Open Access

ARTICLE

Forensic Analysis of Cyberattacks in Electric Vehicle Charging Systems Using Host-Level Data

Salam Al-E’mari¹, Yousef Sanjalawe^2,*, Budoor Allehyani³, Ghader Kurdi⁴, Sharif Makhadmeh², Ameera Jaradat⁵, Duaa Hijazi⁶

1 Department of Information Security, Faculty of Information Technology, University of Petra, Amman, 11196, Jordan
2 Department of Information Technology, King Abdullah II School for Information Technology, University of Jordan, Amman, 11942, Jordan
3 Department of Software Engineering, College of Computing, Umm Al-Qura University, Makkah, 24382, Saudi Arabia
4 Department of Data Science, College of Computing, Umm Al-Qura University, Makkah, 24382, Saudi Arabia
5 Department of Computer Science, Faculty of Information Technology and Computer Sciences, Yarmouk University, Irbid, 21163, Jordan
6 College of Business Administration, Northern Border University, Arar, 91431, Saudi Arabia

* Corresponding Author: Yousef Sanjalawe. Email:

Computers, Materials & Continua 2025, 85(2), 3289-3320. https://doi.org/10.32604/cmc.2025.067950

Received 16 May 2025; Accepted 15 July 2025; Issue published 23 September 2025

Abstract

Electric Vehicle Charging Systems (EVCS) are increasingly vulnerable to cybersecurity threats as they integrate deeply into smart grids and Internet of Things (IoT) environments, raising significant security challenges. Most existing research primarily emphasizes network-level anomaly detection, leaving critical vulnerabilities at the host level underexplored. This study introduces a novel forensic analysis framework leveraging host-level data, including system logs, kernel events, and Hardware Performance Counters (HPC), to detect and analyze sophisticated cyberattacks such as cryptojacking, Denial-of-Service (DoS), and reconnaissance activities targeting EVCS. Using comprehensive forensic analysis and machine learning models, the proposed framework significantly outperforms existing methods, achieving an accuracy of 98.81%. The findings offer insights into distinct behavioral signatures associated with specific cyber threats, enabling improved cybersecurity strategies and actionable recommendations for robust EVCS infrastructure protection.

---

Keywords

---