With the rapid adoption of electric vehicles (EVs), transportation and power systems are increasingly closely interconnected, driving innovation but also introducing new vulnerabilities. Researchers at The Hong Kong Polytechnic University (PolyU) have uncovered a novel cross-domain cyberattack whereby, rather than breaching a heavily guarded power communication network, an attacker need only manipulate EV charging navigation systems to redirect large numbers of vehicles to the same charging station, concentrating demand in a short period of time and potentially triggering local power outages or degrading grid reliability.
Most cyberattacks on power systems must break into the grid's secure, dedicated communication networks, which is difficult and costly. By contrast, the driver-facing charging navigation systems are far less well-protected, making them a more accessible entry point for attackers. The research reveals that such an attack can originate outside the distribution network and propagate through EV charging behaviour until it threatens the grid's secure operation.
Led by Prof. BU Siqi, Associate Head (Research) and Professor of the PolyU Department of Electrical and Electronic Engineering, the study examines risks arising from the deep integration of cyber-physical transportation systems (CPTSs) and cyber-physical power systems (CPPSs). CPTSs integrate communication networks into transportation systems for traffic monitoring, routing, and mobility management, while CPPSs incorporate them into power systems to ensure reliable monitoring, protection, and control of generation, transmission, and distribution. Their integration, while innovative, also creates potential vulnerabilities that attackers can exploit.
The research team demonstrated that by executing sparse vector attacks on charging prices and traffic flow data — that is, injecting a small number of carefully chosen false data points to mislead the system's decisions — attackers can exploit vulnerabilities and expose increasingly interconnected infrastructure to new risk.
Prof. Bu said, "This research highlights how a cyberattack originating in one system can spread to another. By demonstrating the destructive potential of cross-domain attacks, we aim to raise public awareness and encourage stronger preventive measures."
Because such cyberattacks are highly destructive, their impact on CPPSs can have serious consequences. Beyond clarifying how these attacks occur and the harm they may cause, the study proposes concrete defensive measures, including enhanced monitoring for abnormal price and traffic signals, stronger protection of communication links, and earlier detection of unusual recommendation patterns in EV charging navigation systems.
The research has been published in IEEE Transactions on Transportation Electrification. Beyond identifying a potential cross-domain cyberattack method and the associated risks, the study offers valuable insights for enhancing the resilience of integrated power and transportation systems.
Prof. Bu added, "As EVs become more popular, the connection between transportation and power systems will only grow closer, making cybersecurity increasingly vital. Our research contributes to a safer charging environment, enabling more secure charging services and system integration, and supporting the adoption of EVs in Hong Kong, the Chinese Mainland and the world."
Prof. Bu's research focuses on power system stability, operation and economics, with an emphasis on renewable energy integration, smart grid application and transport electrification. His team also explores dynamic security risk assessment of new renewable-rich power systems and the coordination of power and transport systems for more secure, reliable and resilient operations. Recently, his research team began close collaboration with Tianjin University, China Southern Power Grid and CLP Power under the NSFC/RGC Joint Research Scheme project "Cyber-physical Coordinated Control and Defense Methods for Grid-forming Distributed Energy Resource Clusters in Greater Bay Area Megacities". The outcomes of this project are expected to help address consumer concerns over voltage dips and other power quality issues, while enhancing the secure and resilient operation of urban cyber-physical power grids in Hong Kong, the Greater Bay Area and beyond.
