Abstract
The usage of Electric vehicle (EVs) has been exponentially growing due to its focus on eco-friendly means of transport, distributed charging platform and user dictated supporting infrastructures. The EVs are charged by the charging stations which equipped with Electric Vehicle Supply Equipment (EVSE) that contains Internet enabled computers. These systems are considered to be more important for controlling the function such as charging electric vehicles, authorization and smart connection to the local power grid using different wireless technologies such as green WIFI, Bluetooth and even 5 G. The cyber-attacks such as DoS and DDoS attacks can violate integrity, confidentiality and availability of the EVSE resources. Hence the intelligent Intrusion Detection System (IDS) is required to ensure the system for the robust and trustworthy deployment of EVSE resources. To meet the above challenge, this paper proposes new composite and intelligent system which contains the deep learning based IDS and high random chaotic generators to safeguard the data against the different cyber-attacks. The proposed IDS has been modelled based on Gated Recurrent Units (GRU) and counter measures are performed by adopting the Enhanced Chaotic Scroll attractor keys (ECSA). The contribution of this research paper is as follows: Novel Dataset Preparation for EVSE under different attack scenarios, Implementation of high accurate multi-objective accurate GRU based IDSs, Design of Enhanced Chaotic Countermeasure Encryption Schemes for the counterfeiting the attacks in Internet Enabled EVSE system. The extensive experimentation has been carried out into two important phases. In first phase algorithm centric metrics such as prediction accuracy, time of detection, whereas in second phase key centric metrics such as Number of Changing Pixel Rate (NPCR), Unified Averaged Changed Intensity (UACI), Key sensitivity and entropy are calculated and compared with the other existing methodologies. Results demonstrates that the proposed ensemble system has outperformed than the other methodologies and proves its strong place in designing the more secured Internet Enabled EVSE systems.
Introduction
Electric vehicle Charging equipment (EVSE) generally has essential components, namely data sensing, communication and computational networking [1]. The data sensing unit plays a major role in collecting data which comes from the EVSE components. The computational unit has the operation such as arithmetic, scheduling and charging operations as well as authentication operations among different users [2, 3]. With an advent of Internet of things, data transmission from the EVSE stations has reached its new dimension but paid the way of different vulnerabilities which even leads to the economic and operational shutdowns of EVSE [30, 31].
Several widely seen attacks which has immense impact on EVSE infrastructures are Denial of Service (DoS), Distributed Denial of Services (DDoS) and so on [4–7]. These attacks; floods the infrastructure with fake request and should take carefully or it leads to complete infrastructure loss. Generally IDS frameworks are utilized to monitor the network traffic and suspicious activities in the network. To prevent the above mentioned attacks in the network, strong IDS along with the encryption schemes are mandatorily required to ensure the security. These attacks are not intelligent and needs to be updated manually. Hence the intelligent system of IDS is required to learn a new features of attacks. With the advent of Machine Learning (ML) and Deep Learning (DL) models, IDS have reached its peak performance in identifying the different attacks mainly DoS attacks.
From the several studies [11–16], it seems that there is no proper methodology has been developed for the security needs of EVSE to deal with different attacks. It infers that still EVSE require appropriate model to reduce the technical gap in terms of IDS modelling, data collection and strong countermeasure methodology.
Motivated from above background, this paper proposes the novel DL based IDS integrated with scroll chaotic AES key generation in EVSE to deal with the multiple attacks. The proposed model named as ECHO-GRU IDS(Ensembling of Chaotic Encryption with Optimized GRU) IDS which employs the principle of the Optimized Gated Recurrent Units for predicting the multiple class attacks such as Denial of Service, DDoS and MIM attacks in an EVSE environment with strong chaotic AES encryption to provide the effective defense against the above attacks.
