In this paper, cyber-attack prevention for the prosumer-based electric vehicle (EV) charging stations (EVCSs) is investigated, which covers two aspects: 1) cyber-attack detection on prosumers' network traffic (NT) data, and 2) cyber-attack intervention. To establish an effective prevention mechanism, several challenges need to be tackled, for instance, the NT data per prosumer may be non-independent and identically distributed (non-IID), and the boundary between benign and malicious traffic becomes blurred. To this end, we propose an edge-assisted federated prototype knowledge distillation (E-FPKD) approach, where each client is deployed on a dedicated local edge server (DLES) and can report its availability for joining the federated learning (FL) process. Prior to the E-FPKD approach, to enhance accuracy, the Pearson Correlation Coefficient is adopted for feature selection. Regarding the proposed E-FPKD approach, we integrate the knowledge distillation and prototype aggregation technique into FL to deal with the non-IID challenge. To address the boundary issue, instead of directly calculating the distance between benign and malicious traffic, we consider maximizing the overall detection correctness of all prosumers (ODC), which can mitigate the computational cost compared with the former way. After detection, a rule-based method will be triggered at each DLES for cyber-attack intervention. Experimental analysis demonstrates that the proposed E-FPKD can achieve the largest ODC on NSL-KDD, UNSW-NB15, and IoTID20 datasets in both binary and multi-class classification, compared with baselines. For instance, the ODC for IoTID20 obtained via the proposed method is separately 0.3782% and 4.4471% greater than FedProto and FedAU in multi-class classification.

翻译：本文研究了面向产消者电动汽车充电站的网络攻击防御问题，涵盖两个方面：1）针对产消者网络流量数据的网络攻击检测；2）网络攻击干预。为建立有效的防御机制，需解决若干挑战，例如每个产消者的网络流量数据可能呈现非独立同分布特性，且正常流量与恶意流量之间的边界趋于模糊。为此，我们提出一种边缘辅助的联邦原型知识蒸馏方法，其中每个客户端部署于专用本地边缘服务器，并可上报其参与联邦学习过程的可用性。在实施该方法前，为提升准确性，我们采用皮尔逊相关系数进行特征选择。在所提出的方法中，我们将知识蒸馏与原型聚合技术整合至联邦学习框架以应对非独立同分布挑战。针对边界模糊问题，我们通过最大化所有产消者的整体检测正确率来替代直接计算正常与恶意流量间距离，相比前者可有效降低计算成本。检测完成后，各专用本地边缘服务器将触发基于规则的网络攻击干预机制。实验分析表明，在NSL-KDD、UNSW-NB15和IoTID20数据集上，所提方法在二分类与多分类任务中均能取得优于基线模型的整体检测正确率。例如在多分类场景下，本方法在IoTID20数据集上获得的整体检测正确率分别较FedProto和FedAU提升0.3782%和4.4471%。