Hybrid VAE-Transformer-based multi-task learning for cyberattack detection and fault classification in electric vehicle charging stations

1 Introduction

The transportation sector accounts for almost 24% of global CO₂ emissions, and the rapid worldwide adoption of electric vehicles (EVs) is an important pathway for reducing transportation-related emissions (Gorthi and Jyothi, 2026). According to the International Energy Agency (IEA) Global EV Outlook 2026, the global market for EVs sold in 2025 was already more than 20 million, which is around 25% of the world's new car sales. By 2035, it is estimated that EVs will number over 450 million, and electricity consumption for EV charging will increase significantly during this timeframe [International Energy Agency (IEA), 2026]. The public charging infrastructure is also improving, as EV Charging Stations (EVCSs) are becoming an important part of today's electricity and smart grid infrastructure, BloombergNEF reports (BloombergNEF, 2026). With the growth in EV usage and charging demand, the resilience and security of EVCSs are critical.

Today's EVCSs are cyber-physical systems that combine power electronic converters, embedded sensors, communication networks, and control systems, communicating with each other using protocols such as Open Charge Point Protocol (OCPP) and International Organization for Standardization (ISO) 15118 (Gorthi and Jyothi, 2026). They facilitate real-time communication among EVs, charging stations, service providers, and the smart grid for applications such as dynamic pricing, remote diagnostics, demand response, and Vehicle-to-Grid (V2G) operation. However, the benefits of enhanced connectivity come at the cost of a higher attack surface for EVCSs. Cyberattacks may alter sensor measurements, messages transmitted over communications links, or control instructions for equipment, leading to incorrect charging actions, equipment damage, and unintended impacts on grid operations (Waqar et al., 2026). Hence, it is important to monitor the cyber-physical status of EVCSs to ensure safe and uninterrupted charging operation.

The anomaly detection systems for EV systems included rule-based systems and statistical models such as Autoregressive Integrated Moving Average (ARIMA) and Principal Component Analysis (PCA), where the assumptions of linear relationships and stationary distributions are often not met in real-time EV environments (Wang et al., 2024). All these methods generate a high proportion of false positives and cannot change their operating conditions. Classical machine learning techniques like Support Vector Machine (SVM), K-Nearest Neighbor (KNN), and Random Forests (RFs) achieved good generalization results. Such approaches heavily depend on the manually engineered features and require a great deal of domain knowledge. They may fail to recognize fine-grained patterns or extract salient features when operating conditions fluctuate. In the end, these models usually address a specific objective, such as identifying a cyberattack or a physical failure, but not both. This limitation can affect their performance in practical EVCS installations where cyberattacks and physical failures can happen simultaneously.

Monitoring in EVCSs requires joint monitoring of the cyberphysical aspects, as EV charging can impact the distribution network voltage, Transformer loading, and power quality. Temporal deep learning models, such as attention-based architectures (Balakumar et al., 2024; Chadha et al., 2026; Jiang et al., 2025; Ghosh and Roy, 2024) and Bidirectional Long Short-Term Memory (Bi-LSTM) have thus been integrated into forecasting and energy-management approaches. Thus far, the majority of these systems assume that the data from the sensors for control and decision-making is reliable. Cyberattacks can invalidate this assumption by altering measurements used by energy-management and control systems (Ghosh and Roy, 2024). Therefore, it is important that a reliable EVCS monitoring system not only identifies any abnormal sensor behavior but also determines whether the abnormal behavior is caused by a cyberattack or a physical fault.

This is difficult to distinguish since similar patterns can be seen in sensor time-series measurements as a result of cyberattacks and physical defects (Rahman et al., 2024). The multi-agent Deep Reinforcement Learning (DRL) and Koopman-based approaches have been studied recently for detection and attack isolation of cyberattacks (Ramul et al., 2025; Xia et al., 2026). In addition, methods in the field of Explainable Artificial Intelligence (XAI) can be used to aid in the interpretation of attack-related decisions, such as SHapley Additive exPlanations (SHAP) and Local Interpretable Model-Agnostic Explanationsb (LIME), which described (Afrin et al., 2025). Current solutions, however, mainly address specific threat classes or single-system goals and seldom offer a holistic approach that can detect cyberattacks and simultaneously categorize a physical fault.

In contrast to Feature engineering, Deep Learning (DL) eliminates the need for it by learning representations directly from raw sensor data relevant to the task. Convolutional Neural Networks (CNNs) effectively capture short-term fault characteristics and local spatial patterns, improving fault detection performance. Sequential temporal dependencies across charging sessions can be captured by LSTM and Gated Recurrent Unit (GRU) networks and have been extensively used in EV fault detection and energy management (Pawlik et al., 2025). For V2G fault detection, hybrid CNN-LSTM architectures are used to leverage both approaches, whereas attention-based variants selectively weight informative time steps to estimate the battery State-of-Health (SoH) and model the battery degradation process (Peng et al., 2026; Saranathan et al., 2026). Ensemble learning frameworks estimate SoH and Remaining Useful Life (RUL) simultaneously, enhancing the robustness of SoH estimation for different battery chemistries. Inverter fault detection and EV drivetrain predictive maintenance are also extended to machine learning-based frameworks (Xu et al., 2025; Palaiologou et al., 2025). There is a fundamental constraint in the structure of LSTM and GRU networks: information travels sequentially through the hidden states, representing past context that is progressively diluted. Recurrent models are susceptible to low-rate data injection attacks that cause incorrect sensor data to be recorded over hours, and the detected anomaly may be some time removed from the causal signal. Daah et al. (2026) proposed that the CNN-BiLSTM-Attention architecture partially addresses this issue by combining CNN feature extraction with a bidirectional LSTM structure, which has demonstrated competitive performance in smart grid intrusion detection. These architectures are based on recurrent networks and are limited in their ability to capture long-term temporal information and achieve high inference speed. However, for recurrent architectures, information is presented sequentially, which limits their capacity to learn long-term temporal dependencies and relationships efficiently. Furthermore, traditional Variational Autoencoder (VAE) models yield a latent representation that is treated as a probability distribution, but typically do not explicitly distinguish between cyber-related and physical-fault-based attributes. Additionally, current EV security models remain limited in uncertainty-aware representation, interpretability, and their ability to simultaneously handle diverse cyber-physical scenarios (Ghoreishi et al., 2026; Terruggia et al., 2025).

