{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,9,22]],"date-time":"2026-09-22T10:01:07Z","timestamp":1790071267851,"version":"4.0.1"},"reference-count":36,"publisher":"MDPI AG","issue":"18","license":[{"start":{"date-parts":[[2026,9,17]],"date-time":"2026-09-17T00:00:00Z","timestamp":1789603200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"DOI":"10.13039\/501100015624","name":"University of Jeddah","doi-asserted-by":"publisher","award":["UJ-25-DR-568"],"award-info":[{"award-number":["UJ-25-DR-568"]}],"id":[{"id":"10.13039\/501100015624","id-type":"DOI","asserted-by":"publisher"}]},{"award":["UJ-25-DR-568"],"award-info":[{"award-number":["UJ-25-DR-568"]}],"id":[{"id":"https:\/\/ror.org\/015ya8798","id-type":"ROR","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Sensors"],"abstract":"<jats:p>Smart electric vehicle (EV) charging infrastructures are evolving into large-scale cyber-physical Internet of Things (IoT) systems that depend on distributed communication, real-time sensing, and spatially coordinated charging operations. However, their interconnected communication architecture exposes charging stations, EV communication links, and network gateways to coordinated distributed denial-of-service (DDoS) attacks. Existing intrusion detection approaches primarily rely on localized or static traffic analysis and therefore have limited capability to capture spatially distributed and temporally evolving attack behavior. This study proposes the Spatio-Temporal Attack Graph Guard Network (STAG-GuardNet), an unmanned aerial vehicle (UAV)-assisted spatio-temporal attack graph learning framework for DDoS detection and security monitoring in smart EV charging networks. The framework integrates spatiotemporal signal conditioning, telemetry-adaptive graph aggregation, temporal dependency learning, attack-memory encoding, and adaptive risk-aware attention to model coordinated cyber-physical attack behavior. UAV-assisted telemetry provides complementary spatial and wireless information on communication instability, signal variation, neighboring congestion, and distributed attack-related behavior. A Hybrid Hawk\u2013Manta Adaptive Optimizer (HHMAO) is employed to improve hyperparameter selection and convergence stability under imbalanced, heterogeneous, and nonstationary traffic conditions. The framework is evaluated using a smart-city EV charging cybersecurity dataset and three benchmark IoT intrusion detection datasets, namely TON_IoT, Edge-IIoTset, and X-IIoTID. Experimental results show that STAG-GuardNet achieves 97.7% accuracy, a 97.7% weighted F1-score, and a 98.4% area under the receiver operating characteristic curve (AUC) on the primary dataset. The framework also maintains stable performance under noisy telemetry, missing observations, heterogeneous traffic distributions, and charging-node outages. These findings demonstrate the potential of STAG-GuardNet for resilient and spatially informed security monitoring in UAV-assisted IoT-enabled EV charging infrastructures.<\/jats:p>","DOI":"10.3390\/s26185898","type":"journal-article","created":{"date-parts":[[2026,9,22]],"date-time":"2026-09-22T09:04:17Z","timestamp":1790067857000},"page":"5898","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["STAG-GuardNet: UAV-Assisted Spatio-Temporal Attack Graph Learning for Secure IoT Communication in Smart EV Charging Networks"],"prefix":"10.3390","volume":"26","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-9815-0319","authenticated-orcid":false,"given":"Abdulrahman A.","family":"Alshdadi","sequence":"first","affiliation":[{"name":"Department of Information Systems and Technology, College of Computer Science and Engineering, University of Jeddah, Asfan Road, Jeddah 21959, Makkah, Saudi