND (LIMIT-TO (EXACTKEYWORD, “Electric Vehicles”) OR LIMIT-TO (EXACTKEYWORD, “EVSE”) OR LIMIT-TO (EXACTKEYWORD, “PEV”) OR LIMIT-TO (EXACTKEYWORD, “EVCS”) OR LIMIT-TO (EXACTKEYWORD, “charge point”) OR LIMIT-TO (EXACTKEYWORD, “CSMS”)).
  • The extended search yielded the same number of publications (n = 102) as the original query. This outcome reflects the fact that Scopus does not rely solely on author-supplied keywords, but instead applies its own standardized indexing. As a result, articles in which authors provided alternative terms (e.g., EVSE, PEV, EVCS) were nevertheless indexed under the unified keyword Electric Vehicles. Accordingly, the synonym expansion did not alter the dataset but confirmed the completeness of the initial screening strategy.

3.

Eligibility: The full texts of the remaining 102 publications were assessed for eligibility and no further exclusions were made at this stage.

4.

Included: A final set of 102 publications was ultimately included in the review.

The flow diagram illustrating this process is presented in Figure 2. It is important to note that no duplicates were identified in the Scopus database after applying the initial filters, as the database itself ensures their absence. However, all records were additionally imported into a PostgreSQL database, where their uniqueness was verified based on DOI identifiers and titles. The exact dates of the searches and data exports were provided, and the Supplementary Materials include the detailed queries used in the process to ensure full reproducibility.

The second classification focused on research topics, which were determined through keyword extraction. Text mining tools, such as VOSviewer, were used to identify dominant terms and their co-occurrence across the reviewed publications. Two primary thematic axes were distinguished: cybersecurity-related issues and electric vehicle technologies and infrastructure.

Within the cybersecurity group, the following thematic categories were identified:

• Authentication and cryptography;
• Cyber attacks;
• Intrusion and anomaly detection;
• Blockchain.

The second thematic group included topics related to the following:

• Vehicle charging;
• Grid integration;
• Vehicle systems, such as battery management systems (BMS), vehicle-to-vehicle (V2V) communication, and vehicular networks.

The geographical classification was performed based on the country of author affiliation. The analyzed dataset was dominated by publications originating from China, India, Germany, the United States, the United Kingdom, Japan, Saudi Arabia, Italy, Canada, and South Korea. Countries with single publication entries were grouped under the category “Other.” This approach enabled the identification of geographic centers of research activity in the application of ML/DL/SA methods within electromobility.

Publications were also classified by document type, using a basic division into the following:

• Journal articles (published in peer-reviewed journals);
• Conference papers;
• Other formats.

These classifications were based on metadata provided directly by the Scopus database.

Additionally, the research methodology was evaluated based on abstract content and full-text analysis. Four categories were distinguished, as follows:

• Experimental studies (involving measurements, prototypes, or implementations);
• Literature reviews (focused on surveying existing knowledge);
• Case studies (presenting specific real-world implementations);
• Conceptual papers (theoretical or model-based works proposing new approaches).

For the purposes of this classification, the collected data were manually reviewed by two independent evaluators, who assessed each publication based on predefined criteria. In cases of disagreement, a consensus-based approach was adopted through joint discussion. To quantify inter-rater agreement, Cohen’s κ will be computed for the screening and classification stages and reported with a 95% confidence interval. This procedure ensured consistency and enabled a multidimensional analysis of the literature, covering technical, geographical, and methodological aspects. As part of the review protocol, a dedicated quality appraisal step was introduced to evaluate the methodological soundness and relevance of the included studies. A tailored checklist was applied, covering clarity of research objectives, transparency of methodology, robustness of data analysis, and replicability of results. Each publication was assessed independently, and the appraisal scores were used to weight the conclusions drawn from the review. In practice, findings supported by higher-quality studies were given greater interpretative weight, while evidence from lower-quality or less transparent sources was treated with appropriate caution.

The classification categories were determined not only by the presence of relevant terms but also by their frequency and prominence within the keyword co-occurrence structure. This analysis was visualized using a keyword density map (Figure 3). The resulting visualization enabled the identification of the most frequently addressed topics and their interrelationships, highlighting areas of intensive research activity as well as gaps that warrant further exploration.

Figure 4 presents a detailed keyword co-occurrence network based on the analyzed publications, forming a thematic map of conceptual linkages within the literature on electric vehicles and related technologies. Each node represents a keyword or concept appearing in the dataset, and its size reflects the frequency of occurrence. The larger the node, the more central its role in the research structure.

Node colors indicate membership in specific thematic clusters, automatically generated using a clustering algorithm. Each cluster groups terms that frequently co-occur across publications, reflecting their logical and topical coherence. For example, the red cluster (top-left area of the map) is focused on cybersecurity issues, including terms such as “cyber-attacks,” “cyber attacks,” “computer crime,” “denial-of-service attack,” and “intrusion detection.” This terminology indicates a high volume of research dedicated to protecting EV infrastructure from digital threats.

At the center of the map, the largest and most dominant node is “electric vehicles,” which serves as the primary anchor for surrounding topics. It is surrounded by terms such as “charging (batteries),” “charging station,” “battery management systems,” and “vehicle-to-vehicle communication.” These are grouped in the yellow cluster, representing a combined focus on infrastructural, technological, and operational aspects of EV energy management and charging systems.

The green cluster, located in the lower section of the map, includes terms related to power grid systems and their integration strategies with EVs. Terms such as “smart power grids,” “electric power system control,” “transmission networks,” “power grids” and “electric power transmission” indicate strong research interest in the integration of electric vehicles with smart grid technologies and bidirectional energy flow concepts, such as vehicle-to-grid (V2G).

On the right-hand side of the map, the blue cluster focuses on data and identity security, featuring terms like “authentication,” “blockchain” and “cryptography.” Its linkage with other clusters—through terms like “vehicle-to-grid” and “Internet of things”—demonstrates the intersection of security issues with technological and infrastructural dimensions.

The thickness of the edges (links) between nodes indicates the strength of co-occurrence; thicker edges represent higher frequencies of joint appearance. The dense network of connections between clusters suggests a high level of interdisciplinarity, bridging topics across energy systems, computer science, control, and cybersecurity.

This network visualization enables the identification of dominant research areas, as well as gaps and potential directions for further exploration. For instance, the relatively weak linkage between “blockchain” and “battery management systems” may signal an underexplored area in leveraging distributed ledger technologies for EV energy management. Thus, Figure 4 provides a valuable visual perspective on the structure and complexity of the reviewed literature and supports intuitive navigation through the interrelated research domains.

In the following work, literature items ranging from 11 to 112 were analyzed.

3. State of the Art

The rapid growth of electromobility is shaping a complex digital environment where electric vehicles are becoming part of smart grid systems. This new connectivity presents exciting opportunities but also brings notable security risks. It is crucial to protect the integrity and data privacy that moves between vehicles, charging points, and the grid. For this reason, modern research combines cybersecurity with the advancement of electromobility technologies and infrastructure, creating a new field that needs robust protection. This review examines 102 selected publications, sorting them into two primary areas: Cybersecurity (Section 3.1) and technologies and infrastructure (Section 3.2).

3.1. Cybersecurity

This section is structured around the three primary areas that form the focus of this review: authentication, cyber attacks, and intrusion/anomaly detection. The development of electromobility and related digital technologies brings both enormous opportunities and significant challenges related to cybersecurity. Authentication and cryptography mechanisms play a particularly important role, ensuring confidentiality, integrity, and non-repudiation of communication during electric vehicle charging processes and integration with grid infrastructure. As the scale and complexity of energy systems grow, so does the threat of cyber attacks, including denial-of-service attacks, which can destabilize both local charging stations and entire power grids. A key area of research is detecting intruders and anomalies, enabling early response to security breaches in critical systems. Blockchain is also gaining importance, with applications in energy transaction settlement, vehicle-to-grid (V2G) systems, and ensuring data transparency and immutability.

3.1.1. Authentication and Cryptography

The article presents new authentication methods in distributed systems, focusing on minimizing delays in the login process. The authors emphasize the importance of lightweight authentication protocols in the context of devices with limited computing power [8].

The paper analyzes biometric solutions as authentication tools in information systems, highlighting the potential of combining biometrics with classical cryptographic methods [9]. The authors discuss the use of single sign-on (SSO) protocols in large computer networks and propose mechanisms to increase their resilience against spoofing attacks [10]. The article presents the application of post-quantum cryptography in protecting sensitive data, emphasizing the resilience of proposed solutions to future threats posed by quantum computers [11]. The study describes the implementation of homomorphic encryption in cloud systems, pointing out that this technology enables operations on encrypted data without the need for decryption [22]. Finally, research analyzes the use of elliptic curve cryptography in mobile communication systems, indicating that this method ensures a high level of security while requiring minimal resources [15].