The majority of the existing EVCS research focuses on detecting a cyberattack or on diagnosing a physical fault and applying them to separate scenarios, and it is difficult to distinguish between the cyber anomaly and the physical fault when the sensor pattern is similar. Traditional methods are also limited in their ability to isolate cyber-physical characteristics and capture long-range temporal dependencies. This encourages the development of a common VAE-Transformer model that learns disentangled cyber-physical representations and temporal dependencies, while simultaneously detecting cyberattacks and classifying physical faults. Table 1 summarizes the existing approaches, which are generally targeted at individual aspects of EV system security or fault diagnosis. Few studies unify probabilistic representation learning, cyber-physical disentanglement, long-range temporal modeling, and multi-task classification in a single framework. This gap leads to the development of the proposed VAE-Transformer framework for simultaneous cyberattack detection and physical-fault classification.

Table 1. Comparison of existing methods and VAE–Transformer framework.

The motivation for integrating the VAE-Transformer architectures stems from the nature of cyber-physical systems in EV charging stations. Both a cyberattack and a physical fault may create similar patterns in sensor measurements, making it difficult to distinguish between them reliably. The VAE is used to train a small, disentangled latent representation to help separate attack- and fault-related features. In the meantime, the Transformer is used to learn the long-term temporal dependence among multivariate sensor sequences. Hence, the proposed VAE-Transformer architecture specifically caters to the combined demands of feature disentanglement and temporal modeling at greater distances for cyberattack detection and fault classification of EVs.

The main objective of this study is to develop a hybrid VAE-Transformer-based multi-task learning framework for simultaneous cyberattack detection and fault classification in EV charging stations. Figure 1 shows the overall architecture of the proposed VAE-based hybrid deep learning framework. The framework begins by collecting data from EVs via their sensors, then preprocesses it, and finally extracts informative latent features using a VAE. The hybrid deep learning model (LSTM, GRU, Generative Adversarial Network [GAN], and Transformer) is used to analyze these features and capture discriminative feature representations. Finally, the framework is capable of not only detecting cyberattacks [such as Fast Gradient Sign Method (FGSM), Projected Gradient Descent (PGD), Replay, Man-in-the-Middle (MitM), Message manipulation attack] but also categorizing physical faults (Flatline). The VAE-Transformer is likely to be the most effective model due to its built-in self-attention mechanism, which can learn long-range temporal dependencies while leveraging parallel computing and introducing feature separation.

The main contributions of this study are as follows:

• A hybrid deep learning framework is proposed by integrating a Variational Autoencoder (VAE) with various DL architectures, including LSTM, GRU, GAN, and Transformer.
• A disentangled latent space representation is learned that separates cyber-related and physical fault-related features, reducing misclassification between cyberattacks and physical faults.
• A probabilistic VAE-based feature learning strategy is employed to enhance feature representation, improve detection accuracy, and reduce uncertainty in the learned latent features.
• The Transformer self-attention mechanism is incorporated to capture long-range temporal dependencies in sensor data, resulting in superior cyberattack detection and fault classification compared with DL models.
• A domain-aware consistency mechanism is incorporated to preserve the relationships among physically related EV charging sensor variables. This improves the alignment of learned features with the underlying cyber-physical characteristics of EV charging infrastructure.

This study is organized as follows: Section 2 describes the Cyberattack and physical fault scenarios. The hybrid VAE-based deep learning frameworks are presented in Section 3. The discussion on the performance evaluation metrics of the proposed system is in Section 4. The obtained results are presented in Section 5. Section 6 compares the proposed study with existing studies. The conclusion and the future research directions are outlined in Section 7.

2 Types of attacks and faults in EV charging networks

This section describes six different threat scenarios: Five cyberattacks (FGSM, PGD, Replay, MitM, and Message Manipulation attacks) and one physical fault (Flatline). All cyberattack scenarios are synthetically injected into clean EV sensor recordings, which are gathered from IoT-enabled EVs in various settings (EV Data Center, 2025). Each injection is designed to remain within a physically realistic sensor range, ensuring that the resulting attack samples cannot be easily identified through simple sensor-range checks.

2.1 Fast Gradient Sign Method (FGSM)

FGSM is an adversarial attack that adds a small, mathematically crafted modification to the original sensor readings to mislead the target detection model. The key idea is that the disturbance is structured rather than random noise, but it is calculated in a direction that most likely causes a mistake to the target detection model (Liu et al., 2026). In a formal sense, if the input window is supplied with a loss function (J) then the adversarial sample is created.

The adversarial input(x_*adv*)can be expressed in Equation 1.

xadv= x+ε . sign(∇xJ(x,y))(1)

where, x is the original sensor data, ε controls the size of the perturbation, J(x, y) is the loss function, (∇_*x*J(x, y)) is the gradient of the loss with respect to the input, and sign(.) determines the direction of the perturbation added to the input.

The FGSM-corrupted data mimic the output of real sensors almost completely from a detection perspective. The changes are not large enough to trigger any threshold-based decision, but are targeted at the model's decision boundary. Attacks done through FGSM take only one step and therefore are easy to quickly deploy at scale.

2.2 Projected Gradient Descent (PGD)

The PGD iteratively updates the perturbation to create a stronger adversarial attack without exceeding the permitted perturbation limit (Lyu et al., 2024). The first step of PGD is from a clean input (x). The adversarial sample after the next iteration (xadvk+1) is given in Equation 2.

xadvk+1=Πx(xadvk+α.sign(∇xJ))(2)

where xadvk is the adversarial sample at the current iteration, α is the step size, J is the loss function, ∇_*x*J is the gradient of the loss with respect to the input, and P_*x*(.) projects the perturbed sample back into the allowable perturbation region around the original input.