Research contribution
The research contributions are presented as follows The paper proposes the novel software testbed for an effective data collection unit for normal and malicious information in Internet enabled EVSE infrastructures. The complete software was created using OMNET++with Python API and to our knowledge it is first of its kind in research. The paper proposes the novel Optimized GRU deep learning models to predict the multiple class attacks in EVSE infrastructure. Additionally, the paper also proposes the novel scroll chaotic S-box based AES encryption to provide the strong countermeasure against the multiple attacks. The paper further demonstrates the two-tier evaluation methodology of the proposed model using the various performance metrics such as “accuracy, NPCR, UACI, entropy” and so on.
The paper structure is given as follows: Section II deal with related works. The proposed framework is presented in Section III. Performance validation is presented in Section IV. The Section V concludes the research work with its future enhancement.
Related works
To expect the departure time of EVs, O. Frendo et al. [17] constructed regression models. The models were tried utilizing recorded data traversing three years and north of 1 million charging meetings. Strong indicator of flight time included elements like “mean meeting length by client ID, appearance time, and work day”. For takeoff time expectation, the most elevated performing model, XGBoost, acquired a MAE of 82 minutes. The ML models’ forecasts significantly affected planning quality. The constraint of the linear regression method produces the overfitting issue and presence of outliers.
Essentially, to forecast EV user conduct as far as start time and charging span, [18] utilized mean estimate. The creators then, at that point, used the LR model to estimate energy utilization dependent on the length of the vehicle charging time. Albeit the expectations of EV conduct were incorporated into the shrewd charging algorithm to guarantee grid maintenance, the article didn’t survey the prescient models’ adequacy. In [19], SVM was utilized to forecast the entry and leaving period of time of EVs. The dataset incorporates the charging information from sub-urbanites who utilize electric vehicles on the “College of California, San Diego” (UCSD) grounds north of a three-year time span (2012–2014). The transient elements (week, day, and hour) just as previous vehicle entry and leaving times were utilized to prepare the ML model. The normal MAPE was 2.85 percent for appearance time and 3.7.
The creators of [20] utilized diverse ML models to calculate charging time span and power utilization from two charging datasets, including DT, K-NN, and RF. Charging time span from the university campus were remembered for the underlying dataset, which included nonresidential charging cycles. The second bunch of information remembered private charging information from EV drivers for the United Kingdom. Lee et al. [21] utilized collective model like RF, Artificial Neural Networks (ANNs) and Naïve Bayes (NB), to figure assuming that EVs in a non-commercial would be charged the following day. The hours of the day when electric vehicles will be charged the next day are likewise estimated [22–24]. The estimated charging cycling is utilized as the inputs of predictive models [25].
Proposed methodology
Overview of the proposed framework
An overview of proposed ECHO-NETS based IDS with chaotic encrypted countermeasure method is presented in Fig. 1. The first layer of the framework is the data collection unit by simulating the Internet enabled EVSE networks based on MAC addresses which are utilized to collect the packets and original data under both normal and attack scenarios. At the second layer, enhanced GRU network model is adopted for the attack prediction by adopting data cleaning and normalization process. Finally, adoption of the enhanced AES-S-Box on original data once the attack is predicted. The proposed model has been employed to predict the multiple- attacks types. In the attack event, the proposed framework predicts the following a) Whether the EVSE is malicious or normal along with its MAC address b) the attack type occurred in EVSE.

