V2G Anomaly Detection with a Transformer and Explainable AI

A transformer-based intrusion detection system for Vehicle-to-Grid (V2G) charging infrastructure, with SHAP explanations and classical baselines.

The model performs 5-class classification of cyberattacks against EV chargers on the CICEVSE2024 dataset. It fuses two modalities: network traffic and host events.

Course project for CSC461 at the Lebanese American University.

Authors: Ali Zaghlan El Hajjar, Sami Bou Khaled Instructor: Dr. Nadine Abbas

What the project covers

• Preprocessing — cleaning, scaling, and alignment of the network and host feature sets into a single fused representation.
• Model — a transformer classifier over the fused tokens, trained in PyTorch on a CUDA GPU.
• Baselines — RandomForest, SVC, and MLP from scikit-learn, for comparison.
• Explainability — SHAP attributions and exported attention maps.
• Ablation — deterministic host-masked and net-masked inference, to measure how much each modality contributes.

Notebooks

The workflow is notebook-first. The notebooks are the source of truth; the scripts under app/ are support utilities.

Notebook	Role
V2G_preprocessing.ipynb	Source of truth for preprocessing artifacts
V2G_token_fusion.ipynb	Fusion of the network and host modalities
V2G_training.ipynb	Source of truth for training and evaluation
V2G_xai_ablation.ipynb	SHAP, attention plots, and ablation results
V2G_ML (1).ipynb	Early exploration

The notebooks are Google Colab compatible.

Stack

Python 3.10+, PyTorch, scikit-learn, SHAP, pandas, numpy, matplotlib, seaborn.

python -m venv .venv && source .venv/bin/activate
pip install -r requirements.txt
python -c "import torch; print(torch.cuda.is_available())"   # GPU check

Repository contents

Path	Contents
DataSet/	CICEVSE2024 inputs and dataset notes
baseline/	Classical baseline runs
app/	Generated artifacts and support utilities
full results/, xai result/	Evaluation output and SHAP figures
Project Docs/	Report (main.tex, main.pdf), proposal, analyses, change log
Research Papers/, sources/	Prior work

Project Docs/implementation_change_log.md records every change to a notebook or script, for report traceability.

Dataset

CICEVSE2024, from the Canadian Institute for Cybersecurity. The dataset is not redistributed here. Get it from the institute directly.