PFAD-BC: privacy-preserving federated anomaly detection across multi-operator EV charging consortia via a blockchain-anchored framework
Abstract
The rapid build-out of electric-vehicle (EV) charging infrastructure has created a protocol-rich cyber-physical attack surface that spans many independently operated charging networks. Anomaly detection across such networks is most effective when operators pool experience, yet session-level charging telemetry is commercially sensitive, privacy-regulated, and non-IID, so it cannot be centralized. Federated learning (FL) removes the need to share raw data, but plain FL leaks information through shared updates, is fragile under poisoning by malicious participants, and provides no verifiable accountability among mutually distrustful operators. We present PFAD-BC, a privacy-preserving, Byzantine-resilient, and blockchain-anchored federated anomaly-detection framework tailored to multi-operator Charge Point Operator (CPO) consortia. PFAD-BC couples an Open Charge Point Protocol (OCPP)-aware feature pipeline and an LSTM-autoencoder local detector with differentially private training under Rényi-DP accounting, a reputation-weighted cosine-similarity aggregation rule that tolerates up to f<K/3\documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$f < K/3$$\end{document} Byzantine operators, and three permissioned-ledger contracts that record update commitments, enforce declared per-operator privacy-cap admission, register aggregation attestations, and maintain reputation state. Across two datasets—ACN-Data and the labeled-attack CICEVSE2024 benchmark—and nine baselines, PFAD-BC attains F1 = 0.736 at ϵ=1.0\documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$\epsilon = 1.0$$\end{document} on ACN-Data (within 0.006 of the non-private centralized ceiling) and F1 = 0.896 on CICEVSE2024, leading every privacy-protected baseline. It sustains F1 ≥\documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$\ge $$\end{document} 0.68 under sign-flip, Fang, and LIE attacks at a 40% adversarial ratio—where FedAvg collapses below 0.36—and reduces the membership-inference advantage from 0.562 to 0.184. Removing differential privacy improves F1 by only 0.023, quantifying a modest and explicit privacy–utility cost. The results indicate that privacy, robustness, and auditability can be combined in a single auditable prototype framework with only a small loss of detection quality relative to a non-private centralized model.