3.1.2. Cyber Attacks

The article analyzes the growing scale of cyber attacks targeting critical infrastructure, emphasizing the need for developing global response standards [13]. Within the EV ecosystem, such attacks directly translate into risks for charging stations and control backbones, where manipulation of communication can disrupt open charge point protocol (OCPP) sessions or ISO 15118 handshakes. Advanced persistent threats (APTs), known for persistence and strategic data theft, may target central charging station management systems (CSMSs) to compromise authentication data or disrupt charging coordination [23]. Case studies of ransomware incidents in other critical domains, such as healthcare [14], illustrate how similar techniques could be applied to electric vehicle supply equipment (EVSE) operators. These attacks could encrypt charging management servers and prevent access to billing or session data. Likewise, the evolution of DDoS attacks using IoT botnets [24], demonstrates a clear parallel: large-scale traffic floods can be directed at charging networks, overloading OCPP message queues and causing widespread service denial. Attacks on Supervisory Control and Data Acquisition (SCADA) systems [25], while originally documented in industrial contexts, highlight vulnerabilities relevant to EVSE–grid integration, where tampering with telemetry could destabilize load management. This is a risk particularly highlighted by security standards like IEC 62351-7:2017, which [25] aims to extend. Financial cybercrime [26] and social engineering [27], although often analyzed outside the EV context, point to attack vectors against payment platforms and user accounts linked with EV charging services. Legal harmonization challenges [28] and psychological factors behind cybercrime [29] may be secondary, but they underscore the persistent global nature of these threats. DoS attacks against banking systems [30] and DDoS campaigns in campus networks [31] are valuable by analogy, as they demonstrate the effectiveness of overload strategies that can be repurposed against EVSE authentication servers or CSMS APIs, leading to significant disruption of mobility services.

3.1.3. Intrusion and Anomaly Detection

The article analyzes signature-based intrusion detection systems (IDSs), emphasizing that this method is effective against known attacks but has limited capability to detect new threats [32]. In the EV charging context, this limitation is particularly relevant for OCPP and ISO 15118, where novel manipulation of handshake or tariff messages may bypass legacy IDS signatures.

Hybrid intrusion detection systems combining signature analysis with behavioral methods demonstrate improved detection accuracy and reduced false alarms [33], which is applicable to identifying abnormal CSMS traffic patterns. IDS solutions for industrial networks [34] directly inform EVSE protection, as integration with grid protocols demands anomaly detection that accounts for both power and data flows. Machine learning-based IDS [35] enhance adaptability to new threats, a necessity for dynamic EV environments involving wireless or roaming charging. IDS approaches in cloud environments [20] and IoT networks [36] are highly relevant, as CSMS platforms are increasingly cloud-hosted and connected to heterogeneous IoT devices. Deep learning-based IDS solutions [19] show promise in reducing false positives when applied to large-scale EVSE telemetry. Research on IDS for autonomous vehicles [16] offers transferable insights into vehicular communication patterns, which overlap with EVSE data flows.

Integrated firewall–IDS solutions [37] and flow-based detection [38] provide additional layers of defense suitable for protecting charging stations and backend APIs. Banking sector IDS applications [39], while sector-specific, highlight transferable approaches for fraud detection in EV payment platforms. Telemetry-based solutions [40] are directly applicable to the real-time monitoring of EVSE devices, while phishing detection [41], mobile app security [42], and anomaly detection in industrial [43] or grid systems [44] all highlight methodological tools that can be tailored to EVCS environments. Statistical traffic analysis [45], deep neural networks [46], and IoT anomaly detection [47] further demonstrate techniques that can be adapted to detect misuse of OCPP or ISO 15118 traffic channels. Medical IDS applications [48], although contextually different, underscore the broader utility of anomaly detection in protecting safety-critical systems, reinforcing the case for their application to EVSE networks.

3.1.4. Performance Comparisons and Methodological Limitations

When comparing the families of algorithms listed in

Table 1. Communication interfaces, protocols, threats, and recommended controls in EV charging infrastructures.

Interface	Protocols	Trust Anchors/Credentials	Common Threats	Recommended Controls
EV ↔ EVSE	ISO 15118-2/ISO 15118-20 (Plug & Charge, Smart Charging, V2G)	EV contract certificates, EVSE station certificates, PKI root CAs	Impersonation of EV/EVSE, MITM during handshake, expired certificates, renegotiation failures	PKI validation with OCSP checks, strict TLS, lifecycle management of certificates, ISO 15118-20 diagnostic/security extensions
EVSE ↔ CSMS	OCPP 2.0.1 (JSON over WebSocket, Device Model, TransactionEvent)	TLS certificates (per OCPP security profiles), signed firmware keys	MITM on OCPP channels, malicious firmware, manipulation of transaction records, key compromise	OCPP Security Profiles, signed firmware validation, Security Event Log, certificate lifecycle management (15,118 workflows)
CSMS ↔ Market/Grid/Roaming	Today: OCPP-based APIs; Emerging: IEC 63110 (charging management), IEC 63119 (roaming)	Operator-issued PKI credentials, roaming contracts, TLS channel certificates	Interoperability failures, weak inter-operator security, inconsistent telemetry, replay attacks	Strong TLS with mutual authentication, harmonization with IEC 63110/63119, monitoring aligned with IEC 62351-7

and

Table 2. Machine learning algorithms in electromobility.

Algorithm Type	Example Applications	Selected Sources
Linear and polynomial regression	Forecasting energy consumption, optimizing charging schedules	[4,32]
Neural networks (ANN, DNN)	Prediction of energy demand, adaptive control of charging power	[20,36,45]
Decision Trees, Random Forest, Gradient Boosting	Identification of key features affecting energy consumption, detection of unusual charging patterns	[36,42]
Support vector machines (SVM)	Classification of charging patterns, prediction of peak hours, assessment of overload risk	[37,43]
Unsupervised learning (k-means, t-SNE, PCA)	Segmentation of charging station users, dimensionality reduction of telemetry data	[11,32]
Federated learning	Privacy-preserving anomaly detection, distributed predictive models	[16,19]
Generative Adversarial Networks (GANs)	Synthesizing energy data, detecting rare anomalies, testing model robustness	[2,32]
Hybrid systems (SVM + fuzzy logic)	Complex demand modeling, network congestion prediction	[8,14]

, several trade-offs emerge that matter for EVSE/CSMS intrusion and anomaly detection. Linear and polynomial regression provide strong baselines for forecasting (e.g., load and price sensitivity) due to their interpretability and low latency. However, they struggle with non-linear, regime-shifting behaviors typical of charging sessions and are sensitive to multicollinearity. Over-parameterized polynomial models may fit historical dynamics but generalize poorly under novel operating conditions, leading to unstable residual-based alarms.

Support Vector Machines (SVMs) with appropriate kernels often deliver competitive accuracy on medium-sized, high-dimensional feature sets and handle margin maximization well under modest label noise. Their drawbacks include expensive training for large datasets, limited native support for incremental/online updates, and comparatively opaque decision boundaries. Latency on embedded targets may also constrain real-time deployment unless models are carefully pruned.

Tree-based ensembles (Decision Trees, Random Forest, Gradient Boosting) typically offer strong out-of-the-box performance, robustness to heterogeneous features, and useful by-product explanations (feature importance, split logic). Random Forests handle variance well but may underfit fine-grained temporal signatures. Boosting methods capture subtle interactions yet risk overfitting without careful regularization and early stopping. Both families can be brittle under concept drift (e.g., firmware updates, tariff changes), requiring periodic retraining or drift-aware adaptation. Native online learning support is limited in many off-the-shelf implementations.

Neural networks (ANN/DNN) excel when abundant labeled data are available and can learn non-linear couplings among electrical, protocol, and contextual signals. Recurrent variants (RNN/LSTM/GRU) are particularly effective on session sequences and OCPP/ISO-15118 message streams. Their costs include data hunger, higher latency/energy use, and sensitivity to hyperparameters. Black-box behavior complicates incident response unless paired with post-hoc or inherently explainable mechanisms. Regularization (dropout, weight decay), calibration, and careful thresholding are essential to control false alarms in volatile operating conditions.

Unsupervised methods cover distinct roles. K-means clustering supports quick clustering and coarse segmentation but presumes spherical clusters and is sensitive to scaling and initialization. It may confuse transient load ramps or maintenance modes with attacks. Principal Component Analysis (PCA) reduces dimensionality and can stabilize downstream models, yet information loss may suppress weak but security-relevant signals. T-Distributed Stochastic Neighbor Embedding (t-SNE) is valuable for visualization but is non-parametric and not suited for production inference. In all unsupervised settings, threshold selection (e.g., on reconstruction error or cluster distance) strongly governs the precision–recall trade-off and must be tuned per site and season.

Federated learning addresses data-sharing constraints by training across stations or operators without centralizing raw data, often improving cross-site generalization. Practical limitations include communication overhead, client heterogeneity (non-independent and identically distributed (non-IID) data, intermittent connectivity), and potential privacy leakage through gradients unless combined with secure aggregation and differential privacy. Convergence can degrade when local datasets are small or highly imbalanced.