Arabia"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1968","published-online":{"date-parts":[[2026,9,17]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","unstructured":"Pawlik, L., Wilk-Jakubowski, J.L., Grabski, P.T., and Wilk-Jakubowski, G. (2025). Securing the electrified future: A systematic review of cyber attacks, intrusion and anomaly detection, and authentication in electric vehicle charging infrastructure. Energies, 18.","DOI":"10.3390\/en18184847"},{"key":"ref_2","doi-asserted-by":"crossref","first-page":"16914","DOI":"10.1109\/TITS.2025.3575399","article-title":"Privacy-aware and resource-efficient distributed charging scheduling for plug-in vehicles under denial-of-service attack","volume":"26","author":"Weng","year":"2025","journal-title":"IEEE Trans. Intell. Transp. Syst."},{"key":"ref_3","doi-asserted-by":"crossref","first-page":"3595","DOI":"10.1109\/TFUZZ.2025.3597276","article-title":"Intelligent event-triggered lane keeping security control for autonomous vehicle under DoS attacks","volume":"33","author":"Ding","year":"2025","journal-title":"IEEE Trans. Fuzzy Syst."},{"key":"ref_4","doi-asserted-by":"crossref","first-page":"9963","DOI":"10.1109\/TDSC.2026.3697937","article-title":"Toward secure task offloading in vehicular edge computing networks","volume":"23","author":"Xiao","year":"2026","journal-title":"IEEE Trans. Dependable Secur. Comput."},{"key":"ref_5","doi-asserted-by":"crossref","unstructured":"Naseem, H., Goswami, P., Choi, K., Iqbal, A., and Hakami, H. (2026). Smart charging and vehicle-to-grid integration of electric vehicles: Technical insights, cybersecurity risks, and mobility-oriented control strategies. Appl. Sci., 16.","DOI":"10.3390\/app16041748"},{"key":"ref_6","doi-asserted-by":"crossref","first-page":"16794","DOI":"10.1038\/s41598-025-93898-2","article-title":"A computational framework for IoT security integrating deep learning-based semantic algorithms for real-time threat response","volume":"15","author":"Ranpara","year":"2025","journal-title":"Sci. Rep."},{"key":"ref_7","doi-asserted-by":"crossref","first-page":"10092","DOI":"10.1038\/s41598-025-92895-9","article-title":"Detection of cyber attacks in electric vehicle charging systems using a remaining useful life generative adversarial network","volume":"15","author":"Dinler","year":"2025","journal-title":"Sci. Rep."},{"key":"ref_8","doi-asserted-by":"crossref","first-page":"603","DOI":"10.1016\/j.aej.2024.12.061","article-title":"AI-enhanced smart grid framework for intrusion detection and mitigation in EV charging stations","volume":"115","author":"Singh","year":"2025","journal-title":"Alex. Eng. J."},{"key":"ref_9","doi-asserted-by":"crossref","unstructured":"Cao, Z., Liu, B., Gao, D., Zhou, D., Han, X., and Cao, J. (2025). A dynamic spatiotemporal deep learning solution for cloud\u2013edge collaborative industrial control system distributed denial-of-service attack detection. Electronics, 14.","DOI":"10.3390\/electronics14091843"},{"key":"ref_10","doi-asserted-by":"crossref","first-page":"3988","DOI":"10.1109\/TCE.2026.3667039","article-title":"Multi-agent federated edge learning for UAV-IDS in smart city IoT environment","volume":"72","author":"Attaullah","year":"2026","journal-title":"IEEE Trans. Consum. Electron."},{"key":"ref_11","doi-asserted-by":"crossref","first-page":"1672","DOI":"10.1109\/TCE.2025.3631745","article-title":"Energy-efficient trajectory design and resource allocation for multi-drone-enabled ISAC in IoT networks","volume":"72","author":"Gou","year":"2026","journal-title":"IEEE Trans. Consum. Electron."},{"key":"ref_12","doi-asserted-by":"crossref","first-page":"111454","DOI":"10.1109\/ACCESS.2025.3580856","article-title":"Cyber resilience of electric vehicle charging in smart grids: The Dutch case","volume":"13","author":"Hijgenaar","year":"2025","journal-title":"IEEE Access"},{"key":"ref_13","doi-asserted-by":"crossref","first-page":"14297","DOI":"10.1109\/JIOT.2025.3525623","article-title":"A novel dynamic Hill cipher and its applications on Medical IoT","volume":"12","author":"Jin","year":"2025","journal-title":"IEEE Internet Things J."