Energy Theft Attacks On An Hybrid Charging Station

# Energy Theft Attacks On an Hybrid Charging Station This repository contains an extended dataset described in the conference paper, called "Detecting Energy Theft Attacks On A Off-Grid Station". The primary goal of this dataset is to provide researchers working with attack detection methods with a real, measured attacked dataset to test the detection and classification algorithms. ## Description This dataset contains power measurements collected in the testbed called the "Smart Room." The measurements represent the 72-day experiment of emulating an off-grid charging station for electric bikes under energy theft attacks. The dataset is presented in two sets. **1)** The one included in the folder 'Raw_dataset' represents real measurements collected by the monitoring system of the Testbed. Each folder contains .csv files with a timestamp and a value for a recorded measurement, which are: - batteryChargeCurrent [A], the recorded current in amperes which is charging the batteries installed in the Smart Room, using excess energy generated by the PV panel; - batteryChargeState [%], the state of charge of batteries in the Smart Room, used for charging the bikes when PV production is not enough; - batteryDischargeCurrent [A], the current in amperes which corresponds to the utilization of the batteries to charge the bikes when the PV production is not sufficient; - batteryVoltage [V], the voltage of the batteries in volts; - gridPower [W], the power consumed by the grid in watts, used for the auxiliary equipment installed in the Smart Room and not directly related to the experiment (sensors, PCs, Raspberry Pis, etc.). The negative value corresponds to the case where the excess power is being sent to the public grid. - PVpower [W], the power produced in watts by the photovoltaic panel on the roof of the building; - VariableChargePower [W], the power consumed by the electric programmable load, which in the case of the first week is a combination of charging profiles of 1-3 bikes; - VariableChargePower [W], the power consumed by the electric programmable load representing a combination of charging profiles of 1-3 bikes and possibly corrupted by the FDI attack, subtracting the additional increase (4th bike); - mode [1-4], the Inverter setting, which defines the power distribution in the grid; - attack status [0/1], defines the time instant where the attack was active (1) or not (0); - PVpower_wifi [W], provides the additional, more frequent measurements (every 3-5 seconds), intending to reduce the impact of the disturbances on the overall energy balance equation. **2)** The second set of data in the folder 'Processed_dataset' uses the transformed raw dataset and presents it in a complete format for the attack detection methods to be readily applied. The transformation includes: - Fixed timestep. The data collection principle of the testbed is set up in a way that every ~60 seconds, the measurement is collected, and it is recorded only in the case where the value is different from the previously recorded one. In order to make the data more representative, the data was extended, filling the gaps between the measurements, to have a fixed timestep of exactly 60 seconds. - Variable transformation. The data collected in a raw dataset was simplified to obtain 4 main sets of readings in watts: **Pload** (VariableChargePower), **Pbatt** (batteryVoltage*(batteryDischargeCurrent-batteryDischargeCurrent)), **Ppv** (PVpower), **Pgrid** (gridPower), **SoC** (batteryChargeState), **mode** (mode), as well as a new variable which represents the