Generative Adversarial Networks (GANs) can augment rare attack samples and stress-test detectors; they help rebalance training but introduce risks of mode collapse, synthetic–real distribution gaps, and inadvertent bias amplification. Synthetic data should be validated with fidelity metrics and ablation studies, and results reported separately from purely real-world training to avoid overstating operational performance.

Hybrid approaches (e.g., SVM + fuzzy rules) often reduce false positives by encoding domain constraints (grid limits, charger nameplate power) alongside a statistical margin. Their limitations are engineering overhead and rule drift: as tariffs, firmware, or market products evolve, fuzzy rulebases require maintenance to remain aligned with operational realities.

Across all families, reporting should reflect class imbalance (attacks are rare) and the operational cost of errors. Beyond accuracy and ROC-AUC (Receiver Operating Characteristic—Area Under the Curve), precision–recall curves, F1/F_β, Matthews correlation coefficient, and calibrated expected cost are appropriate. Windowed detection latency and throughput (edge vs. cloud execution) should be provided for ISO 15118/OCPP use cases. Because many studies rely on simulated or lab datasets, external validity should be established via cross-site testing, temporal holdout, and, where available, field-grade telemetry. Finally, practitioners should document drift handling (retraining cadence, online adaptation), threshold governance (per-site calibration, seasonal profiles), and explainability provisions so that alarms translate into actionable, auditable responses in real deployments.

3.1.5. Blockchain

Blockchain technologies are increasingly applied to secure EV charging ecosystems, particularly in the context of transaction integrity, decentralized authentication, and V2G energy exchanges. Studies highlight how blockchain can ensure transparency and immutability in charging sessions, preventing tampering with OCPP billing data or ISO 15118 contract certificates [49]. Research on blockchain in supply chains [50] and healthcare [51], while from different sectors, provides transferable models of decentralized trust management that can be adapted to EVSE–CSMS environments.

Smart contracts [52] show promise in automating tariff agreements between EV owners and charging providers, ensuring secure execution without reliance on centralized intermediaries. However, scalability and latency issues [53] remain critical, as charging sessions require near real-time validation to avoid service delays. The integration of blockchain with edge computing [54] and IoT security [55] is particularly relevant, since EVSEs are distributed devices that must securely interact with central management systems. Privacy-preserving techniques in blockchain [56] further support secure handling of user credentials and payment data during charging sessions. While applications in banking [57] and e-government [58] demonstrate broader utility, their adaptation to EVSE/CSMS systems illustrates how blockchain can underpin resilient, transparent, and secure charging infrastructures.

3.2. Technologies and Infrastructure

This section dives into the technological backbone and infrastructure of the electromobility ecosystem. While Section 3.1 focused on the cybersecurity aspects, this part explores the physical and systemic components that make up the modern electric vehicle landscape. The review will examine the advancements in charging technology, the crucial integration with smart grids, and the in-vehicle systems that are key to the functionality and security of EVs.

3.2.1. Vehicle Charging

The article discusses fast-charging techniques for electric vehicle batteries, emphasizing that the use of dynamic control algorithms can reduce cell degradation [58]. The paper focuses on wireless charging methods, with studies confirming that inductive charging systems can achieve high efficiency when properly calibrated [59]. The authors analyze the problem of cell overheating during fast charging and propose a cooling system based on dielectric fluids [60].

The article investigates the impact of different charging methods on EV battery lifespan, showing that algorithmically optimized charging increases the number of operational cycles [61]. The paper describes a charging management system based on artificial intelligence, highlighting its potential to balance grid loads effectively [62]. The study focuses on the interoperability of different charging protocols, underlining the importance of standards such as ISO 15118 for the advancement of electromobility [63].

ISO 15118 is a key standard supporting the development of electromobility [64]. In practice, ISO 15118-2 has been the baseline implementation, providing message structures for AC and DC charging sessions, including support for Plug & Charge and Smart Charging. The newer ISO 15118-20 refines this further by improving session renegotiation, supporting bidirectional power flow (V2G), and extending functionalities such as price communication and advanced load control [65]. One of the most critical aspects is the cryptographically secured handshake, which relies on a Public Key Infrastructure (PKI) with contract certificates and station certificates. This mechanism enables Plug & Charge, where the electric vehicle authenticates seamlessly without requiring RFID cards or mobile apps. Known implementation pitfalls include the complexity of certificate lifecycle management, backward compatibility with legacy standards (DIN SPEC, IEC 61851), and ensuring resilience in case of expired or corrupted certificates. ISO 15118-20 addresses several of these challenges by strengthening the diagnostic and security mechanisms, ensuring interoperability in heterogeneous charging environments.

Complementary to ISO 15118, the Open Charge Point Protocol (OCPP) 2.0.1 has become the de-facto standard for communication between charging stations and central management systems (CSMS). The 2.0.1 release introduces the Device Model for consistent station inventories, the new TransactionEvent structure for flexible session handling, and native support for ISO 15118 certificate management workflows. Importantly, OCPP 2.0.1 defines three distinct security profiles that prescribe TLS (Transport Layer Security) configurations and mutual authentication methods suitable for different deployment contexts. It also introduces secure firmware updates (signed firmware), a Security Event Log, and explicit certificate management messages (e.g., SignCertificate, CertificateSigned, Get15118EVCertificate, InstallCertificate), which allow CSMS operators to manage the entire lifecycle of certificates used in ISO 15118 Plug & Charge [64]. These enhancements significantly reduce the risk of unauthorized access, tampered firmware, and data integrity attacks.

While OCPP remains the dominant implementation today, ongoing international standardization efforts in IEC 63110 and IEC 63119 are expected to shape future deployments. IEC 63110 addresses charging management, including V2G operations, roaming, metering, and maintenance, while IEC 63119 standardizes roaming interfaces between e-mobility service providers (eMSPs) and charge point operators (CPOs). Together, they aim to harmonize EVSE–CSMS and CSMS–market communication at a global scale. Importantly, telemetry and monitoring requirements defined in IEC 63110 and IEC 63119 can be aligned with the monitoring and information exchange mechanisms of IEC 62351-7, which is already referenced in the conclusions of this work [25]. This linkage highlights how secure interoperability can be extended beyond station-level communication to encompass market and grid services.

To provide a concise overview, Table 1 maps the key communication interfaces in the EV charging ecosystem to their respective protocols, trust anchors, common threats, and recommended security controls. The article examines the design of high-power charging stations, stressing the necessity of advanced cooling and energy management systems [66]. The paper describes the architecture of charging stations powered by renewable energy sources, noting that integration with photovoltaic panels reduces grid load [67]. The authors present a model of a charging station equipped with an energy storage system, with research confirming that buffer batteries enhance station stability [68].

The article analyzes the economic aspects of building charging stations, pointing out that profitability depends on location, energy tariffs, and infrastructure utilization rates [69]. The paper discusses dynamic power allocation systems for simultaneous multi-vehicle charging, showing that this solution minimizes the risk of grid overload [70]. The article investigates the impact of EV charging on CO₂ emissions depending on the energy mix, with results indicating that renewable energy significantly reduces emissions [71]. The study examines the availability of charging stations in urban areas, highlighting that infrastructure density is a key factor for EV user adoption [72]. The article focuses on the cybersecurity of charging stations, with findings showing that the lack of encrypted communication protocols exposes systems to manipulation [73]. The paper discusses the development of national-level charging infrastructure, emphasizing the need for strategic planning and collaboration between the public and private sectors [74].

3.2.2. Grid Integration

The article discusses the concept of V2G as a tool for stabilizing the power grid, emphasizing that vehicles can act as decentralized energy storage units [75]. The paper analyzes the impact of V2G on battery lifespan, with results showing that appropriate control algorithms minimize battery degradation [76]. The authors present a mathematical model assessing V2G efficiency in urban conditions, with simulations demonstrating its ability to reduce peak load demand [77].

The article focuses on the impact of EV charging on transmission networks, highlighting that uncontrolled mass charging can lead to overloads [78]. The paper presents methods for forecasting loads in transmission networks within the context of electromobility, showing that predictive algorithms improve system stability. The study analyzes EV integration with smart grids, proving that bidirectional communication enables effective energy management [79]. The article discusses the role of smart grid technologies in reducing transmission losses, noting that the deployment of smart meters improves energy balance [80]. The paper presents a smart grid architecture supporting EV charging, proposing decentralized control algorithms [81]. The article examines the development of smart energy networks in Europe, underlining the importance of standardization and interoperability [82].

The study analyzes the resilience of smart grids to cyber attacks, stressing the need for IDS systems and secure communication [83]. The article presents control methods for power systems under fluctuating demand, emphasizing the role of adaptive algorithms in stabilizing the grid [84]. The paper focuses on energy flow management in hybrid RES–EV (Renewable energy sources EV) systems, showing that dynamic load management increases efficiency [85].