Overall block diagram for proposed ECHO-IDS system.
In this research, data collection unit consists of three important parts as shown in Fig. 2. The first part is creation of Internet Enabled EVSE nodes followed by Attack injection modules and data storage unit.

Screenshot for the data collection unit created using OMNET++5.6 (Client are considered EVSE).
Figure 3 shows the EVSE node creation by utilizing OMNET++with an IoT API. The client-server modes are utilized in which the nodes are connected to the server environment using Message Queuing Transport Telecommunication (MQTT). The software model has been created with the privilege of triggering the nodes with the user-defined inputs such as images, texts and even both. In this research, image data is considered for the inputs to the EVSE nodes.

GRU units and its structure.
Multiple Studies [26–28] have demonstrated that the Internet Enabled EVSE are vulnerable to wide range of attacks which have its own impact on the network and also data. As a result, attack injecting model has developed with the Python API interfaced with EVSE nodes created in OMNET++scenario. Figure 4 shows the attacks induced on the EVSE networks. Additionally, the proposed model also induces the bit changes in the original image bit (pixel) location during the attacks. Table 1 shows the list of attacks injected by Label sequencesthe proposed model.

Complete architecture for the proposed enhanced GRU based attack detection.
Types of attacks injected by the proposed software test bed
Since the OMNET++ is discrete event-based test systems, all inbound and outbound network information are recorded as the occasions and saved as log documents. These log records are then saved in data sets for additional investigations and handling. For an efficient training of the proposed model and to overcome class imbalance problem, nearly 4,800,000 traces of packets are collected under normal and attack scenarios for 60 days. The total number of samples collected are presented in Table 2.
Types of attacks injected by the proposed software test bed
The limitations of the traditional neural networks in term of high classification rate and better feature extraction has been overcome by the usage of deep neural networks(DNN) due to its ability of strong non-linear fitting characteristics. However, these DNN suffers from an inaccurate classification ratio due to the non-consideration of temporal relationship between the training samples. Above drawback can be eradicated by the usage of recurrent neural networks (RNN). Generally, RNN models are specifically designed for time series of data and big data analytics because of its fast remembrance activity. Here the direct graphs are generated by the nodes with their respective sequences. With this statement, this method demonstrates dynamic synchronizations of sequences. For the input sequences process internal memory is utilized. In order to predict the future values, RNN generally uses the past data. But in real time applications, if the transition time between past and future data is relatively large, then this method struggles to remember the past values and creates disappearing gradient issue, so it requires update to support real time applications. In order to countermeasure these issues, the RNN is updated as a LSTM structure.
Since the detection /prediction time plays an important role in designing the IDS, this research uses Gated Recurrent Units (GRUs) [30] which is similar to an LSTM, this structure shown in Fig. 3 and it is used to simplify the LSTM structures and uses as two gates only instead of three gates in LSTM. The mathematical calculations of the GRUs are presented below Equation (1)
These feature are then given as the inputs to the BAT -optimized MLFNN training layers for the classification of multiple attacks in EVSE environment.
Figure depicts the structure of proposed enhanced GRU units in which GRUs are coupled with the bat-optimized multi-layered feedforward neural networks (MLFNN) for better temporal feature extraction and high prediction ratio. In this research, novel bat-optimized hyper parameters are used to achieve the maximum performance in classifying the different attacks in EVSE networks. The MLFNN layers may have many number of training layers and gives better classification ratio. Finally the Bat-Optimized training network is interfaced with softmax layer for further predicting the attacks. Figure 5 presents the complete architecture of the enhanced GRU structure.