consumption-production balance error **Pe** (VariableChargePower-PVpower-batteryVoltage*(batteryDischargeCurrent-batteryDischargeCurrent)-0.9*gridPower) - The label variable called 'Attack' is added to indicate at which instances of time the programmable load consumption profile was altered (corresponding to '1'), and when it was not (corresponding to '0'). - The timestamp converted to 'Time', indicating time, day, and year of every measurement. Finally, the completed dataset includes a .csv file 'Full_dataset.csv', which corresponds to all data collected during the experiments. Full description of the experiment as well as an example of a detection method can be found in the paper presented for ACM EnergySP '25 ACM SIGEnergy Workshop on Cybersecurity and Privacy of Energy Systems and published as a part of the proceedings of ACM eEnergy '25 in ACM digital library. ## Support For any questions related to the dataset as well as to the paper, the reader is welcome to contact the author by e-mail [e-mail] or [e-mail]. ## Contributing The data is in open access, all contributions are welcome. For reference, please cite the paper "Detecting Energy Theft Attacks On A Off-Grid Station". ## Authors and acknowledgment This dataset collection was funded and supported by Direction Générale de l’Armement through CREACH LABS under the project CAMTAR, with the help and under supervision of Jean-François Lalande ([e-mail]) and Romain Bourdais ([e-mail]).# 混合充电站能源盗窃攻击数据集 本仓库包含发表于会议论文《离网充电站能源盗窃攻击检测（Detecting Energy Theft Attacks On An Off-Grid Station）》的扩展数据集。本数据集的核心目标是为从事攻击检测方法研究的人员提供一套真实的实测受攻击数据集，用于测试检测与分类算法。 ## 数据集说明 本数据集包含采集自名为“智能实验室（Smart Room）”的测试床的电力测量数据。这些数据源自一项为期72天的实验，该实验模拟了电动自行车离网充电站在遭受能源盗窃攻击时的运行状态。 本数据集分为两个子集： ### 1. 原始数据集（Raw_dataset）文件夹 该文件夹包含测试床监控系统采集的真实测量数据。每个子文件夹内均为.csv格式文件，存储了带时间戳的测量值，具体包括： - 电池充电电流 [A]：记录的蓄电池充电电流（单位：安培），该电流利用光伏面板产生的富余电力为智能实验室中的蓄电池充电； - 电池充电状态 [%]：智能实验室中蓄电池的荷电状态，用于在光伏发电量不足时为电动自行车充电； - 电池放电电流 [A]：光伏发电量不足时，蓄电池为电动自行车充电时的放电电流（单位：安培）； - 电池电压 [V]：蓄电池的电压（单位：伏特）； - 电网功率 [W]：智能实验室中辅助设备（传感器、个人电脑、树莓派等，与实验无直接关联）消耗的电网功率（单位：瓦特）；若数值为负，则表示富余电力被送入公共电网； - 光伏功率 [W]：建筑屋顶光伏面板产生的电力（单位：瓦特）； - 可变充电功率 [W]：电动可编程负载消耗的功率，实验第一周该负载对应1-3辆电动自行车的充电功率组合； - 可变充电功率 [W]：电动可编程负载消耗的功率，对应1-3辆电动自行车的充电功率组合，且可能遭到虚假数据注入攻击（False Data Injection, FDI）篡改，此时需扣除第4辆自行车带来的额外功率增量； - 运行模式 [1-4]：逆变器设置参数，用于定义电网中的功率分配方式； - 攻击状态 [0/1]：标识攻击是否处于激活状态，1表示激活，0表示未激活； - WiFi光伏功率 [W]：额外的高频测量数据（采集间隔为3-5秒），用于降低整体能量平衡方程受扰动的影响。 ### 2. 处理后数据集（Processed_dataset）文件夹 该数据集基于原始数据集转换得到，采用标准化格式以便直接应用于攻击检测方法。转换过程包括： 1. 固定时间步长：测试床原数据采集机制为每约60秒采集一次数据，且仅在测量值与前一次记录值不同时才进行存储。为提升数据可用性，我们对数据进行补全扩展，将时间步长统一修正为精确的60秒。 2. 变量转换：对原始数据集的采集变量进行简化，得到4类核心功率读数（单位：瓦特）： - `Pload`（对应VariableChargePower）：可编程负载功率； - `Pbatt`（表达式为`batteryVoltage*(batteryDischargeCurrent - batteryDischargeCurrent)`）； - `Ppv`（对应PVpower）； - `Pgrid`（对应gridPower）； - `SoC`（对应batteryChargeState，即电池荷电状态）； - `mode`（运行模式）； 此外新增了代表能耗-产能平衡误差的变量`Pe`，其表达式为：`Pe = VariableChargePower - PVpower - batteryVoltage*(batteryDischargeCurrent - batteryDischargeCurrent) - 0.9*gridPower`。 3. 新增标签变量：名为`Attack`的标签变量，用于标识可编程负载充电功率曲线被篡改的时刻（标记为1），以及未被篡改的时刻（标记为0）。 4. 时间戳转换：将原时间戳转换为`Time`字段，用于标注每条测量数据的具体时间、日期与年份。 最终，完整的处理后数据集包含一个名为`Full_dataset.csv`的.csv文件，涵盖实验期间采集的全部数据。 本实验的完整说明以及一种检测方法的示例，可参阅发表于ACM SIGEnergy 2025年能源系统网络安全与隐私研讨会（ACM EnergySP '25），并收录于ACM eEnergy 2025会议论文集、可通过ACM数字图书馆获取的论文。 ## 技术支持 若对本数据集或论文有任何疑问，可通过邮箱`[e-mail]`或`[e-mail]`联系作者。 ## 贡献说明 本数据集为开源开放资源，欢迎所有贡献。引用时请参考论文《离网充电站能源盗窃攻击检测（Detecting Energy Theft Attacks On An Off-Grid Station）》。 ## 作者与致谢 本数据集的采集工作由法国军备总局（Direction Générale de l’Armement）通过CREACH LABS资助，依托CAMTAR项目开展，并由Jean-François Lalande（`[e-mail]`）与Romain Bourdais（`[e-mail]`）提供指导与协助。