The study discusses the impact of electromobility on power grid reliability, noting the risks of local overloads [86]. The article analyzes the necessity of modernizing transmission networks for the development of electromobility, highlighting investments in automation and digitalization [87]. The paper describes the potential of energy sharing between vehicles and the grid within V2G, proving that this approach supports renewable energy integration [12].

The article presents a business model for V2G services, pointing to new revenue opportunities for both grid operators and EV owners [88]. The study analyzes the implementation of V2G in Japan and Europe, emphasizing the key role of regulatory frameworks in its development [89]. The paper focuses on communication in V2G systems compliant with ISO 15118, underlining the importance of secure vehicle and station authentication [90]. The article discusses methods of peer-to-peer energy transfer between vehicles, highlighting that this approach supports decentralized energy models [91]. The study analyzes real-time energy transfer technologies in V2G networks, with findings showing high transmission efficiency when using dynamic communication protocols [92].

3.2.3. Vehicle Systems

The article discusses the role of embedded systems in electric vehicles, highlighting that their miniaturization and energy efficiency are crucial for the development of electromobility [93]. The study analyzes embedded system architectures in the context of security, emphasizing that hardware module isolation enhances resilience against cyber attacks [94].

The article presents methods for battery health diagnostics in Battery Management System (BMS), showing that artificial intelligence algorithms improve prediction accuracy [95]. The paper describes the development of BMS with cell-balancing functions, demonstrating that active balancing extends battery lifespan [96]. The study focuses on BMS safety, underlining the importance of protection mechanisms against overcharging and overheating [97].

The article analyzes vehicle-to-vehicle (V2V) communication as a tool for improving traffic safety, showing that information exchange between vehicles helps prevent collisions [98]. The paper focuses on communication standards for V2V systems, stressing the importance of protocols designed for low-latency transmission [99]. The article discusses the integration of electric vehicles with public transportation systems, showing that such solutions improve urban mobility efficiency [100]. The study analyzes the architecture of autonomous vehicle systems, highlighting the importance of redundancy in control and sensor systems [101]. The article presents the use of vehicular networks in traffic management, showing that dynamic data exchange reduces congestion [102]. The paper analyzes the security of communication in vehicular networks, warning that the lack of encryption in vehicle-to-everything (V2X) protocols creates risks of transmission interception [103].

The article discusses fleet management of electric vehicles using predictive systems, showing that machine learning algorithms enhance operational efficiency [104]. The study focuses on route optimization for EV fleets, demonstrating that intelligent planning algorithms reduce energy consumption [105]. The article analyzes the domain architecture of electric vehicles, showing that function integration within domains improves system management efficiency [106].

The paper describes challenges related to consolidating control units in vehicles, emphasizing the importance of standardizing communication interfaces [107]. The article discusses the impact of electromobility on transportation systems, showing that EV integration with public transport requires expansion of charging infrastructure [108]. The study focuses on the sustainable development of transportation systems, highlighting the role of EVs in reducing CO₂ emissions [109].

The article analyzes the integration of IoT with electric vehicles, showing that real-time connectivity enables continuous vehicle monitoring [65]. The paper focuses on IoT security in vehicle environments, stressing the need for encryption and device authentication [110]. The study discusses IoT applications in EV fleet management, showing that IoT systems optimize logistics processes and monitor energy consumption [111].

3.3. Summary

Overall, the research demonstrates the convergence of security and infrastructure, emphasizing the necessity of strong authentication and cryptographic mechanisms. These mechanisms, such as Plug & Charge and ISO 15118, must balance low latency with privacy protection. Based on the conducted analysis, the following findings can be drawn:

• The threat landscape encompasses DoS/DDoS, MITM/replay, data manipulation, and backend protocol vulnerabilities (e.g., OCPP). Coordinated load attacks may escalate from charging stations to the entire power system.
• Intrusion and anomaly detection systems increasingly rely on ML/DL approaches (LSTM, autoencoders), hybrid designs, and edge/federated solutions. These are used to monitor vehicle buses, EVSE, and 5G-EVCS with low latency and fewer false positives.
• Blockchain and smart contracts support settlements, access control, and energy traceability (including in V2G and dynamic charging). However, they require lightweight consensus mechanisms and careful balancing of scalability and costs.
• On the technological side, rapid and wireless charging, modular EVCS, and integration with RES and storage are advancing; integration with the grid (V2G, Smart Grid, advanced control) improves stability but expands the attack surface.

In vehicle systems, AI enhances BMS and diagnostics, V2V/V2X and IoT improve fleet and transport management. Overall progress depends on standardization, formal verification, segmentation/zero-trust, continuous monitoring, and response readiness to ensure secure, resilient, and privacy-preserving electromobility.

Table 2 provides a comprehensive review of the most frequently applied machine learning algorithms in the field of electromobility, highlighting representative use cases and corresponding references. Regression-based methods are primarily employed for forecasting energy consumption and optimizing charging schedules, whereas neural networks and hybrid approaches facilitate the modeling of highly dynamic processes and enable adaptive power management. Tree-based algorithms and support vector machines (SVMs) are widely utilized for pattern classification, peak demand prediction, and grid overload risk assessment. Unsupervised learning techniques contribute to user segmentation and dimensionality reduction, while federated learning enables the construction of distributed models with strict preservation of data privacy. Furthermore, generative adversarial networks (GANs) have emerged as powerful tools for generating synthetic datasets, detecting rare anomalies, and evaluating model robustness under adverse conditions. Collectively, the literature indicates that the judicious selection and integration of machine learning methods significantly enhance energy management, improve system security, and optimize the development of electromobility infrastructures.

Table 3. Application of machine learning algorithms in electric vehicle energy management and grid integration.

Application Area	Objective/Function	Applied ML Algorithms	Example Publications
Electric vehicle charging management	Charging optimization, demand forecasting, dynamic pricing	Artificial Neural Networks, Support Vector Machines, K-Nearest Neighbors	[3,8,112]
In-vehicle energy management	Battery usage optimization, load prediction, BMS control	Decision Trees, Gradient Boosting, Recurrent Neural Networks	[3,6,9]
User and data security	Anomaly detection, access control, privacy protection	Autoencoders, Isolation Forest, Federated Learning	[4,8,113]
Grid integration	Power flow control, availability prediction, grid balancing	Long Short-Term Memory, Ensemble Learning, Deep Reinforcement Learning	[5,7,10]
Vehicle communication systems	V2X protocol optimization, transmission efficiency, interference detection	Bayesian Networks, Convolutional Neural Networks, Random Forest	[1,11,22]

presents the diverse applications of machine learning algorithms in electric vehicle energy management and grid integration. In the area of charging management, algorithms such as neural networks, SVM, and k-NN support demand forecasting, optimization of charging schedules, and dynamic pricing strategies. In vehicle energy management, decision trees, boosting, and recurrent neural networks are applied to optimize battery usage, predict loads, and control BMS. In the area of user and data security, autoencoders, Isolation Forest, and federated learning are employed for anomaly detection, access control, and privacy protection. Grid integration relies on LSTM algorithms, ensemble learning, and deep reinforcement learning, enabling power flow control, availability forecasting, and load balancing. Finally, V2X communication systems leverage Bayesian networks, CNNs, and Random Forest to optimize protocols, enhance transmission efficiency, and detect interference.

4. Statistical Overview

This article summarizes 102 scientific publications, divided into two time periods: 2017–2020 (26 publications) and 2021–2024 (76 publications). A significant intensification of research activity has been observed in recent years, which may indicate the growing importance of cybersecurity and digital technologies in the context of electromobility. The percentage of publications from 2021–2024 was over 74%.

Figure 5 presents document types, with the dominance of two main publication forms: scientific articles (Articles) and conference papers (Conference Papers). A total of 26 papers were published between 2017 and 2020—including 15 as conference papers and 11 as articles. In the 2021–2024 period, the number of these documents increased significantly—as many as 37 publications were assigned to each of these categories. Additionally, there are two publications classified as “Other,” which may include reports, review, or other non-standard forms. This means that conference proceedings and peer-reviewed articles accounted for over 98% of the total publication output. It can therefore be concluded that research was presented primarily in formats that have the greatest impact on the development and dissemination of knowledge—at scientific conferences and in professional journals. The increase in the number of scientific articles from 11 to 37 may indicate the maturation of topics and the transition from the exploratory phase to established knowledge.

4.1. Research Trends and Dynamics

Figure 6 focuses on digital cybersecurity and is structured into four primary thematic categories, each exhibiting distinct growth dynamics:

• Authentication and Cryptography: The number of publications increased from 21 to 27, indicating a stable yet moderate development in this area. It is noteworthy that this category was dominant during the earlier time period and maintained a high level of academic interest in subsequent years;
• Cyber Attacks: This category experienced a sharp increase in publication volume—from 6 to 35 articles—making it the fastest-growing research area among the four. This surge likely reflects the rising cybersecurity threats associated with the proliferation of networked charging systems and the integration of electric vehicles (EVs) into digital infrastructures.
• Intrusion and Anomaly Detection: The number of publications grew from 3 to 19, suggesting a growing relevance of behavioral detection techniques and increased interest in machine learning (ML)-based solutions for cybersecurity challenges in EV ecosystems.
• Blockchain: Publications in this category rose from 3 to 11, which may indicate expanding research opportunities in the application of blockchain technologies for transaction security, identity verification, and access management in electric vehicles.