The adversarial signal generated by PGD is more sophisticated than that generated by FGSM, since PGD iteratively optimizes the perturbation within the desired range, enabling the creation of more effective adversarial examples. As for the corrupted sensor readings, they are statistically very close to normal operating data, which makes PGD the most difficult attack to detect. Nearly all the confusion in the normal-class samples shown in the results is due to samples attacked by PGD; this stems from PGD's ability to closely mimic normal sensor behavior, making them inherently difficult to distinguish.

2.3 Replay—Re-injected legitimate sensor data

A Replay attack is the easiest of all attacks, but relies on a secret and powerful weakness, and real data from the past is not the same as real data from now. The attacker does not create any sensor values but instead obtains legitimate sensor readings from a previous operating session and replays them into the current data stream at the wrong time (Liu et al., 2011).

Formally, a segment of sensor data from time t–d is substituted for the live readings in the window [t_*start*, t_*start* + L_*r*]: The corresponding expression is given in Equation 3.

xt= xt-d for t ε[tstart,tstart+Lr](3)

where x_*t* is the sensor reading at the current time t, x_*t*−*d* is the previously recorded sensor reading delayed by d time steps; d is the replay delay, t_*start* is the time at which the replay attack begins, L_*r* is the duration of the replay attack, and t ε [t_*start*, t_*start* +L_*r*] indicates that the replayed data are used throughout the attack interval.

This temporal characteristic of the Replay attack provides a compelling case for long-range self-attention. The reason is that a recurrent model with local windows of recent readings will not notice an unusual situation, whereas a model that compares the current segment against the wider temporal context of the session will notice an unusual situation. Only a model that considers both the current data and earlier sensor readings can detect that the readings are outdated.

2.4 Man-in-the-Middle (MitM) attack

A Man-in-the-Middle (MitM) attack occurs when an attacker covertly intercepts communication between the EV, charging station, and backend system and can eavesdrop on or alter the information exchanged. In the IoT-enabled EV charging environment, an attacker can eavesdrop on the charging commands, sensor measurements, authentication messages, or energy-related information exchanged between the communication endpoints. This may result in false charging decisions, unauthorized control, or interruption of normal charging operation.

This framework introduces a MitM attack by synthetically modifying communication-related sensor data while keeping the values within the real operating range. The attack aims to maintain the general characteristics of authentic sensor signals while introducing inconsistency in the transmitted information. This makes the attack difficult to detect by simple threshold-based detection methods.

The MitM attack can be represented in Equation 4.

xtMitM=xt+δt(4)

where x_*t* represents the original sensor/communication data at time t, δ_*t* represents the communication-level modification introduced by the attacker, and xtMitM denotes the resulting compromised data. The inclusion of MitM provides an additional evaluation of the model's ability to detect communication-level cybersecurity threats in EV charging networks.

2.5 Message Manipulation attack

A Message Manipulation (MsgManip) attack is an attack in which an attacker modifies legitimate messages exchanged between EV charging components, without necessarily disrupting the communication channel. The manipulated messages in an EV charging network can be charging status, power commands, voltage/current information, authentication data, or control signals. Small changes can lead to incorrect system decisions and compromise the safety and reliability of the charging process.

In this study, the Message Manipulation attack is synthetically generated by introducing controlled modifications into legitimate sensor or communication messages. The modified values are constrained to remain within realistic ranges so that the attack resembles a plausible communication disturbance rather than an obviously abnormal signal. The manipulated data are then assigned to the corresponding attack class and evaluated by the proposed deep learning framework.

The manipulated message can be expressed in Equation 5.

xtMsg=xt+Δt(5)

where x_*t* is the original legitimate message, Δ_*t* represents the injected manipulation, and xtMsg is the resulting compromised message. This attack scenario evaluates the proposed model's ability to distinguish legitimate EV charging communications from subtly modified messages.

2.6 Physical fault: flatline

Inspecting all errors in EV charging stations is not necessary to carry out an attack. Physical components fail sensors stopping, transducers getting stuck, communication modules freezing. A flatline fault mimics a hardware failure: a channel, or a set of channels from a particular sensor, operates at a fixed value over an extended period of time, setting that value without ever continuing to update the sensor readings (Mahapatro and andKhilar, 2013).

The corresponding equation is given in Equation 6.

xt,d= cd for t ε[tstart,tstart+Lf](6)

where x_{*t, d*} is the reading of sensor d at time t, c_*d* is the constant value assigned to the faulty sensor, t_*start* is the time at which the flatline fault begins, L_*f* is the duration of the fault, and t ε [t_*start*, t_*start* + L_*f*] indicates that the sensor output remains fixed throughout the fault interval. The Flatline fault has been added due to its resemblance to some cyberattacks, which makes it difficult to differentiate between the two.

The majority of cyberattacks aim to disrupt sensors by including only small or realistic changes to sensor data. The minor perturbations introduced by FGSM and PGD, replay attacks using previously recorded valid sensor data, and flat-line attacks with patterns that can resemble data suppression attacks are all small perturbations. The small perturbations are introduced by FGSM, PGD, replay attacks using previously recorded valid sensor data, and flat-line attacks using patterns that can look likeusing previously recorded valid sensor data, and flat-line attacks using patterns that can resemble data suppression attacks. Therefore, both long-range temporal dependencies and probabilistic feature representations need to be learned to distinguish cyberattacks from physical faults. To address this challenge, the VAE-Transformer framework is designed to learn disentangled probabilistic latent representations of cyber-physical features with the VAE, and to model long-range temporal dependencies by applying a self-attention mechanism to accurately detect and classify the attacks.

3 Hybrid deep learning architectures

All four DL models are trained with the same training-test split, batch composition, optimizer, and the number of epochs. All generate a binary cyberattack classification (normal vs. attack) and a multi-class fault classification. The differences between all four proposed models and the single-task approaches lie in their multi-task learning framework.

3.1 VAE-based feature learning framework

It is important to describe the common architectures before discussing the differences between the four proposed models. The common basis is the Variational Autoencoder (VAE), which serves as the common encoder-decoder architecture.

