# adt-kmr/detecting-ev-charger-cyberattacks-using-only-power-consumption-telemetry architecture

> Architecture diagram of the GitHub repository adt-kmr/detecting-ev-charger-cyberattacks-using-only-power-consumption-telemetry, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-06-25). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/adt-kmr/detecting-ev-charger-cyberattacks-using-only-power-consumption-telemetry
- Repository: https://github.com/adt-kmr/detecting-ev-charger-cyberattacks-using-only-power-consumption-telemetry

## Overview

This repository is a notebook-centric research workspace for detecting EV charger cyberattacks from power-consumption telemetry. The architecture is not a deployed application; it is an experiment-and-analysis environment built around Jupyter notebooks.

The repository has only four top-level artifacts:
- `README.md` as the project label,
- `method1.ipynb` and `method2.ipynb` as the two main experiment tracks,
- `errored.ipynb` as a failed or debugging notebook that likely captures an interrupted or broken workflow.

The primary boundary in the repo is between the notebooks and their external data/runtime dependencies. All substantive logic appears to live inside notebooks rather than in reusable packages, services, or scripts. That means the “system” is organized by experiment, not by application layer.

At a high level, the data flow is: power-consumption telemetry is loaded into a notebook, cleaned or transformed, used to train or evaluate detection logic, and then results are inspected in notebook outputs. The architecture likely centers on time-series analysis and classification/anomaly-detection style processing, since the goal is attack detection from telemetry only.

`method1.ipynb` and `method2.ipynb` are the two main branches of the analytical pipeline. They likely represent alternate detection strategies, feature sets, or modeling approaches. In diagram terms, these should be shown as parallel experimental paths rather than sequential production components.

`errored.ipynb` is important as a troubleshooting branch. It suggests an iterative workflow where exploratory code was executed interactively, and at least one notebook captured a failed attempt or a crash state. This indicates manual experimentation and ad hoc debugging are part of the repo’s workflow.

There is no evidence of a backend service, API, UI, database, or message broker in the repository tree. So the correct architecture diagram should not include deployment tiers or networked components unless they exist outside this repo. The execution environment is simply Jupyter + Python runtime.

Because the repo is notebook-based, dependencies and state are likely implicit: imported libraries, local datasets, and notebook cell order matter. This creates a loose coupling between experiments and a tight coupling to the notebook execution context. Reproducibility likely depends on rerunning cells in order with the same data and environment.

The external input of architectural significance is the telemetry dataset itself, probably recorded from EV charging equipment during normal and attack conditions. The primary output is not a service response but analytical results such as detection scores, plots, metrics, or model comparisons captured in notebook output cells.

For an architecture diagram, the cleanest representation is:
- external telemetry data source,
- notebook-based preprocessing/analysis,
- two parallel detection-method notebooks,
- evaluation/output artifacts,
- and a separate failed-experiment/debug notebook.

Overall, this is a research prototype repo with minimal structural separation. The meaningful architecture lies in the experimental workflow and the comparison of alternative detection methods, not in software components or infrastructure.

Main entry points: [`method1.ipynb`](https://github.com/adt-kmr/detecting-ev-charger-cyberattacks-using-only-power-consumption-telemetry/blob/main/method1.ipynb) (Method 1), [`method2.ipynb`](https://github.com/adt-kmr/detecting-ev-charger-cyberattacks-using-only-power-consumption-telemetry/blob/main/method2.ipynb) (Method 2), [`README.md`](https://github.com/adt-kmr/detecting-ev-charger-cyberattacks-using-only-power-consumption-telemetry/blob/main/README.md) (README), [`errored.ipynb`](https://github.com/adt-kmr/detecting-ev-charger-cyberattacks-using-only-power-consumption-telemetry/blob/main/errored.ipynb) (Errored)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_repo["Repository"]
  node_readme["README<br/>project doc<br/>[README.md]"]
  node_prep["Preprocess<br/>data cleaning"]
  node_features["Features<br/>feature engineering"]
  node_detect{{"Detection logic<br/>analysis pipeline"}}
  node_eval["Evaluation<br/>metrics and plots"]
  node_compare["Method compare<br/>analysis comparison"]
  node_debug["Debugging<br/>failure analysis"]
end

subgraph group_notebooks["Notebooks"]
  node_method1["Method 1<br/>experiment notebook<br/>[method1.ipynb]"]
  node_method2["Method 2<br/>experiment notebook<br/>[method2.ipynb]"]
  node_errored["Errored<br/>debug notebook<br/>[errored.ipynb]"]
end