},{"key":"ref_14","doi-asserted-by":"crossref","first-page":"140","DOI":"10.1109\/TNSE.2023.3292855","article-title":"TransMalDE: An effective transformer-based hierarchical framework for IoT malware detection","volume":"11","author":"Deng","year":"2023","journal-title":"IEEE Trans. Netw. Sci. Eng."},{"key":"ref_15","doi-asserted-by":"crossref","unstructured":"Ouyang, X., Zhang, Y., Hua, L., and Yin, Y. (2025). AF-TAD: Transformer-based anomaly detection for aircraft fuel systems. Aerospace, 12.","DOI":"10.3390\/aerospace12121066"},{"key":"ref_16","doi-asserted-by":"crossref","first-page":"17148","DOI":"10.1038\/s41598-024-67865-2","article-title":"Enhanced botnet detection in IoT networks using zebra optimization and dual-channel GAN classification","volume":"14","author":"Shareef","year":"2024","journal-title":"Sci. Rep."},{"key":"ref_17","doi-asserted-by":"crossref","first-page":"7838","DOI":"10.1038\/s41598-024-57864-8","article-title":"Deep learning hybridization for improved malware detection in smart Internet of Things","volume":"14","author":"Almazroi","year":"2024","journal-title":"Sci. Rep."},{"key":"ref_18","doi-asserted-by":"crossref","first-page":"25175","DOI":"10.1038\/s41598-024-74017-z","article-title":"Deep learning-based improved transformer model on Android malware detection and classification in Internet of Vehicles","volume":"14","author":"Almakayeel","year":"2024","journal-title":"Sci. Rep."},{"key":"ref_19","doi-asserted-by":"crossref","first-page":"127504","DOI":"10.1016\/j.eswa.2025.127504","article-title":"ResDNViT: A hybrid architecture for NetFlow-based attack detection using a residual dense network and vision transformer","volume":"282","author":"Wasswa","year":"2025","journal-title":"Expert Syst. Appl."},{"key":"ref_20","doi-asserted-by":"crossref","first-page":"28050","DOI":"10.1038\/s41598-025-10826-0","article-title":"GraphFedAI framework for DDoS attack detection in IoT systems using federated learning and graph-based artificial intelligence","volume":"15","author":"Anjum","year":"2025","journal-title":"Sci. Rep."},{"key":"ref_21","doi-asserted-by":"crossref","first-page":"703","DOI":"10.1093\/comjnl\/bxaf140","article-title":"AdvBiTrans: An efficient botnet detection method based on adversarial BiLSTM-transformer in IIoT","volume":"69","author":"Wang","year":"2025","journal-title":"Comput. J."},{"key":"ref_22","doi-asserted-by":"crossref","first-page":"8","DOI":"10.1007\/s10878-025-01384-2","article-title":"Adaptive latent space dip clustering and few-shot wavelet learning for Android malware detection","volume":"51","author":"Selvi","year":"2026","journal-title":"J. Comb. Optim."},{"key":"ref_23","first-page":"27","article-title":"Deep feature-driven hybrid temporal learning and instance-based classification for DDoS detection in industrial control networks","volume":"86","author":"Su","year":"2026","journal-title":"Comput. Mater. Contin."},{"key":"ref_24","doi-asserted-by":"crossref","first-page":"4847","DOI":"10.1038\/s41598-026-35481-x","article-title":"Improving malware detection performance using hybrid deep representation learning with heuristic search algorithms","volume":"16","author":"Anuradha","year":"2026","journal-title":"Sci. Rep."},{"key":"ref_25","doi-asserted-by":"crossref","first-page":"29122","DOI":"10.1038\/s41598-025-13754-1","article-title":"DDoS classification of network traffic in software-defined networking using a hybrid convolutional and gated recurrent neural network","volume":"15","author":"Elshewey","year":"2025","journal-title":"Sci. Rep."