The encoder compresses the raw EV sensor data into a low-dimensional latent representation, while the decoder reconstructs the original input from the learned latent variables (Rengarajan, 2025). Unlike a conventional autoencoder, which maps each input to a deterministic latent vector, the VAE learns a probabilistic latent representation by modeling the latent variables as a Gaussian distribution characterized by a mean and variance. This probabilistic formulation effectively captures the inherent uncertainty in EV sensor data and enables the learning of more robust and generalized latent features for subsequent cyberattack detection and fault classification.

The VAE is trained by minimizing the loss with the latent distribution, encoder, and loss function expressed in Equations 7–9.

Latent distribution:Z~N(μ,diag(σ2))(7)

Encoder: [μ,logσ2]=fθ(x)(8)

Loss function:LVAE=Eq(z|x)[||x-x^||22]+DKL(q(z|x)||p(z))(9)

The first term represents the reconstruction error, which is the quality of the VAE's approximation of the input sensor window when reconstructing it from the compressed output. A high reconstruction error indicates that the input deviates from the normal data distribution learned by the VAE, suggesting that it may correspond to an anomalous event such as a cyberattack or sensor fault (Mitikiri et al., 2025). The second term is the KL-divergence, which regularizes the latent space to be close to a standard Gaussian distribution. This will help keep the model from memorizing the training examples and encourage it to learn more general representations of normal operation. Figure 2 shows the architecture of the Variational Autoencoder (VAE), in which the input is encoded into a probabilistic latent representation parameterized by the mean and standard deviation. The latent vector is then used to form the input and reconstruction, and KL divergence losses are used to optimize the learned latent representation.

3.2 LSTM

The temporal dependency in EV sensor data is modeled as a baseline using an LSTM. It has a gated memory mechanism that allows it to retain relevant historical information, which can make it inefficient at capturing long-range temporal dependencies when processing data sequentially (Chen et al., 2026).

3.3 GRU

GRU is a simpler recurrent network that uses update and reset gates to regulate the flow of temporal information, compared with LSTM. It is simpler, which allows faster training without compromising its temporal modeling ability (Balakumar et al., 2026).

3.4 GAN

GAN is an adversarial learning framework that involves training a generator and discriminator to learn complex data distributions. In the VAE-GAN baseline, adversarial training is incorporated into the network to enhance feature learning, alongside VAE reconstruction and latent regularization.

3.5 Transformer model

Transformer uses a self-attention mechanism to capture long-range dependencies in sequential data. It processes all input data in parallel, enabling faster and more accurate learning than recurrent models such as LSTM and GRU. The VAE-Transformer model splits the latent space into a cyber subspace and a physical subspace, making it easier to reason about cybersecurity threats and physical hardware faults. This disentanglement is unique to the proposed architecture. The VAE-Transformer is a variant of the VAE model in which the recurrent sequence module is replaced with a Transformer encoder based on a multi-head self-attention module. The Transformer reads all the time steps at once and computes the amount of attention to give to each time step in a sequence of time steps.

To do this, each input time step is projected into three vectors—a Query (Q), a Key (K), and a Value (V):

The attention score between any two-time steps is computed from Equations 10–13.

Q=XWQ(10)

K=XWK(11)

V=XWV(12)

Attention(Q,K ,V)=Softmax(QKTdk)V(13)

Here, X is the input sequence, Q, K, and V are the query, key, and value matrices obtained using learnable weight matrices, W_*Q*, W_*k*, and W_*v*. The attention function computes the similarity between queries and keys, applies the Softmax function to obtain attention weights, and uses these weights to generate the output from the value matrix V.

The unique power of this, compared with recurrent models, is that the dependency distance between any two time steps is fixed and independent of how far apart they are in the sequence. This capability allows the model to effectively capture long-range temporal patterns without suffering from information bottlenecks or gradient degradation over extended sequences (Waqar et al., 2026; Makaremi, 2025; Kuang et al., 2025). Moreover, attention mechanisms are effective for long-term dependencies in the battery health prediction task (Zhao et al., 2023).

The VAE-Transformer framework is illustrated in Figure 3. The pre-processed EV sensor data is encoded into disentangled cyber and fault latent representations. The Transformer is used to extract temporal features. In contrast, the decoder is used to reconstruct the input and, simultaneously, to perform binary attack detection and multi-class fault classification.

3.6 Disentangled latent space

The VAE latent space is explicitly split into two non-overlapping subspaces:

• Z_*c* (cyber subspace): captures features associated with adversarial manipulations in the sensor stream.
• Z_*f* (physical subspace): captures features associated with hardware faults and degradation.

This design is inspired by the need to identify cyber-physical anomalies, which has been a challenge in previous EV cybersecurity designs (Xia et al., 2026; Ghosh and Roy, 2025; Sepehrzad et al., 2024). The model is trained to distinguish whether an anomaly is caused by a cyberattack or a physical fault using Mutual Information (MI) minimization and an orthogonality constraint.

3.7 EV-domain-aware physical consistency

The proposed framework incorporates EV-domain knowledge by considering the relationships among physically related sensor groups rather than treating all channels independently. Battery variables [state of charge (SoC), State of Health (SoH), voltage, current, and temperature], motor variables [temperature, vibration, torque, Revolutions Per Minute (RPM), and power], and other operating-condition variables exhibit correlated behavior. These relationships are used to improve the distinction between normal operating variations, cyber manipulation, and physical faults.

A domain-consistency loss is expressed in Equation 14:

Ldomain=1G∑g=1G||Cg(x)-Cg(x^) ||F2(14)

The final training loss function is formulated in Equation 15:

Ltotal=LRecon+λKL·LKL+λBCE·LBCE+λCE·LCE +λdis·LDis+λdomain·Ldomain(15)

This domain-aware constraint enables the model to preserve meaningful relationships between EV sensor variables and strengthens its applicability to EV cyber-physical anomaly detection. The sensor groups used are consistent with the EV telemetry features described in the dataset.

3.8 Loss functions

The loss functions facilitate the model to learn accurate features by improving the reconstruction of the input, regularizing the latent space, improving the classification of cyberattack and faults, and separating the cyberattack and physical fault features for better detection performance. First the reconstruction loss (L_*RL*) is given in Equation 16.