The particularly dynamic growth in the areas of Cyber Attacks and Intrusion and Anomaly Detection suggests a trend in which traditional cryptographic approaches are being increasingly complemented—or even supplanted—by predictive and adaptive security systems. The analysis of research types revealed a clear shift in the nature of studies conducted over the analyzed period. Specifically:

• Experimental Studies: The number of publications increased from 15 to 46, representing a 207% growth. This trend indicates a transition from theoretical investigations toward practical implementation and hypothesis testing in real-world or simulated environments.
• Literature Analyses: A rise from 6 to 26 publications was observed, reflecting a growing interest among researchers in synthesizing existing knowledge and identifying prevailing trends within the field.
• Case Studies: No publications of this type were recorded between 2017 and 2020. However, since 2021, seven case studies have been published, suggesting an increasing demand for application-oriented research, particularly in commercial deployments or pilot implementations of charging infrastructure.
• Conceptual Research: Conceptual studies rose from 20 to 48 publications, highlighting continued efforts in design and development aimed at introducing new models for energy management and cybersecurity alongside empirical validation.

This methodological distribution suggests that the field is reaching a higher level of maturity, supporting both theoretical exploration and the practical deployment of machine learning (ML) models. Figure 7 shows the number of scientific publications by research methodology in two time periods: 2017–2020 and 2021–2024. The second half of the decade (2021–2024) saw a significant increase in publications across all categories, particularly in experimental research (from 15 to 46) and conceptual research (from 20 to 48). It is also worth noting the emergence of case studies after 2020, which may indicate a growing interest in practical implementation.

The classification of studies by application domains (Figure 8) revealed three dominant research areas:

• Vehicle Charging: This was the most frequently investigated topic across both analyzed periods, with the number of publications increasing from 21 to 63. This trend likely reflects the growing need for optimization of charging strategies and flexible energy cycle management in electric vehicle (EV) systems.
• Grid Integration: The number of studies increased from 16 to 35, indicating a rising focus on Vehicle-to-Grid (V2G) interactions, dynamic pricing models, and energy balancing within power systems involving EVs.
• Vehicle Systems: Publications in this category grew from 7 to 29, suggesting increased research interest in onboard energy and safety management systems. This is particularly relevant to the deployment of embedded machine learning (ML) algorithms and edge computing within EV architectures.

These findings confirm that the most significant advancements in research have occurred in areas directly related to EV operation and their integration with external infrastructure systems.

Table 4. Publications by year in all categories.

Name	2017–2020	2021–2024	All Years	Share [%]	Chi–Square
Total	26	76	102	100.0
Document Type
Conference Paper	15	37	52	50.98	χ2 = 1.16 (df = 2, p = 0.56)
Article	11	37	48	47.06
Other	0	2	2	1.96
Cybersecurity
Authentication and Cryptography	21	27	48	47.06	χ2 = 12.38 (df = 3, p = 0.01)
Cyber Attacks	6	35	41	40.2
Intrusion and Anomaly Detection	3	19	22	21.57
Blockchain	3	11	14	13.73
Technologies and Infrastructure
Vehicle Charging	21	63	84	82.35	χ2 = 1.62 (df = 2, p = 0.45)
Grid Integration	16	35	51	50.0
Vehicle Systems	7	29	36	35.29
Research Methodology
Experiment	15	46	61	59.8	χ2 = 3.74 (df = 3, p = 0.29)
Literature Analysis	6	26	32	31.37
Case Study	0	7	7	6.86
Conceptual	20	48	68	66.67

presents a detailed analysis of the distribution of scientific publications by cybersecurity topic and their relationship to technologies, infrastructure, and research methodology. Four main categories of security issues are considered: Authentication and Cryptography, Cyber Attacks, Intrusion and Anomaly Detection, and Blockchain. Additionally, a statistical analysis was performed using the chi-square test in two groups: (1) technologies and infrastructure, and (2) research methodology.

A total of 102 publications were included in the analysis, distributed as follows:

• Authentication and Cryptography: 48 studies;
• Cyber Attacks: 41 studies;
• Intrusion and Anomaly Detection: 22 studies;
• Blockchain: 14 studies.

Authentication and Cryptography emerged as the most represented category (47% of all publications), confirming the critical role of traditional security mechanisms in electromobility systems. At the same time, the significant share of publications addressing Cyber Attacks highlights the increasing vulnerability of EV systems and energy infrastructure in open network environments.

The distribution of publications by technological and infrastructural domains revealed the following patterns. This was the most frequently studied domain, with 84 total publications. With in this area:

• Authentication and Cryptography appeared in 41 studies.
• Cyber Attacks in 32 studies.
• Intrusion and Anomaly Detection in 18 studies.
• Blockchain in 9 studies.

This distribution indicates a high level of complexity and associated risk in charging interfaces, which serve as a critical point of interaction between users and the network. These systems require robust authentication, anomaly detection, and transaction-level security mechanisms.

A total of 51 publications addressed this domain:

• Authentication and Cryptography: 25 occurrences.
• Cyber Attacks: 23 occurrences.
• Intrusion and Anomaly Detection: 9 occurrences.
• Blockchain: 6 occurrences.

Integration of EVs with power grids requires secure bidirectional exchange of data and energy, as well as resilience against external attacks, particularly within dynamic grid environments.

This domain included 36 publications, with a more balanced distribution:

• Authentication and Cryptography: 15 studies;
• Cyber Attacks: 16 studies;
• Intrusion and Anomaly Detection: 8 studies;
• Blockchain: 8 studies.

This even distribution suggests that all four cybersecurity aspects are considered equally critical in onboard systems, with particular emphasis placed on protection against direct attacks and internal threats.

The analysis of methodological approaches revealed a strong presence of conceptual and experimental studies, alongside limited use of case studies:

• Experiments dominated in each security category, especially in Authentication and Cryptography (30 studies) and Cyber Attacks (27 studies). In the case of Blockchain, 9 experimental studies were identified, indicating growing efforts to implement this technology in practical settings.
• Literature Analyses were primarily conducted for Authentication and Cryptography (14 studies) and Cyber Attacks (14 studies), suggesting a well-established theoretical foundation in these areas.
• Case Studies were limited to only 7 publications overall, with 4 in Cyber Attacks and 3 in Intrusion and Anomaly Detection, indicating a relatively low degree of real-world deployment or documented implementations.
• Conceptual Studies were dominant in Authentication and Cryptography (37 studies) and Cyber Attacks (23 studies), and notably present in Blockchain (12 studies), reflecting the ongoing development of theoretical models and architectures in these areas.

Table 4 provides a comprehensive statistical overview of the 102 publications included in the review, categorized according to document type, cybersecurity domain, technological and infrastructural area, and research methodology.

In terms of document type, conference papers (52; 50.98%) and journal articles (48; 47.06%) dominate the dataset, while other formats account for only a marginal share (2; 1.96%). Within the cybersecurity categories, Authentication and Cryptography emerges as the most frequently studied area, represented in 48 publications (47.06%). This is followed by Cyber Attacks (41; 40.20%), Intrusion and Anomaly Detection (22; 21.57%), and Blockchain (14; 13.73%).

From the perspective of technologies and infrastructure, the majority of studies focus on Vehicle Charging (84; 82.35%), while Grid Integration (51; 50.00%) and Vehicle Systems (36; 35.29%) are also well represented, confirming the strong research emphasis on charging processes as the primary interface between users and the network.

Methodologically, Conceptual works (68; 66.67%) and Experimental studies (61; 59.80%) dominate, supported by Literature analyses (32; 31.37%) and a limited number of Case studies (7; 6.86%). This distribution reflects a field that combines strong theoretical development with increasing tendencies toward practical validation, while still showing relatively few real-world implementation studies.

The results of the chi-square tests, presented in parentheses in Table 4, indicate whether the observed distributions differ significantly across categories. The analysis shows no statistically significant differences for document type (χ² = 1.16, df = 2, p = 0.56), technologies and infrastructure (χ² = 1.62, df = 2, p = 0.45), or research methodology (χ² = 3.74, df = 3, p = 0.29). However, a significant difference is observed for cybersecurity categories (χ² = 12.38, df = 3, p = 0.01), suggesting that research efforts are unevenly distributed across security domains, with a clear predominance of authentication- and cryptography-related studies. Similarly, this result suggests no statistically significant differences in research methodologies applied across the various security categories. This implies that the choice of research approach was relatively balanced regardless of the topic area.

