EVSOAR: Security Orchestration, Automation and Response via EV Charging Stations

TL;DR

EVSOAR tackles automotive cybersecurity under resource-constrained vehicles by offloading security orchestration and analysis to the EV charging station network (CSN) as an edge computing platform. The approach combines a three-layer architecture (Vehicle SOAR Agent, Edge-SOAR, Central SOAR) with both traditional ML IDS and Federated Learning IDS, plus automated responses to threats, enabling cross-vendor threat intelligence sharing. Evaluations show significant latency and throughput benefits of wired EV-CSN connectivity over wireless alternatives, and a privacy-aware trade-off where Federated Learning maintains data privacy while achieving competitive accuracy. The work demonstrates practical improvements in real-time security operations for EV ecosystems and argues for scalable, collaborative defense via edge-enabled VSOCs and OTA patching.

Abstract

Vehicle cybersecurity has emerged as a critical concern, driven by the innovation in the automotive industry, e.g., automomous, electric, or connnected vehicles. Current efforts to address these challenges are constrained by the limited computational resources of vehicles and the reliance on connected infrastructures. This motivated the foundation of Vehicle Security Operations Centers (VSOCs) that extend IT-based Security Operations Centers (SOCs) to cover the entire automotive ecosystem, both the in-vehicle and off-vehicle scopes. Security Orchestration, Automation, and Response (SOAR) tools are considered key for impelementing an effective cybersecurity solution. However, existing state-of-the-art solutions depend on infrastructure networks such as 4G, 5G, and WiFi, which often face scalability and congestion issues. To address these limitations, we propose a novel SOAR architecture EVSOAR that leverages the EV charging stations for connectivity and computing to enhance vehicle cybersecurity. Our EV-specific SOAR architecture enables real-time analysis and automated responses to cybersecurity threats closer to the EV, reducing the cellular latency, bandwidth, and interference limitations. Our experimental results demonstrate a significant improvement in latency, stability, and scalability through the infrastructure and the capacity to deploy computationally intensive applications, that are otherwise infeasible within the resource constraints of individual vehicles.

Figures (5)

• Figure 1: SOAR architecture
• Figure 2: SOAR flowchart
• Figure 3: Median Client RTT.
• Figure 4: Throughput for Client
• Figure 5: Network stability