LRL=E[||x-x^||2](16)

The reconstruction loss measures the difference between the original input x and the reconstructed output x^. Here, E denotes the expectation and ||x – x^||² represents the squared error. A lower value indicates accurate reconstruction, while a higher value suggests the presence of an anomaly.

The KL Divergence loss (L_*KL*) is expressed in Equation 17.

LKL=DKL(q(z|x)||p(z))(17)

The KL divergence measures the difference between the learned latent distribution q(z|x) and the standard Gaussian prior p(z). It regularizes the latent space, preventing overfitting and improving the model's generalization.

The Binary Cross-Entropy loss (L_*BCE*) can be expressed in Equation 18.

LBCE=−[ylogy^+(1−y)log(1−y^)(18)

where y is the true binary label, and ŷ is the predicted probability. The BCE loss penalizes incorrect binary predictions, improving cyberattack and normal-state classification.

The multi-class Cross-Entropy (L_*CE*) is represented in Equation 19.

LCE-Σyklogy^k(19)

where y_*k* is the true class label and ŷ_*k* is the predicted probability for class k. This loss penalizes incorrect predictions and improves multi-class fault or attack classification.

The Disentanglement Loss (L_*Dis*) is expressed in Equation 20.

LDis= λMI·I(Zc;Zf)+λorth ||Zc∧T Zf||F2(20)

where Z_*c* and Z_*f* represent the cyber-physical latent features, I(.) is Mutual Information, λ_*MI* and λ_*orth* are weighting factors. The Frobenius norm (F) makes the orthogonality constraint mathematically clearer. This loss separates cyber-physical representations, enabling each latent space to learn only its corresponding information.

The total losses are expressed in Equation 21.

Ltotal=LRL+λKL·LKL+λBCE·LBCE+λCE·LCE+λdis·LDis(21)

The weighting factors λ_*KL*, λ_*BCE*, λ_*CE*, and λ_*dis* control the contribution of each loss term and are optimized using the validation set. For the three baseline models, the disentanglement loss is omitted because latent space separation is a unique feature of the proposed architect.

Table 2 shows a comparison of the architectural and training parameters of the four hybrid deep learning models combining a VAE. The sequence learning module and loss function were the only differences between the models, allowing for a fair performance comparison, since they share a common VAE backbone and training settings.

Table 2. Architectural and training hyperparameters for all four models.

4 Performance metrics

Metrics are numerical values that are used to assess the performance of ML or DL models. They compare the predicted results with the actual values to evaluate the accuracy and reliability of the model's predictions.

4.1 Accuracy

Accuracy is the ratio of the number of TP + TN samples to the total number of samples, as expressed in Equation 22. While it is easy to understand, it may be misleading in imbalanced datasets, where one class dominates the data (Ghosh and Roy, 2024).

Accuracy=(TP + TN)/(TP + TN + FP + FN)(22)

4.2 Precision

Precision is used to detect that the percentage of attacks detected and predicted correctly by the model, is accurate and expressed in Equation 23. A high precision value will reduce the number of false alarms, a point that is crucial to avoid alerting customers and build trust in any real-world system (Ramul et al., 2025).

Precision=TP/(TP + FP)(23)

4.3 Recall

Recall measures how well the model identifies real attacks and is expressed in Equation 24. A high recall value indicates that the model correctly identifies the majority of the attack instances, resulting in a low false negative rate. This is particularly important in cybersecurity systems, where failure to detect an attack may result in severe operational and security consequences (Ghoreishi et al., 2026).

Recall=TP/(TP + FN)(24)

4.4 F1-score

The F1-score combines precision and recall into a single metric using their harmonic mean. It provides a balanced measure of performance, ensuring that both false alarms and missed attacks are minimized, and is expressed in Equation 25. A high F1-score indicates that the model performs well on both aspects (Lyu et al., 2024).

F1=2×Precision×Recall/Precision + Recall(25)

4.5 The confusion matrix

The confusion matrix summarizes the model's predictions into four categories: True Positive (TP), True Negative (TN), False Positive (FP), and False Negative (FN). TP and TN represent correctly classified attack and normal samples, respectively, whereas FP and FN represent false alarms and missed attacks. It forms the basis for evaluating the model's performance of the model and computing various performance metrics (Rahman et al., 2024).

4.6 AUC-ROC

AUC-ROC measures the model's ability to distinguish between attack and normal samples across all decision thresholds and is expressed in Equations 26 and 27. A value close to 1 indicates excellent separation, while a value near 0.5 suggests random performance. It provides a comprehensive evaluation beyond a single threshold (Mitikiri et al., 2025).

TPR (Recall)=TP/(TP+ FN)(26)

FPR=FP/(FP + TN)(27)

4.7 FPR @ 95% TPR

FPR@95% denotes the number of attacks the model falsely identifies as fraud at a 95% detection rate, as given in Equation 28. It represents the number of “false alarms” that occur within a high-sensitivity setting, and where deployment might occur in the real world, too many “false alarms” can be overwhelming.

FPR@95=FPR(τ),τ=argminτ=|TPR(τ)-0.95|(28)

where FPR@95 is the false positive rate when the true positive rate (TPR) reaches 95%. τ^* is the optimal decision threshold that makes TPR closest to 0.95, while FPR(τ^*) is the corresponding false positive rate at that threshold.

4.8 Macro F1

Macro F1 computes the F1-score separately for each class and then takes an average of the F1-scores; the weights used are equal. This gives equal importance to all classes, including less frequent ones, and enables a more accurate assessment of multi-class classification performance. This will be more demanding than global accuracy. A model that fails on rare classes but passes well on common classes (such as Replay) will get a low Macro F1. This means the model needs to be as effective as possible for all classes and not just for those it has encountered most during training, and is expressed in Equation 29.

F1macro=1C∑i=1cF1i(29)

4.9 MCC

The Matthews correlation coefficient (MCC) is a strong measure taking all of the elements of the confusion matrix. It gives a reasonable assessment even with imbalanced data sets, with values between −1 (poor performance) and +1 (perfect prediction), and is expressed in Equation 30.

