Forensic Analysis of Cyberattacks in Electric Vehicle Charging Systems Using Host-Level Data
Source abstract
Abstract
Electric Vehicle Charging Systems (EVCS) are increasingly vulnerable to cybersecurity threats as they integrate deeply into smart grids and Internet of Things (IoT) environments, raising significant security challenges. Most existing research primarily emphasizes network-level anomaly detection, leaving critical vulnerabilities at the host level underexplored. This study introduces a novel forensic analysis framework leveraging host-level data, including system logs, kernel events, and Hardware Performance Counters (HPC), to detect and analyze sophisticated cyberattacks such as cryptojacking, Denial-of-Service (DoS), and reconnaissance activities targeting EVCS. Using comprehensive forensic analysis and machine learning models, the proposed framework significantly outperforms existing methods, achieving an accuracy of 98.81%. The findings offer insights into distinct behavioral signatures associated with specific cyber threats, enabling improved cybersecurity strategies and actionable recommendations for robust EVCS infrastructure protection.
Source: openalex_inverted_index · Quality: baseline
Research context
OpenAlex topics: Advanced Malware Detection Techniques · Forensic Fingerprint Detection Methods · Forensic and Genetic Research
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
References (55)
Show source-provided references
1. Cybersecurity of smart electric vehicle charging: a power grid perspective10.1109/ACCESS.2020.3041074 ↗
2. Detection of cyber attacks to mitigate their impacts on the manipulated EV charging prices10.1109/TTE.2024.3368920 ↗
3. Securing the electric vehicle charging infrastructure: an in-depth analysis of vulnerabilities and countermeasures
4. Exploring cybersecurity issues in 5G enabled electric vehicle charging station with deep learning10.1049/gtd2.12275 ↗
5. Intrusion detection for electric vehicle charging systems (evcs)10.3390/a16020075 ↗
6. Overview on intrusion detection systems for computers networking security10.3390/computers14030087 ↗
7. Ransomware detection using deep learning in the SCADA system of electric vehicle charging station
8. FL-EVCS: federated learning based anomaly detection for EV charging ecosystem
9. An AutoML-based security defender for industrial control systems10.1016/j.ijcip.2024.100718 ↗
10. Anomaly detection of adversarial cyber attacks on electric vehicle charging stations. e-Prime—Adv Electr Eng Electron Energy
11. Enhancing cybersecurity in onboard charging systems of electric vehicles: a MATLAB-based approach10.30574/wjarr.2024.23.1.2259 ↗
12. Cyber attack detection and classification for integrated on-board electric vehicle chargers subject to stochastic charging coordination10.1016/j.trpro.2023.10.007 ↗
13. Kondu SCV. Machine learning and deep learning-based anomaly detection for electric vehicle charging infrastructure and industrial internet of things [master’s thesis]. Ames, IA, USA: Iowa State University; 2024.
14. Metere R, Neaimeh M, Morisset C, Maple C, Bellekens X, Czekster RM. Securing the electric vehicle charging infrastructure. arXiv:2105.02905. 2021. doi:10.48550/arxiv.2105.02905.
15. Cyber-attack event analysis for EV charging stations
16. Cyber-physical systems forensics
17. Digital forensic analysis of mobile automotive maintenance applications
18. Impact of fast charging station for electric vehicles with grid integration: forensic-based investigation and Archimedes optimization algorithm approach10.1002/oca.3100 ↗
19. Securing electric vehicle charging stations: a critical analysis of authentication vulnerabilities
20. Federated learning for detecting cyber attacks in EVCS using a lightweight neural network
21. Secure electric vehicle charging infrastructure in smart cities: a blockchain-based smart contract approach10.3390/smartcities8010033 ↗
22. Kent K, Chevalier S, Grance T. Guide to integrating forensic techniques into incident. Tech Rep 800-86. 2006 [Internet]. [cited 2025 Jul 14]. Available from: https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-86.pdf.
23. D4I-Digital forensics framework for reviewing and investigating cyber attacks10.1016/j.array.2019.100015 ↗
24. Enhancing EV charging station security using a multi-dimensional dataset: Cicevse2024
25. Data mining: concepts and techniques
26. Scikit-learn: machine learning in Python
27. Kelleher · The massachusetts institute of technology · 2019
28. Worth the Wait? Time window feature optimization for attack classification
29. Time-dependent analysis of attacks
30. Performance analysis of branch prediction unit for pipelined processors
31. The effect of code reordering on branch prediction
32. Detection of message injection attacks onto the can bus using similarities of successive messages-sequence graphs10.1109/TIFS.2021.3098162 ↗
33. Cacheguard: a security-enhanced directory architecture against continuous attacks
34. Adaptive caches as a defense mechanism against cache side-channel attacks
35. Fast, robust and accurate detection of cache-based spectre attack phases
36. Dos attacks on your memory in cloud
37. Didi: mitigating the performance impact of TLB shootdowns using a shared TLB directory
38. InfoShield: a security architecture for protecting information usage in memory
39. An asset-based approach to mitigate zero-day ransomware attacks
40. Detection of privilege escalation for linux cluster security
41. Improving security for time-triggered real-time systems against timing inference based attacks by schedule obfuscation
42. Data correlation-based analysis methods for automatic memory forensic10.1002/sec.1337 ↗
43. Anomaly detection: a survey10.1145/1541880.1541882 ↗
44. A survey of network anomaly detection techniques10.1016/j.jnca.2015.11.016 ↗
45. Heckler · Applied multivariate statistical analysis · 2005
46. Silverman · Density estimation for statistics and data analysis · 201810.1201/9781315140919 ↗
47. Two approaches for novelty detection using random forest10.1016/j.eswa.2014.12.028 ↗
48. SVM-based technique for mobile malware detection
49. Distributed denial of service attack detection using naïve bayes and K-Nearest neighbor for network forensics
50. Malware classification using XGboost-Gradient boosted decision tree10.25046/aj050566 ↗
51. Pan · Journal of Physics: Conference Series · 2020 · 1684
52. Detection of obfuscated Tor traffic based on bidirectional generative adversarial networks and vision transform10.1016/j.cose.2023.103512 ↗
53. Abnormal transactions detection in the ethereum network using semi-supervised generative adversarial networks10.1109/ACCESS.2023.3313630 ↗
54. Detection of cyber attacks in electric vehicle charging systems using a remaining useful life generative adversarial network10.1038/s41598-025-92895-9 ↗
55. Federated deep learning for enhanced prediction of electric vehicle charging station availability10.1007/s10586-025-05152-z ↗