The statistical analyses based on χ² tests reported were performed using the categorical distributions presented in Table 4. This table provides the raw counts of publications assigned to specific categories (e.g., Authentication and Cryptography, Cyber Attacks, Intrusion and Anomaly Detection, Blockchain, etc.), which allows for full replication of the test setup. The reported χ² values, degrees of freedom, and p-values were calculated directly from these category counts. Since the underlying frequencies are included in the tables, the results can be independently verified and reproduced without additional preprocessing.

Based on the conducted analysis, the following conclusions can be drawn:

5.

Authentication and Cryptography remains the most frequently studied security domain. However, there is a noticeable increase in research activity related to Cyber Attacks and Anomaly Detection, indicating an expanding focus on behavioral and adaptive security mechanisms.

6.

Charging infrastructure has been identified as the most critical area in terms of cybersecurity concerns. This domain accounts for the highest number of studies and experimental implementations, underscoring its importance as a user-network interface vulnerable to various threats.

7.

Blockchain, although currently less represented in the dataset, shows increasing potential and is beginning to be investigated not only in vehicle-level applications but also in infrastructure-level contexts. This suggests an emerging trend of exploring decentralized and transparent security frameworks.

8.

The absence of statistically significant differences across categories may reflect the maturity of the field, where research is distributed evenly with respect to both methodology and technological context. This balanced distribution may indicate a well-established foundation for interdisciplinary and multi-domain research efforts in the area of electromobility cybersecurity.

The collected data revealed that a total of 26 studies were published between 2017 and 2020, while 76 publications appeared during the period from 2021 to 2024, representing an increase in research activity of nearly 192%. This growth can be interpreted as a direct reflection of the rising global importance of electromobility and cybersecurity as interrelated areas of scientific and technological interest.

4.2. Geographic Distribution and Statistical Analysis

Figure 9 and

Table 5. Publications by year in Countries.

Country	2017–2020	2021–2024	All Years	Share [%]	Chi–Square
All countries	26	76	102	100.0	26.1 $(df=11, p=0.01)$
United States	11	22	33	32.35
China	2	17	19	18.63
Canada	5	13	18	17.65
Germany	5	6	11	10.78
India	0	10	10	9.8
Australia	0	5	5	4.9
Italy	1	4	5	4.9
United Kingdom	0	5	5	4.9
Brazil	4	0	4	3.92
South Korea	1	3	4	3.92
Turkey	0	4	4	3.92
Other	3	8	11	10.78

present a detailed analysis of the geographical distribution of publications. The highest number of publications was attributed to:

• The United States, which increased its output from 11 publications in the initial period to 22 in the subsequent one. This accounted for 32.35% of the total body of work, thereby maintaining its dominant position as the leading research hub in the field.
• China, which recorded a substantial increase—from 2 to 17 publications—resulting in a total share of 18.63%, positioning it as the second-largest contributor. This growth may be interpreted as a consequence of national policies promoting research in advanced transportation and digitalization.
• Canada, whose contribution also grew significantly, from 5 to 13 publications, representing 17.65% of the total.
• Germany, the only European country with relatively stable output across both periods—5 publications prior to 2020 and 6 afterward—contributing 10.78% overall.
• India, Brazil, South Korea which was unrepresented in the first period, produced 10 publications between 2021 and 2024, thereby securing the fifth position globally.
• Australia, Italy, the United Kingdom, and Turkey all exhibited activity exclusively during the 2021–2024 period, each publishing between 4 and 5 studies.
• Brazil was the only country whose contributions were limited solely to the 2017–2020 period (4 publications), potentially indicating a decline in research initiatives or a shift in national priorities.
• South Korea expanded its research activity moderately, with 1 publication before 2020 and 2 after this time.
• Turkey expanded its research activity moderately, with 1 publication.
• The “Other” category, representing additional countries, included a total of 11 publications—3 from the first period and 8 from the second—indicating the internationalization of the topic and the growing involvement of emerging academic and industrial centers.

To determine whether the changes in the number of publications across the analyzed years and countries were statistically significant, a chi-square test was performed (Table 5):

• Chi-square value (χ²): 26.1
• Degrees of freedom: 11
• p-value: 0.01

Since the p-value was less than 0.05, a statistically significant relationship was observed between the year of publication and the country of origin. In other words, the variation in publication distribution was not random and may be attributed to political, financial, or infrastructural conditions that supported research activities in specific countries.

In summary, the United States maintained its leading position in the field of electromobility and digital security research. China and Canada demonstrated a marked increase in research activity after 2020, which may be attributed to the implementation of aggressive national technology strategies. A significant rise in publication volume was also observed in India, as well as in countries such as the United Kingdom, Australia, Italy, and Turkey, which had previously not been represented in this research domain. Germany exhibited a stable publication output, reinforcing its long-standing commitment to engineering and energy-related research. Conversely, Brazil was the only country that did not continue its publishing activity beyond 2020, potentially indicating a shift in research priorities or funding. The chi-square statistical analysis confirmed that the observed geographic redistribution of publications was statistically significant and likely reflects deliberate research policies and national initiatives aimed at advancing innovation in the domains of electric vehicles and cybersecurity.

4.3. Methodological and Thematic Relationships

Figure 10 presents a detailed analysis of the distribution of research methods used in scientific publications in the field of cybersecurity in the context of electromobility.

The data were structured along two dimensions: the type of research methodology applied (horizontal axis) and the security-related thematic category (vertical axis). The analysis incorporated four primary methodological approaches:

• Experiment;
• Literature Analysis;
• Case Study;
• Conceptual;

As well as four thematic categories:

• Authentication and Cryptography;
• Cyber Attacks;
• Intrusion and Anomaly Detection;
• Blockchain.

The Authentication and Cryptography thematic area accounted for the largest number of publications, with 81 studies divided into:

• 37 conceptual works;
• 30 experimental studies;
• 14 literature reviews;
• 0 case studies.

This distribution indicates a strong theoretical foundation in the domain of authentication and cryptographic mechanisms, accompanied by a substantial volume of experimental research. The relatively high number of experimental publications suggests that authentication and encryption algorithms are actively being tested and deployed within real-world EV system environments. The absence of case studies may reflect a limited number of institution-specific implementations documented through in-depth field analysis.

The category of Cyber Attacks encompassed a total of 68 publications, distributed as follows:

• 27 experimental studies;
• 23 conceptual papers;
• 14 literature analyses;
• 4 case studies.

This area demonstrates a strong focus on applied research, particularly through experimental approaches, which is justified by the need to validate security mechanisms against real-world attack scenarios. The presence of case studies, although limited in number, suggests that specific incidents or implementations have been analyzed in detail, providing valuable insights into actual system vulnerabilities and defense strategies.

In the thematic category of Intrusion and Anomaly Detection, 35 publications were identified, derived in a manner:

• 14 conceptual studies
• 13 experimental studies
• 5 literature analyses
• 3 case studies

Compared to the other categories, Intrusion and Anomaly Detection exhibits a moderate methodological distribution. The relatively high number of conceptual and experimental studies indicates an ongoing phase of active development and testing of anomaly detection algorithms. In contrast, the limited number of case studies suggests that the implementation of these technologies remains at an early stage in real-world systems.

The Blockchain category was the least represented topic category, containing 25 publications, including:

• 12 conceptual studies
• 9 experimental studies
• 2 literature reviews
• 0 case studies

The field of Blockchain is characterized by a strong dominance of theoretical research, suggesting that its application to electromobility security is still in the preliminary development stage, with limited practical implementation (as evidenced by the absence of case studies). Nevertheless, the presence of experimental studies indicates initial attempts at integrating blockchain with transaction systems or charging infrastructure.

In summary, the Authentication and Cryptography and Cyber Attacks categories are characterized by the largest number of experimental studies, which highlights their technological maturity and advanced level of practical application. In contrast, Blockchain and Intrusion and Anomaly Detection remain dominated by conceptual research, indicating that these areas are still being formulated and tested and are less frequently deployed in actual EV systems.

The case study methodology was minimally represented across all categories, suggesting a need for further documentation of real-world implementations and comparative analyses between different deployment environments. Literature reviews were most frequently applied in traditional security domains (e.g., Authentication and Cyber Attacks), which reflects a well-developed knowledge base and the existence of a large body of prior research in these areas. Overall, the methodological matrix points toward a shift from conceptual research to experimental validation, which may indicate the increasing maturity of machine learning and cybersecurity technologies within the electromobility domain.

Figure 11 presents a heat map matrix illustrating the relationship between cybersecurity categories and technological/infrastructural domains in the context of electromobility. For each intersection between a technological area and a security category, the matrix indicates the number of publications that addressed both topics simultaneously. This visualization allows for a clearer assessment of the technical contexts in which issues such as authentication, cyber attacks, anomaly detection, and blockchain have been most frequently studied.

The Vehicle Charging category emerged as the most represented in the literature, underscoring its significance as a critical node within the electromobility infrastructure. Within this group, the following distribution of publications was observed:

• 41 publications focused on Authentication and Cryptography;
• 32 related to Cyber Attacks;
• 18 addressed Intrusion and Anomaly Detection;
• 9 covered Blockchain.