MCC=TP.TN - FP.FN(TP + FP)(TP + FN)(TN + FP)(TN + FN)(30)

4.10 Learning curve

Learning curves show model learning over time, with plots of training and validation loss over epochs. First, both losses are quite steep, suggesting good learning. The curves slowly approach each other as training keeps going. Reducing the difference between training and validation loss to be small means that the model generalizes well, and a large difference means overfitting. Smooth, tightly fitting curves indicate that the model is learning well and is in line with data it has not encountered before.

4.11 t-SNE plots

t-distributed Stochastic Neighbor Embedding (t-SNE) is a dimensionality reduction method that transforms high-dimensional latent features (such as VAE latent vectors) into a 2D image, while maintaining the neighborhood structure of the data points. t-SNE is more powerful than linear techniques like PCA for uncovering hidden cluster structures, making it easier to see how classes are separated.

In this study, t-SNE is used to check the quality of the learning of the VAE model by verifying the well-separability of the latent representations of the various cyberattacks and faults visually. The clear and separated clusters show that the model achieves good feature disentanglement, and the smaller overlap between clusters indicates that the proposed model has better representation-learning ability than baseline models.

5 Results and discussion

Figure 4 shows the overall flow the proposed framework. The data from the EV sensors are collected and pre-processed, followed by cyberattack generation and feature learning based on the VAE. The learned latent features are divided into cyber and fault features and then processed based on four hybrid DL models. Finally, the framework simultaneously detects cyberattacks in binary and classifies faults into multiple classes and evaluates the performance.

5.1 Dataset

In the EV IoT-Predictive Maintenance Dataset, the data are gathered from IoT-enabled electric vehicles (EVs) in various settings. This dataset contains a total of 175,393 sensor readings sampled every 15 min per reading from January 2020 to January 2025, as well as multi-modal telemetry and historical maintenance data (EV Data Center, 2025). Every data point documents the status of 29 features of five major subsystems in an electric vehicle, such as the battery, motor, braking system, tire, and the environment.

5.2 Data pre-processing

The raw data are processed, following a structured data pipeline before feeding into a model for training and evaluation. The Timestamp column was excluded from the data preprocessing process because it is an index and does not contain information regarding attack and fault detection. The remaining 24 continuous features (from SoC to Route Roughness) were used as input features, while Failure Probability, Maintenance Type, RUL, TTF, and Component Health Score were used as target variables and not included as input features. All input features were normalized to the range [0, 1] using Min–Max normalization to make sure that all features have the same scale (e.g., Motor_RPM can not dominate SoC). The multi-class physical fault label was the Maintenance_Type column, and the binary anomaly label was Failure Probability. Finally, data were split into 80% for training and 20% for testing following a stratified train–test split to ensure class distribution in both train and test sets. Table 3 shows details about the EV IoT Predictive-Maintenance Dataset utilized in this study, including the sensor features, target variables, threat scenarios, data preprocessing, class distribution, and train–test split.

Table 3. Dataset parameters.

5.3 Cyberattack injection methodology

The original EV IoT dataset contains only the clean sensor readings, so the cyberattack is synthetically added to the test set to simulate real-world adversarial conditions. The normalized sensor data is directly subjected to all six attacks: FGSM, PGD, Replay, MitM, Message manipulation, and Flatline. In each attack, it is injected with a clearly distinguishable signal magnitude so the six attack classes are well-separated in the latent space, allowing the model to learn distinct signatures for each. The injected samples come with class labels: 0 = Clean, 1 = FGSM, 2 = PGD, 3 = Replay and 4 = Flatline, 5 = MitM, 6 = Message manipulation. Attacks are only used on the test set, and the models are trained on clean data and tested on their capacity to detect unseen, adversarial test data without seeing attack patterns during training. Table 4 shows the target performance thresholds for attack and fault detection evaluation. To evaluate the effectiveness of the proposed framework, the benchmark metrics are used as reference values for precision, recall, F1-score, and AUC-ROC.

Table 4. Performance benchmarking thresholds for attack and fault detection.

5.4 VAE-DL models

This section shows all graphs of the results for all four VAE architectures. The same test data and conditions are used for both models. For all models, the graphs are shown in the following standard order: (a) binary confusion matrix, (b) attack type confusion matrix, (c) total loss, (d) AUC-ROC during training, (e) reconstruction & KL loss, (f) fault and cyber signal separation, (g) orthogonality and MI loss, and (h) ROC curve.

5.4.1 Binary confusion matrix

The binary confusion matrices for clean and attack classification are shown in Figures 5a–d for VAE-LSTM, VAE-GRU, VAE-GAN, and VAE-Transformer models, respectively. All models obtain high accuracy in binary detection, with the majority of the predictions clustered around the diagonal. The VAE-Transformer has the highest binary F1-score (99.03%) and AUC-ROC (99.76%) values, indicating the lowest false positive and false negative rates among the models.

5.4.2 Attack type confusion matrix

Confusion matrices are shown in Figures 6a–d to compare the attack classification performance of VAE-LSTM, VAE-GRU, VAE-GAN, and VAE-Transformer models.

The classification accuracy is high for all models, with the majority of the predictions focused along the diagonal, which signifies correct identification of the attack. Of these, VAE-Transformer shows the best classification accuracy (Macro F1 = 0.9729) and the lowest misclassification, especially for the Replay attack, which is the most difficult.

5.4.3 Total loss

The loss curves for the training and validation sets of the VAE-LSTM, VAE-GRU, VAE-GAN, and VAE-Transformer models are shown in Figures 7a–d.

The training and validation losses of all models are similar, suggesting that the models learned effectively without significant overfitting. The VAE-Transformer exhibits the best optimization stability and the most stable training behavior.

5.4.4 AUC-ROC during training

The AUC-ROC measures the model's ability to distinguish between normal and attack samples, where a value closer to 1 indicates better classification performance. To validate these models, the AUC-ROC curves of the VAE-LSTM, VAE-GRU, VAE-GAN, and VAE-Transformer models are shown throughout the training process in Figure 8. All models have consistently high AUC-ROC values and converge quickly, with excellent discrimination between normal and attack samples. The VAE-Transformer achieves the highest and most stable AUC-ROC among them, showing its better capability of classification.

