# A Copula-Based Attack Prediction Model for Vehicle-to-Grid Networks
## 5 V2G Network Simulation
### Generation of the Attack Database  
To be able to detect attacks in a network and, more precisely, in the V2G network, it is essential to have an attack database resulting from the collection of information exchanged between network entities. In the absence of this database, it must be generated following several simulations. Thus, the open-source tool called \"MiniV2G\", proposed by [PERSON] et al. [24] and built on Mininet and RiseV2G, allowed us to simulate a V2G environment, taking into account the requirements of the ISO 15118 standard.  
The simulations were carried out on the basis of three different scenarios.  
1. Scenario without attack (Figure 1). In this scenario, the entities used are: a charging station, a switch (s1), a controller (c0), and two electric vehicles. 2. Scenario with a MitM attack (Figure 2). The purpose of the MitM Switch is to intercept traffic leaving the Electric Vehicle Communication Controller (EVCC) and redirect it to the MitM node. The MitM node is able to perform any kind of manipulation before sending the network flow to the Supply Equipment Communication Controller (SECC). 3. Scenario with a DoS-type attack. The architecture of this scenario resembles the one shown in the previous figure above. The MitM entity has been reconfigured and its function is to impede the charging process of the electric vehicle.  
Figure 1: Attack-free simulation architecture.  
Figure 2: Architecture relating to the simulation of the MitM-type attack.  
In each scenario, the interfaces created by each entity in the network are monitored by the Wireshark tool during the process of charging electric vehicles. The charging process was repeated several times in order to collect enough packets. After sorting the interfaces, the data are saved in packet capture (PCAP) format. At the end of these three simulations, three PCAP files are obtained. In order to have the data collected in Comma-Separated Values (CSV) format and distributed according to several variables, the CICFlowMeter tool was used.  
CICFlowMeter is recognized for its ability to generate datasets (database) relating to attacks. It has been used to generate three partial databases (recorded PCAP files have been imported). Each partial database is in CSV file format with columns labeled for each flow, namely: FlowID, SourceIP, DestinationIP, SourcePort, DestinationPort, Protocol, and 78 other network traffic features (or variables).  
After obtaining three partial databases that correspond to the three simulations carried out, the operation of cleaning these databases is the next step. For each partial database, the variables FlowID, SourceIP, DestinationIP, SourcePort, DestinationPort, Protocol, and the variables (or functionalities) whose data are identical for the three CSV files have been deleted. Then, the data in the database were labeled with the variable ATT (abbreviation of the word attack), added in order to differentiate between the data without attack and with attack. Thus, we have the following:  
* In the CSV file corresponding to the data relating to the scenario without attack variable, ATT = 0;
* In the CSV file corresponding to the data relating to the scenario with a MitM attack, ATT = 1;
* In the CSV file corresponding to the data relating to the scenario with a DoS type attack, ATT = 1.  
Finally, after adding the ATT variable, the three partial databases were merged, from which the final database was obtained.