},{"key":"ref_26","doi-asserted-by":"crossref","first-page":"20122","DOI":"10.1109\/TITS.2025.3589188","article-title":"Deep learning-driven cyber attack detection framework in DC shipboard microgrids system","volume":"26","author":"Ali","year":"2025","journal-title":"IEEE Trans. Intell. Transp. Syst."},{"key":"ref_27","doi-asserted-by":"crossref","first-page":"104951","DOI":"10.1016\/j.jpdc.2024.104951","article-title":"Anomaly detection based on LSTM and autoencoders using federated learning in smart electric grid","volume":"193","author":"Shrestha","year":"2024","journal-title":"J. Parallel Distrib. Comput."},{"key":"ref_28","doi-asserted-by":"crossref","first-page":"3113","DOI":"10.1109\/TITS.2026.3651434","article-title":"Bidirectional GNN-based intrusion detection of malware injection attacks in EV charging stations","volume":"27","author":"Poudel","year":"2026","journal-title":"IEEE Trans. Intell. Transp. Syst."},{"key":"ref_29","doi-asserted-by":"crossref","unstructured":"Aldossary, M., Alzamil, I., and Almutairi, J. (2025). Enhanced intrusion detection in drone networks: A cross-layer convolutional attention approach. Drones, 9.","DOI":"10.3390\/drones9010046"},{"key":"ref_30","doi-asserted-by":"crossref","first-page":"112450","DOI":"10.1016\/j.ymssp.2025.112450","article-title":"Towards high-speed elevator fault diagnosis: A ParallelGraphNet driven multi-sensor optimization selection method","volume":"228","author":"Wang","year":"2025","journal-title":"Mech. Syst. Signal Process."},{"key":"ref_31","doi-asserted-by":"crossref","first-page":"108756","DOI":"10.1016\/j.neunet.2026.108756","article-title":"DADiffNet: Delay-aware diffusion networks with adaptive subgraphs for large scale traffic forecasting","volume":"200","author":"Fan","year":"2026","journal-title":"Neural Netw."},{"key":"ref_32","doi-asserted-by":"crossref","first-page":"4125","DOI":"10.1109\/TITS.2026.3661548","article-title":"Criticality assessment model for intelligent vehicle test scenario based on interactive field feature and hypergraph learning","volume":"27","author":"Huang","year":"2026","journal-title":"IEEE Trans. Intell. Transp. Syst."},{"key":"ref_33","unstructured":"Toni, S. (2026, July 03). Smart City EV Charging Network Spatiotemporal Telemetry Dataset. Zenodo. 2026; Version 1. Available online: https:\/\/zenodo.org\/records\/19675808."},{"key":"ref_34","doi-asserted-by":"crossref","first-page":"849","DOI":"10.1016\/j.future.2019.02.028","article-title":"Harris hawks optimization: Algorithm and applications","volume":"97","author":"Heidari","year":"2019","journal-title":"Future Gener. Comput. Syst."},{"key":"ref_35","doi-asserted-by":"crossref","first-page":"103300","DOI":"10.1016\/j.engappai.2019.103300","article-title":"Manta ray foraging optimization: An effective bio-inspired optimizer for engineering applications","volume":"87","author":"Zhao","year":"2020","journal-title":"Eng. Appl. Artif. Intell."},{"key":"ref_36","first-page":"1447","article-title":"Performance of evaluation metrics for classification in imbalanced data","volume":"40","author":"Russo","year":"2025","journal-title":"Comput. Stat."}],"container-title":["Sensors"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1424-8220\/26\/18\/5898\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,9,22]],"date-time":"2026-09-22T09:09:42Z","timestamp":1790068182000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1424-8220\/26\/18\/5898"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,9,17]]},"references-count":36,"journal-issue":{"issue":"18","published-online":{"date-parts":[[2026,9]]}},"alternative-id":["s26185898"],"URL":"https:\/\/doi.org\/10.3390\/s26185898","relation":{},"ISSN":["1424-8220"],"issn-type":[{"value":"1424-8220","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,9,17]]}}}