5.4.5 Reconstruction and KL loss

The reconstruction and KL divergence loss curves of VAE-LSTM, VAE-GRU, VAE-GAN, and VAE-Transformer models are compared in the training process in Figures 9a–d. The reconstruction losses of all models converge, and the KL divergence monotonically decreases, showing good learning of the latent space. In particular, the VAE-Transformer has the smallest and most stable KL divergence, indicating superior representation learning ability in the probabilistic space.

5.4.6 Fault and cyber signal separation

The comparison of fault and cyber signal separation learned from the VAE-LSTM model, VAE-GRU model, VAE-GAN model, and VAE-Transformer model is shown in Figures 10a–d. The VAE-LSTM and VAE-GRU can keep a stable fault representation under decreasing cyber signal strength, while the VAE-GAN can only keep a stable fault representation for half of the training process. The VAE-Transformer, by contrast, achieves the most balanced and stable separation of fault and cyber features, showing better disentangled representation learning performance.

5.4.7 Orthogonality and MI loss

Figures 11a–d compare the orthogonality and Mutual Information (MI) loss curves of the VAE-LSTM, VAE-GRU, VAE-GAN and VAE-Transformer during training. In all models, the orthogonality and MI losses decrease, suggesting better disentanglement of cyber and fault representations. The VAE-Transformer is able to obtain the most effective disentanglement of features and has the fastest convergence and the lowest loss values among them; it shows the best feature disentanglement.

5.4.8 ROC curve

The ROC curves of the VAE-LSTM model, VAE-GRU model, VAE-GAN model, and VAE-Transformer model for binary attack detection are shown in Figures 12a–d. The AUC-ROC of all models is high and has low false-positive rates, meaning that they have good discrimination between normal and attack samples. The best detection performance is achieved by the VAE-Transformer model with the highest AUC-ROC score (99.76%) and the lowest FPR@95 (0.41%).

5.5 Comparative performance analysis

Figure 13 presents results for all four models on six metrics for the binary classification problem of determining whether a sensor window is in a normal state or an attack occurs (in both cases, an attack is classified as normal or abnormal). Both models are tested on an identical held-back data set under identical test conditions.

All models show high precision (above 0.97) and high recall (above 0.99) scores, indicating few false alarms and few missed attacks. VAE-Transformer performs best across all metrics, with a maximum F1-score of 0.9891, accuracy (99.10 %), AUC (0.9976), and MCC (0.982), making it highly reliable and well-balanced compared with other models.

Table 5 compares the computational complexity of four hybrid models based on their trainable parameters and temporal-processing complexity. VAE-GRU is the most computationally efficient, while VAE-GAN has the highest complexity due to adversarial training. VAE-Transformer has high complexity due to the self-attention mechanism. However, it provides superior long-range temporal modeling and achieves the best overall detection performance among the evaluated models.

Table 5. Computational complexity comparison of hybrid VAE-based deep learning models.

Table 6 compares the class-wise performance of the four models using precision, recall, and F1-score. The results show that the VAE-Transformer achieves the highest overall performance, particularly for FGSM, PGD, Flatline, MitM, and message manipulation attacks, while replay remains comparatively more challenging for all models. This demonstrates the effectiveness of the proposed VAE-Transformer in distinguishing different cyberattack and fault patterns.

Table 6. Per-class computational complexity, F1-score, and accuracy for each model and attack type.

The comparison of the higher-is-better performance metrics of the hybrid deep learning models is shown in Figure 14a, and lower-is-better performance metrics are represented in Figure 14b. It shows that the performance of the VAE-Transformer is better than the remaining architectures for cyberattack detection in EV sensor networks. It has the highest AUC-ROC of 0.9976, the highest Binary Attack F1 of 0.9891, the highest Attack Type Macro F1 of 0.9930, and the lowest FPR@95% of 0.0041 (false alarms of only 0.41% of clean EV sensor readings when configured to catch 95% of all attacks). Furthermore, its MCC of 0.982 is the highest, confirming that its strong performance is not the result of class imbalance bias but genuine discriminative ability. Graphical comparison of FPR @ 95% TPR, demonstrating that the VAE-Transformer achieves the lowest FPR and the best detection performance among the evaluated models.

The Ablation analysis of EV-domain-aware learning is presented in Table 7. It shows that adding disentanglement improves cyberattack–fault separation, while the proposed EV-domain consistency further improves Accuracy, Macro-F1, MCC, and AUC-ROC with reduced FPR. This demonstrates that incorporating EV-specific sensor relationships improves the domain adaptation of the proposed model.

Table 7. Ablation analysis of EV-domain-aware learning.

5.6 Disentanglement analysis

All four models explicitly separate cyberattack information and physical fault information into two independent subspaces, the latent space of the disentangled VAE. This disentanglement can be visually confirmed by the Orthogonality and Mutual Information (MI) loss curves. In the first 3–8 epochs, the Orthogonality loss decreases to near zero in all four models, starting at 0.46 to 0.80, and stays at zero for the remaining epochs (52–57). The same tendency is observed with the MI loss, which starts to drop to almost zero after 1–2 epochs and stays more or less steady for the rest of the training. This means that the cyber subspace and the fault subspace grow more orthogonal from the beginning of training, both from a geometrical point of view and from a statistical point of view.

This disentanglement is useful in practice because the model can detect whether a cyberattack is taking place, while also assessing whether a physical fault is also occurring, without the two tasks interfering with each other. This multi-task independence is crucial for real-world EV monitoring systems, where security attacks and physical wear-and-tear can happen simultaneously. The t-SNE visualization of the disentangled latent space of the VAE-LSTM model, VAE-GRU model, VAE-GAN model, and VAE-Transformer model is shown in Figures 15–18. The VAE-Transformer produces the tightest, the majority of the well-separated clusters between Normal, attack types, and fault types, visually confirming its best quantitative scores (AUC 0.9976, Macro-F1 0.9729). The VAE-GRU shows clear separation with slightly more inter-class proximity. The VAE-LSTM achieves reasonable separation but shows visibly more overlap in specific attack and fault clusters, tying to its lower long-range detection performance on Replay and PGD attacks. The VAE-GAN exhibits the the majority of the cluster overlap and diffuseness among the four models, consistent with its high KL-divergence instability around epochs 30–33 and its comparatively weaker benchmark.