subgraph group_external["External inputs"]
  node_telemetry[("Telemetry data<br/>external dataset")]
  node_runtime(("Jupyter runtime<br/>execution environment"))
end

node_readme -->|"points to"| node_method1
node_readme -->|"points to"| node_method2
node_method1 -->|"loads"| node_telemetry
node_method2 -->|"loads"| node_telemetry
node_method1 -->|"runs in"| node_runtime
node_method2 -->|"runs in"| node_runtime
node_errored -->|"runs in"| node_runtime
node_method1 -->|"processes"| node_prep
node_method2 -->|"processes"| node_prep
node_prep -->|"feeds"| node_features
node_features -->|"feeds"| node_detect
node_detect -->|"produces"| node_eval
node_method1 -->|"contributes to"| node_compare
node_method2 -->|"contributes to"| node_compare
node_errored -->|"supports"| node_debug
node_compare -->|"summarizes"| node_eval

click node_readme "https://github.com/adt-kmr/detecting-ev-charger-cyberattacks-using-only-power-consumption-telemetry/blob/main/README.md"
click node_method1 "https://github.com/adt-kmr/detecting-ev-charger-cyberattacks-using-only-power-consumption-telemetry/blob/main/method1.ipynb"
click node_method2 "https://github.com/adt-kmr/detecting-ev-charger-cyberattacks-using-only-power-consumption-telemetry/blob/main/method2.ipynb"
click node_errored "https://github.com/adt-kmr/detecting-ev-charger-cyberattacks-using-only-power-consumption-telemetry/blob/main/errored.ipynb"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_readme,node_prep,node_features,node_detect,node_eval,node_compare,node_debug toneBlue
class node_method1,node_method2,node_errored toneAmber
class node_telemetry,node_runtime toneMint
```

## Components

### Repository

Notebook-centric research workspace

- [README](https://github.com/adt-kmr/detecting-ev-charger-cyberattacks-using-only-power-consumption-telemetry/blob/main/README.md): project doc · Project overview and entry point · `README.md`
- **Preprocess**: data cleaning · Load, clean, and transform telemetry
- **Features**: feature engineering · Derive time-series inputs for detection
- **Detection logic**: analysis pipeline · Attack identification or anomaly scoring
- **Evaluation**: metrics and plots · Compare results and inspect notebook outputs
- **Method compare**: analysis comparison · Parallel comparison of alternative approaches
- **Debugging**: failure analysis · Investigate interrupted or broken execution

### Notebooks

Interactive experiment tracks

- [Method 1](https://github.com/adt-kmr/detecting-ev-charger-cyberattacks-using-only-power-consumption-telemetry/blob/main/method1.ipynb): experiment notebook · First attack-detection workflow · `method1.ipynb`
- [Method 2](https://github.com/adt-kmr/detecting-ev-charger-cyberattacks-using-only-power-consumption-telemetry/blob/main/method2.ipynb): experiment notebook · Alternative attack-detection workflow · `method2.ipynb`
- [Errored](https://github.com/adt-kmr/detecting-ev-charger-cyberattacks-using-only-power-consumption-telemetry/blob/main/errored.ipynb): debug notebook · Failed or interrupted exploratory run · `errored.ipynb`

### External inputs

Data and runtime dependencies

- **Telemetry data**: external dataset · Power-consumption traces from EV charging
- **Jupyter runtime**: execution environment · Notebook kernel, Python libraries, and cell order

## Connections

- README → Method 1: points to · Documents the main experiment track
- README → Method 2: points to · Documents the alternate experiment track
- Method 1 → Telemetry data: loads · Consumes power-consumption traces
- Method 2 → Telemetry data: loads · Consumes power-consumption traces
- Method 1 → Jupyter runtime: runs in · Depends on notebook execution context
- Method 2 → Jupyter runtime: runs in · Depends on notebook execution context
- Errored → Jupyter runtime: runs in · Failed execution occurred in notebook context
- Method 1 → Preprocess: processes · Cleans and transforms telemetry
- Method 2 → Preprocess: processes · Cleans and transforms telemetry
- Preprocess → Features: feeds · Produces model-ready time-series features
- Features → Detection logic: feeds · Supplies inputs to detection logic
- Detection logic → Evaluation: produces · Generates scores, plots, and metrics
- Method 1 → Method compare: contributes to · One branch of the comparative study
- Method 2 → Method compare: contributes to · One branch of the comparative study
- Errored → Debugging: supports · Captures troubleshooting context
- Method compare → Evaluation: summarizes · Comparison is reflected in notebook outputs