Performance evaluation methods adopted in the proposed research.
The standard mega- bat algorithm generally relies on “echolocation or bio-sonar attributes of micro bats”. Based on the echo location, X.-S. Yang et al., [31] built up the algorithm with the accompanying 3 rulesets: Bats always use echolocation to detect the prey in the mystical manner. Bats always has initial frequency (fmin), speed (vi), position xi and loudness A0. These parameters are consequently modified in regards of nearness of prey. Here we can take that loudness is shifts from A0, Amin.
Every bat motion has initial distance, initial velocity of
Where β € (0,1), fmin → frequency with minimum value (0) fmax → frequency with maximum value.
Initially every bats has frequency between fmax and fmin.
To provide promising solutions, emission rates and loudness are calculated consequently. Once the prey is detected by bat the loudness may diminished, but is the pulse emission rate expanded in frequency between Amin and Amax
In this research, this algorithm is used to optimize the weights and biases of the network suitable for classifying the multiple class attacks in EVSE networks. Initially, random no. of weights and biases are passed to the MLFNN layers according to the Equation (4). To achieve the better classification of multi-class attacks, the proposed model accuracy is coined as the Fitness Function (FF). The mathematical Equations (2) and (3) is utilized for each and every iteration to calculate the input bias and weights. The measured weights are then feed to the MLFNN network in which FFs are calculated. If the FF is equal to the threshold, then the iteration stops or will be iterated continuously. The Fig. 4 illustrates the complete architecture of the proposed framework. The working mechanism of bat-optimized MLFNN is presented in Algorithm 1.
Once the attacks are predicted with its specific location, then it acknowledged by proposed IDS then the bits are recycled to chaotic AES S-box. This process is based on the enhanced scroll properties. The proposed framework provides strong light weight encryption keys by significantly integrating the properties of Multi Scroll and henon maps with high randomness selection of initial conditions. The working mechanism of the Multi-Scroll (MS) chaotic maps and enhanced scroll chaotic maps are discussed below
Multi scroll attractors
When compared to mono scroll attractors as mentioned in [32], multi scroll chaotic systems provide more complexity by producing more output. The common chaotic system‘s attributes are represented by Equations (5)–(7)
The below Equations (8)–(10) are obtained by the adding the hyperbolic eqn p1 tan h (x2 + g) with the Equations (5)–(7)
Using the hyperbolic function, single scroll or 2,4 multi scroll attractors are obtained with initial conditions of [0.1, - 0.1, - 0.6], [0.1, - 0.1, - 0.6], [0.1, 0.1, 0.6] with g1 = [-3], g2 = [3], g3 = [-3] respectively. It can delivers 4, 2, Single scroll attractors and the bifurcation diagram. From this it is verified that the system holds “multi scroll property”.
The nonlinearity of cubic function in Equations (8)–(10) can be written as Equations (11)–(13) after applying fractional order to produce multi scroll properties are exhibited by final chaotic framework which are represented as follows:
Henon outlines the three-dimensional map with quadratic function, which does not consist of any linear function. This function and fractal structure produces the strange attractor this maps fits in several mathematical examinations because of its straightforwardness property, 3D Henon maps are mathematically expressed in Equations (14)—(16)
The proposed hybrid framework integrates Multi scroll chaotic (MSC) maps and henon maps in AES for the S generation. In the traditional process of AES, traditional S-box is replaced with the proposed encryption scheme to defend against the different attacks. This process will be started as soon the IDS sends e alarming signal to the particular EVSE. The main steps involved to have enhanced chaotic-S-boxes are as follows
Step 1: giving plain image as an input and performing gray scale conversion with the size of MxN.
Step 2: with the help of Equations (11)–(13), generating S1 box using MSA
Step 3: with the help of Equations (14)–(16), generating S2 box using 3D Henon Map
Step 4: obtain K=(g1,g2,g3, . . . . . . . . . . . . . . . gQ) called intermediate cipher text, the input image arrays with first S1 box in the first tier operation and it represented by the following Equations (17) and (18)
Where inter_byte(S1,X(i)) → “substitution bytes by S1 box for X”.
In this framework, highly secured intermediate sequences are generated by integrating cross permutation and diffusion process, then encryption process done among S1-Box with 3D MSA and plain picture bytes X.
Step 5: obtain O={f1,f2,f3 . . . . . . . . . ..fl} known as final encrypted image by utilizing I with 2nd S2 box to perform the second tier operation and it is represented by the following Equations (18) and (19)
inter_byte(S2,K(i)) → “the substitution bytes by S2 box for K”, again the step 4 is followed to obtain high chaotic encrypted data. These encoded bits are utilized for the transmission however the attack is available in the network.
Evaluation mechanism
The evaluation of the proposed model is carried out into two parts as shown in Fig. 5
Evaluation mechanism
In the first phase of evaluation, the proposed model performance has been validated using the performance metrics mentioned in Table 3.
Performance metrics used for evaluating the proposed model
Performance metrics used for evaluating the proposed model
“TP is True Positive measurement, TN is True Negative measurement, FP is False Positive and FN is false negative measurement”
The experimental parameters used for training the proposed network is depicted in Table 4. Along with the performance metrics AUC (Area under ROC) and confusion matrix has been calculated for an effective prediction of the different attacks. Higher scores of the metrics indicates the better performances. Five -cross validation process is implemented to validate the performance of the model under different attack scenario. The complete model was developed using opensource TensorFlow vsion 2.1.0 with keras as backend and implemented on a PC workstation with Intel Xeon CPU, NVIDIA Titan GPU,16GB RAM and 3.5 GHZ operating frequency.
Experimental parameters used for training the model
The Table 5 presents the Research parameters of the proposed framework for the different attack prediction.
Performance metrics of the proposed model in prediction of different attacks
Figures 6 and 7 illustrates the ROC curves and confusion matrix of the proposed model in detecting the multiple attacks. From the ROC and Confusion matrix, it is evident that the proposed model has shown the stable performances to detecting the multiple attacks in EVSE environment.

ROC curves for the proposed algorithm under normal detection.

ROC curves for the proposed algorithm under DoS and DDoS attack.

ROC curves for the proposed algorithm under MIM attacks.

Confusion matrix for the proposed model in detecting the different attacks.
The integration of the user-defined optimized algorithm in GRU has proved its excellence in detecting the multiple attacks. Figures 8–11 show the comparative analysis of the different models in detecting the different attacks. From the Fig. 8, it is clear that proposed model and LSTM based IDs has shown the better results in which the proposed model has shown the slight edge over LSTM whereas the other learning models has shown the lesser performances in detecting DoS attacks, But in Figs. 9 and 10, it is clear that the proposed model has outperformed the other existing models in predicting the other attacks. Figure 11 shows that the integration of the optimization in GRU has consumed less time in detecting the multiple attacks in EVSE environment.