These high values indicate that charging stations represent a highly sensitive element of the EV system from a cybersecurity perspective. This context requires robust mechanisms for both user and vehicle authentication, as well as protection against attacks such as spoofing, denial-of-service (DoS), and malware. The moderate representation of Blockchain suggests that this technology is being explored for identity verification, energy transaction settlement, and traceability applications.

The second most frequently studied area involved the integration of EVs with the power grid (V2G—vehicle-to-grid). This area featured the following number of publications:

• 25 focused on Authentication and Cryptography;
• 23 related to Cyber Attacks;
• 9 addressing Intrusion and Anomaly Detection;
• 6 concerning Blockchain.

This distribution highlights the critical need to secure the communication between electric vehicles and the grid. Ensuring confidentiality and integrity of real-time data exchange is essential, along with protection against manipulation in energy accounting and scheduling. The relatively lower presence of anomaly detection algorithms and blockchain applications suggests that these are still emerging areas of research rather than fully implemented technologies.

In onboard systems, i.e., those located directly within electric vehicles (EVs), the total number of publications was lower, yet the distribution was more balanced:

• 15 publications addressed Authentication and Cryptography;
• 16 focused on Cyber Attacks;
• 8 were related to Intrusion and Anomaly Detection;
• 8 discussed Blockchain.

This relatively even distribution suggests a comprehensive approach to securing the internal layers of the vehicle, where multiple layers of protection must be implemented simultaneously. Onboard systems—such as the Battery Management System (BMS), motor control units, and user interfaces—are vulnerable to both physical tampering and remote Cyber attacks. Blockchain is gaining traction as a potential platform for permission management and logging of diagnostic and service operations.

Table 6. Publications by cybersecurity in other categories.

Name	Authentication and Cryptography	Cyber Attacks	Intrusion and Anomaly Detection	Blockchain	Total
Total	48	41	22	14	102
Technologies and Infrastructure
Vehicle Charging	41	32	18	9	84
Grid Integration	25	23	9	6	51
Vehicle Systems	15	16	8	8	36
Research Methodology
Experiment	30	27	13	9	61
Literature Analysis	14	14	5	2	32
Case Study	0	4	3	0	7
Conceptual	37	23	14	12	68

highlights the methodological distribution of studies across four cybersecurity domains. Authentication and Cryptography (81 publications) and Cyber Attacks (68 publications) dominate, with conceptual and experimental works prevailing in both categories. In contrast, Intrusion and Anomaly Detection (35 publications) and Blockchain (25 publications) remain less developed, showing more balanced but still emerging research profiles with limited case study evidence. Across all three categories, Authentication and Cryptography remained the most prevalent topic, clearly confirming that identity, data, and access protection are fundamental requirements in all electromobility architectures. The use of Blockchain remains moderate but steadily increasing, indicating that its full potential has yet to be fully exploited. Future research may further explore this technology as a component for data transparency and non-repudiation.

In Section 4, a detailed quantitative analysis of the scientific literature on cybersecurity in electromobility was conducted. This analysis was based on the data presented in tabular format and corresponding visualizations, categorized by two time periods: 2017–2020 and 2021–2024. Additionally, chi-square tests were applied to assess the statistical significance of changes in data distributions.

The first step involved examining the overall trends in the number of scientific publications. Both the table and the corresponding bar chart revealed that the number of publications increased from 26 in 2017–2020 to 76 in 2021–2024. This represents an almost threefold increase in research activity, confirming growing interest in digital security in the context of EV development. This rise was deemed significant, and its statistical relevance was confirmed in subsequent analyses.

Further classification was performed according to document types. The chart indicates that journal articles and conference proceedings were the most frequently published formats. A total of 11 journal articles were recorded before 2020, compared to 37 after 2020. Likewise, conference papers increased from 15 to 37 over the same periods. Although other document types remained marginal, their appearance in the more recent period may reflect a diversification of knowledge sources within this emerging research domain.

Another classification focused on the thematic scope of the analyzed publications. Four main categories were identified: Authentication and Cryptography, Cyber Attacks, Intrusion and Anomaly Detection, and Blockchain. The most significant increase in the number of publications was observed in the area of Cyber Attacks, which grew from 6 to 35 publications. While Authentication and Cryptography experienced a less dynamic rise (from 21 to 27), it remained the most frequently represented category. This distribution is considered logical given the increasing risk of attacks in intelligent transportation systems and the ongoing development of defensive mechanisms.

The subsequent methodological analysis addressed the type of research approach used. The largest increase was observed in experimental studies, which rose from 15 to 46 publications, and in conceptual papers, which increased from 20 to 48. Literature reviews also grew, from 6 to 26, while case studies appeared only after 2020, totaling 7 publications. This trend suggests growing research maturity in the field, alongside a stronger focus on practical implementation and validation efforts.

A significant portion of the analysis also addressed the technological and infrastructural context. The highest number of publications was related to vehicle charging, increasing from 21 to 63, highlighting the central role of this area. Grid integration grew from 16 to 35 publications, and vehicle systems from 7 to 29. These trends indicate that cybersecurity concerns must be considered both in localized contexts (e.g., the EV itself) and at the infrastructure level (i.e., energy networks and charging stations).

The geographic analysis revealed that the highest number of publications originated from the United States (33 in total), followed by China (19 in total) and Canada (18 in total). An increase in publications was also noted in countries previously unrepresented in the literature, including India, Australia, Italy, and Turkey. This increase was confirmed to be statistically significant, as evidenced by a chi-square test result of χ² = 26.1 with 11 degrees of freedom and a p-value of 0.01. This indicates that the changes in publication distribution over time and across countries were not random, but likely influenced by national research policies and strategic investments.

Further analyses provided insight into the relationships between research methodologies and thematic categories, as well as between technological areas and cybersecurity domains. In the context of Authentication and Cryptography, conceptual and experimental approaches predominated. In contrast, studies on Cyber Attacks employed a diverse array of methods, including case studies, which highlights the applied and practical nature of this topic.

In terms of infrastructure, cybersecurity was most frequently addressed in the context of vehicle charging, as confirmed by a total of 100 publications in this area. While less research attention was dedicated to grid integration and vehicle systems, both areas also showed notable increases in scholarly interest.

In conclusion, based on the analyzed tables and visualizations, it can be stated that recent years have witnessed a marked increase in research related to cybersecurity in electromobility. These studies have grown in complexity, demonstrated broader engagement from emerging economies, and revealed strong connections to technical infrastructure. The application of chi-square testing confirmed that these changes were statistically significant, thus reflecting genuine developmental trends in the scientific literature.

5. Discussion

This review set out to synthesize where cybersecurity risks concentrate across the EV ecosystem and which countermeasures the literature treats as credible at today’s deployment scale. Across the corpus, the charging interface emerges as the primary exposure point: it couples users, vehicles, backend services and the distribution grid, and it concentrates authentication, metering and payment flows. Quantitatively, publication activity after 2020 accelerated and shifted from foundations (crypto, access control) toward attack modelling and intrusion/anomaly detection, which is consistent with the sector’s move from pilots to operation at scale. The dataset shows a near-threefold rise in publications from 26 (2017–2020) to 76 (2021–2024), with charging, grid integration and onboard systems all trending upward in security coverage.

5.1. What the Evidence Says About the Threat Surface

Three layers concentrate risk:

• Protocol and session layer (EV–EVSE–backend). Work dissecting ISO 15118 highlights weaknesses around certificate lifecycle, session take-over and availability of Plug & Charge when misconfigured; wireless access proposals (WAS) add new benefits but also new abuse paths if proximity and signaling are not robustly verified [11,13]. Schemes hardening mutual authentication with PUF and lightweight crypto reduce cost/latency and raise spoofing resistance in dynamic and wireless charging [36], while zero-knowledge proof (ZKP) approaches target privacy of use-patterns without involving a central authority [25,48].
• Operations and market layer. Work on tariff and billing integrity shows how manipulation of metering/price signals or free-riding during wireless charging can distort settlements or incentivize abusive behaviors; blockchain-backed contracts (and proof-of-behaviour (PoB)-type consensus) are explored to ensure auditability and deter misuse while preserving user confidentiality [16]. Architectural reviews of Electric vehicle supply equipment (EVSE) platforms point to gaps in security monitoring and incident response that keep recurring across brands and operators [26].
• Grid-coupling layer. Several studies model coordinated attacks that exploit the aggregate flexibility of EV fleets. Examples include distributed denial-of-service (DDoS) on EVSE control backbones or mobile apps, false data injection attacks (FDIA)on state estimation, and modal/oscillatory forcing against coordinated charging that propagates into frequency/voltage control; the literature reports material stability and latency impacts in simulation and co-simulation settings [14,33,34,41,43,45]. In vehicle-to-grid (V2G) scenarios, adversarial price manipulation can steer charging/discharging to harm feeders in IEEE test networks [19].