6 Discussion

Table 8 compares the existing methods with recent SOTA methods. Deep learning, autoencoder, Koopman-based, and reinforcement-learning methods have recently been used in EV charging cybersecurity and fault diagnosis. The majority, though, are concerned with detecting any cyberattack or diagnosing any physical fault separately. The proposed VAE-Transformer, on the other hand, first disentangles the latent representations from the cyberattacks and physical faults and then classifies the latter using temporal modeling with the Transformer. The numbers reported are for comparative purposes only and may vary depending on the datasets and experimental conditions.

Table 8. Comparative analysis of proposed work with recent SOTA methods.

To address these limitations, the VAE-Transformer framework incorporates probabilistic feature learning, self-attention in the Transformer model, and a multi-task learning function within an end-to-end framework. The disentangled latent space explicitly separates and minimizes cyber-related and physical fault components via Mutual Information minimization and orthogonality constraints, respectively, and the VAE learns powerful latent representations. Moreover, the Transformer can learn long-range temporal relationships among the entire sensor sequence, enabling it to detect stealthy attacks that are hard for recurrent models to detect. The proposed multi-task framework combines binary cyberattack detection and multi-class physical fault classification into a single framework, eliminating computational and improving learning efficiency. The framework offers several benefits for EV charging stations, addressing the significant drawbacks of current approaches and demonstrating its potential to scale to meet the demands of a growing number of charging stations, especially when they are connected to the internet.

7 Conclusion

This study developed a hybrid VAE-based multi-task learning framework for simultaneous cyberattack detection and physical-fault classification in IoT enabled EV charging stations. To make a systematic comparison between various temporal-learning mechanisms, four architectures (VAE-LSTM, VAE-GRU, VAE-GAN, and VAE-Transformer) were implemented. Among the four evaluated architectures, the proposed VAE-Transformer provided the most competitive performance, achieving 99.76% AUC-ROC, 99.03% binary attack F1-score, 97.29% attack-type Macro-F1, 0.41% FPR@95%, and 98.20% MCC. These results demonstrate its effectiveness in distinguishing normal and cyberattack conditions while classifying different attack and physical-fault events.

The ablation study further confirmed the contribution of the proposed components. Incorporating latent disentanglement and EV-domain-aware physical consistency improved the overall performance to 99.36% accuracy, 99.38% Macro-F1, 98.35% MCC, 99.79% AUC-ROC, and 0.38% FPR@95%. The results indicate that combining probabilistic representation learning, cyber-physical disentanglement, long-range temporal modeling, and multi-task classification provides an effective framework for EVCS monitoring.

The main limitation is the limited availability of diverse real-world EVCS datasets containing both cyberattack and physical-fault events. The future study will focus on validation using larger real-world datasets, explainable AI, and real-time edge deployment. Overall, the proposed framework demonstrates strong potential for secure and reliable monitoring of IoT-enabled EV charging infrastructure.

Generative AI statement

The author(s) declared that Generative AI was not used in the creation of this manuscript.

Any alternative text (alt text) provided alongside figures in this article has been generated by Frontiers with the support of artificial intelligence and reasonable efforts have been made to ensure accuracy, including review by the authors wherever possible. If you identify any issues, please contact us.

Publisher's note

All claims expressed in this article are solely those of the authors and do not necessarily represent those of their affiliated organizations, or those of the publisher, the editors and the reviewers. Any product that may be evaluated in this article, or claim that may be made by its manufacturer, is not guaranteed or endorsed by the publisher.

Footnotes

Edited by: Muhammad Asim, University of Engineering and Technology, Lahore, Pakistan

Reviewed by: Shahid Ul Islam, Missouri University of Science and Technology, United States

Ke Hu, Chongqing University of Posts and Telecommunications, China

Anup Gade, SB Jain Institute of Technology Management and Research, India

Footnotes

AI, artificial intelligence; ANN, artificial neural network; ARIMA, autoregressive integrated moving average; AUC, area under the curve; AUC-ROC, area under the receiver operating characteristic curve; BCE, binary cross-entropy; Bi-LSTM, bidirectional long short-term memory; BLDC, brushless direct current; CAN, controller area network; CE, cross-entropy; CNN, convolutional neural network; CO₂, carbon dioxide; DL, deep learning; DRL, deep reinforcement learning; DSM, demand-side management; EV, electric vehicle; EVCS, electric vehicle charging station; EVCSs, electric vehicle charging stations; FGSM, Fast Gradient Sign Method; FN, false negative; FP, false positive; FPR, false positive rate; FPR@95%, false positive rate at 95% true positive rate; GAN, generative adversarial network; GRU, gated recurrent unit; IoT, internet of things; ISO, International Organization for Standardization; KL, Kullback–Leibler; KL Divergence, Kullback–Leibler Divergence; KNN, K-Nearest Neighbors; LIME, local interpretable model-agnostic explanations; LSTM, long short-term memory; MCC, Matthews correlation coefficient; MI, mutual information; MitM, man-in-the-Middle; NN, neural network; OCPP, open charge point protocol; PCA, principal component analysis; PGD, Projected Gradient Descent; PV, photovoltaic; Q, query; ReLU, rectified linear unit; ROC, receiver operating characteristic; RUL, remaining useful life; SGD, stochastic gradient descent; SHAP, SHapley Additive exPlanations; SoC, state of charge; SoH, state of health; SVM, support vector machine; TN, true negative; TP, true positive; TPR, true positive rate; TTF, time to failure; UARL, uncertainty and robustness aware reinforcement learning; V, value; V2G, vehicle-to-grid; VAE, variational autoencoder; VAE-GAN, variational autoencoder–generative adversarial network; VAE-GRU, variational autoencoder–gated recurrent unit; VAE-LSTM, variational autoencoder–long short-term memory; VAE-Transformer, variational autoencoder–transformer; W, weight matrix (used in neural network equations); XAI, explainable artificial intelligence.