Comparative analysis of the different IDS in detecting the DoS attacks.

Comparative analysis of the different IDS in detecting the DDoS attacks.

Comparative analysis of the different IDS in detecting the MIM attacks.

Average detection time for the different models in detecting the different attacks in EVSE environment.
From the above evaluation, it is clear that the proposed model has shown its excellence in detecting the multiple attacks in EVSE environment over the other existing learning model.
In this section, the AES based Scroll Chaotic Key generation is evaluated and analyzed using the performance metrics such as NPCR, UACI, Entropy and also with NIST randomness parameters.
For this evaluation, we have used the standard image datasets such as Lena, Baboon, Vegetable and cameraman images. This chaotic maps are enabled once the proposed IDS sends the acknowledgement to the EVSE which runs the proposed Chaotic AES key generation maps. Table 6 shows the encrypted images after adding the scroll chaotic maps along with AES.
Input images along with encrypted outputs
Input images along with encrypted outputs
Table 6 shows the input images with their encrypted images obtained after the system predicts the any attacks. The general colored LENA image, Baboon Images, Vegetable image and cameraman image with different image formats were used to test the proposed encryption system.
From the table it is evident, that the encrypted images are scrambled in random manner for defending the EVSE attacks.
To prove excellence of the proposed framework, the cipher key sensitivity should be very high against different attacks. For the key sensitivity measurement, the NPCR (National Pixel Change per Unit) and UACI (National Pixel Change per Unit) values are measure to analyze the encryption performance of the proposed framework using the following Equations (20), (21) and depicted in the Table 7
Table 7. Shows the NPCR and UACI parameters for the various encrypted image data used in the process. The qualities figured by the NPCR and UACI tests separately affirms that the proposed calculation can unequivocally shield against any EVSE assaults, since, change that happened subsequent to consolidating the scrambled picture in the first picture is tiny.
PCR and UACI value comparison for various image data set using proposed AES S-Box
In the wake of examining the NPCR and UACI, entropy tests are led to evaluate whether pictures encoded utilizing the proposed model can oppose the any sort of assaults adequately. Entropy is a factual trial of arbitrariness regularly used to describe the picture in textural terms and esteem should be near ideal worth of 8. The entropy are determined utilizing the numerical Equation (23)
Where 1 → the gray value q (m) → gray value probability in image matrix.
In this research framework, bit length taken in 256 for 8-bit gray image. The diverse entropy acquired for the various picture’s sets are arranged in Table 8.
Entropy value comparison for various image dataset
In this research, NIST (National Institute of Standards and technology is utilized to analyze the randomness of the encrypted bits. The different tests were conducted to ensure that the generated encryption bits exhibits the high randomness so that it can defend against the attacks.Table 9. Shows the NIST tests of the proposed encryption schemes,
Input images along with encrypted outputs
Input images along with encrypted outputs
From the above Table 9, it is clear that the proposed encryption has exhibited the high randomness from which it can provide the high resistance to different category of attacks.
This paper introduced a novel attack prediction methodology by incorporating the new encryption scheme in EVSE networks. It is first of its kind which integrates both detection and countermeasure mechanism. First, the data set collection unit has been created for catching the understanding impacts of various attacks on the EVSE networks utilizing OMNET++5.6 and Python API has been created to infuse the various attacks. Besides, Enhanced GRU network has been utilized for the location of the various kinds of attacks. At last fostered the hybrid combination of novel MSA and henon maps based S-boxes to get excellent performance in terms of encryption process. The proposed S-Box framework gives outstanding results when it integrates permutation and diffusion process. The broad experimentation has been completed and two-level assessment system is embraced to demonstrate the greatness of proposed structure in EVSE networks. Results showed that the proposed model has displayed the better exhibition than existing models as far as accuracy, detection time, randomness and high sensitivity.
With respect to the examination for expectation of assaults and encryption process, more over these calculations needs its extemporization in carrying out in the installed chip region for self-recognition and choice of attacks which are demonstrating more imperative in the present web situation.