5.2. Defenses That Scale with Deployment

Defensive themes coalesce around four families:

• Hardened authentication and crypto. Beyond ISO 15118’s Public Key Infrastructure (PKI), the trend is toward hardware-rooted identities, short-lived credentials and context-bound sessions (location, proximity, Radio Frequency (RF) traits). Lightweight, post-quantum-ready designs are called for at the edge where compute and energy are tight [11,15,36,42].
• Detection and response. Intrusion/anomaly detection blends physics-aware features with learned behaviors. Results favor deep models (autoencoders, LSTM/GRU) and edge/fog deployment to push latency down and resilience up; hybrid schemes combining signatures with behavior improve coverage against novel patterns [28,37,43,46].
• Privacy-preserving settlement. Blockchain and smart contracts appear whenever transparency, non-repudiation and privacy of mobility traces must be balanced; zero-knowledge proofs (ZKP) and pseudonymous protocols reduce traceability while keeping audits feasible [16,25,42,48].
• Architecture and zero-trust. The literature and our quantitative split both point to architectures that assume every interface can be hostile: verify each request end-to-end, segment control from metering and payments, and instrument runtime monitoring compliant with IEC 62351-7-style telemetry [25].

5.3. Methods, Data and Where the Evidence Is Thin

Methodologically, the field leans on experimental and conceptual work, with case studies still scarce. That imbalance matters: simulated datasets and lab prototypes can overstate detector performance and understate integration/operational friction. The geographic split (rise of US/China/Canada; new entrants like India, Australia, Italy, Turkey) suggests targeted public investment is steering output rather than random drift (χ² analysis reported in Section 4). It should be noted that the χ² analyses reported earlier can be replicated directly from the category counts shown in Table 3 and Table 4, as these tables provide the complete underlying distributions used in the tests.

Throughout the article, and particularly in the sections presenting analysis and conclusions, the text indicates whether the evidence discussed originates from simulation-based studies or from real-world implementations. This distinction helps clarify the strength and applicability of the findings, as simulation results may not fully capture the practical challenges of deployment, while field evidence provides direct insights into operational contexts. By noting the type of underlying data, the synthesis ensures that readers can interpret the recommendations with appropriate consideration of their evidentiary basis.

5.4. Practical Implications

The analysis highlights that electric vehicle (EV) charging infrastructures constitute a critical vulnerability point within the broader smart grid ecosystem. Attacks targeting these infrastructures not only threaten service continuity but also risk cascading effects on distribution networks and consumer trust. To strengthen resilience, practical measures must be adopted by different stakeholder groups. For DSOs (Distribution System Operators) and TSOs (Transmission System Operators), ensuring the integrity of control signals to EVSE fleets is essential. Public Key Infrastructure (PKI)-based authentication should be implemented to prevent malicious command injection [81,114]. Monitoring load curves through feeder-level anomaly detection allows for early identification of synchronized charging events that may stem from coordinated botnet attacks [115,116]. Stress-testing tariff broadcast and demand-response systems using penetration testing techniques ensures robustness against spoofing and replay attacks [14,117]. Further, blockchain-enabled auditing frameworks can support transparent verification of load balancing commands and pricing adjustments [118]. Simulation studies demonstrate how improper communication security may destabilize the grid [119], while field evidence from smart grid pilots confirms that authenticated, encrypted control channels reduce operational risks [120]. DSOs should also leverage intrusion detection tailored to cyber–physical energy systems, which combine anomaly recognition with real-time telemetry [121]. Finally, cross-domain lessons from industrial control systems and healthcare infrastructures highlight the importance of harmonized standards and continuous monitoring in preventing cascading failures [19,122]. CPOs (Charge Point Operators) and eMSPs (e-Mobility Service Providers) must automate certificate lifecycle management, using OCPP 2.0.1 certificate provisioning to reduce manual errors and enable rapid revocation of compromised devices [123,124]. Rate-limiting and API protection mechanisms should be systematically applied to mitigate denial-of-service (DoS) attacks [125]. Telemetry auditing—including charging duration, energy flow, and billing logs—can detect mismatches indicative of fraud or data tampering [11]. Proximity-based authentication, such as Wi-Fi Access Systems (WAS) or Ultra-Wideband (UWB), must be reinforced with secondary cryptographic verification via ISO 15118 Plug & Charge to ensure robust identity validation [126]. Field studies have shown that insecure APIs in charging management systems can be exploited for fraudulent session initiation, underlining the need for layered defenses. Research into blockchain-based settlement demonstrates the feasibility of tamper-resistant billing and roaming authentication mechanisms that directly support eMSPs in managing contractual obligations [47]. Experience from campus networks and banking systems further illustrates the risk of overload strategies and fraudulent access patterns, both of which are transferable to EVSE contexts [127]. Thus, operators should incorporate anomaly detection modules trained on domain-specific datasets to strengthen fraud prevention and ensure continuity of mobility services [128].

Original Equipment Manufacturers (OEMs) and Tier Suppliers must embed secure hardware roots of trust, such as Trusted Platform Modules or Secure Elements, to guarantee that only authenticated firmware can be executed on EVSE or vehicle components [129]. Secure boot processes reduce exposure to unauthorized firmware injection, while explainable intrusion detection systems enhance operator situational awareness by issuing interpretable alerts (e.g., “unauthorized firmware flash detected”) instead of generic fault codes. Minimalist ISO 15118 stack implementations, combined with regular third-party code audits, are crucial to avoid vulnerabilities arising from unnecessary complexity [123]. Blockchain can also be adopted at the OEM level to maintain transparent firmware update histories and to manage distributed trust across multiple suppliers [118]. Lessons learned from anomaly detection in IoT and autonomous vehicles suggest that adaptive, machine learning-based IDS should be incorporated into EV architectures to capture evolving threats [47,121]. Finally, cross-referencing security practices from adjacent sectors—such as financial services and critical infrastructure—demonstrates the importance of standardized certification schemes and coordinated disclosure processes [122,127].

Together, these measures emphasize that cybersecurity in EV charging infrastructure cannot be addressed in isolation. Practical safeguards must combine strong cryptographic foundations, robust anomaly detection, and transparent auditing mechanisms, applied consistently across DSOs/TSOs, CPOs/eMSPs, and OEMs/Tier suppliers.

6. Conclusions

Cybersecurity is no longer a side constraint in electromobility; it defines whether charging networks can scale without eroding grid stability, user trust or market integrity. The literature mapped in this review converges on the following consistent points:

• The attack surface grows with interoperability. As EVSE density rises and V2G matures, coordinated abuse of scheduling, pricing and control channels becomes plausible at system scale [14,19,33,43].
• The most credible defense posture combines robust, hardware-anchored authentication with continuous, physics-aware anomaly detection, and with privacy-preserving settlement. This looks like a zero-trust stance applied to a cyber–physical grid: verify identities and intents at each hop; offer the least privilege; monitor continuously; and fail safely.
• Quantitatively, research attention has shifted from basic crypto to attacks and IDS, mirroring deployment realities, while case-based evidence remains limited and deserves priority in the next wave of studies.

The practical value of these findings spans operators, manufacturers and service providers: enforcing identity and session hardening at the edge, instrumenting EVSEs for runtime monitoring, and making settlement auditable without leaking mobility patterns are all tractable near-term steps. The barriers are equally concrete: computational cost at the edge, DDoS susceptibility of backend and field networks, inconsistent standards across stacks, and the immaturity of explainable AI for anomaly response.

The following avenues remain valid: Lightweight cryptographic and authentication algorithms (including post-quantum solutions) to secure communication in resource-constrained environments [8,9,10,11,15,22]; advanced anomaly and attack detection leveraging deep neural networks, federated learning and edge/fog computing [16,19,20,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48]; blockchain and smart contracts for transparent settlements, and to access control and privacy [17,49,50,51,52,53,54,55,56,57]; integration with smart grids and expansion of V2G services [12,18,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92]; secure V2X/IoT communication with low-latency, zero-trust standards [65,98,99,100,101,102,103,104,105,106,107,108,109,110,111]. These avenues should be undertaken with an emphasis on operational pilots and interoperability so that results transfer across vendors and regions.

Given the evidence synthesized in the articles, we recommend prioritizing the following: hardening ISO 15118 stacks and certificate workflows; evaluating WAS/UWB proximity only with multi-factor checks [11,13,47]; privacy-preserving authentication and billing using ZKP/PUF and selective-disclosure contracts to curb traceability and free-riding [16,36,42,48,81]; and grid-aware IDS tuned for EV-induced oscillations, FDIA and price-manipulation in V2G [14,19,33,34,43,45]. The findings presented reflect only those aspects of cybersecurity directly related to attacks, anomaly detection, and authentication in EV charging systems, without extending to the broader cybersecurity landscape.

Finally, the evidence base needs more field-grade datasets and open, standardized telemetry—preferably aligned with IEC 62351-7—to allow operators to benchmark detectors, share indicators and automate response without vendor lock-in.