STAG-GuardNet: UAV-Assisted Spatio-Temporal Attack Graph Learning for Secure IoT Communication in Smart EV Charging Networks

Smart electric vehicle (EV) charging infrastructures are evolving into large-scale cyber-physical Internet of Things (IoT) systems that depend on distributed communication, real-time sensing, and spatially coordinated charging operations. However, their interconnected communication architecture exposes charging stations, EV communication links, and network gateways to coordinated distributed denial-of-service (DDoS) attacks. Existing intrusion detection approaches primarily rely on localized or static traffic analysis and therefore have limited capability to capture spatially distributed and temporally evolving attack behavior. This study proposes the Spatio-Temporal Attack Graph Guard Network (STAG-GuardNet), an unmanned aerial vehicle (UAV)-assisted spatio-temporal attack graph learning framework for DDoS detection and security monitoring in smart EV charging networks. The framework integrates spatiotemporal signal conditioning, telemetry-adaptive graph aggregation, temporal dependency learning, attack-memory encoding, and adaptive risk-aware attention to model coordinated cyber-physical attack behavior. UAV-assisted telemetry provides complementary spatial and wireless information on communication instability, signal variation, neighboring congestion, and distributed attack-related behavior. A Hybrid Hawk–Manta Adaptive Optimizer (HHMAO) is employed to improve hyperparameter selection and convergence stability under imbalanced, heterogeneous, and nonstationary traffic conditions. The framework is evaluated using a smart-city EV charging cybersecurity dataset and three benchmark IoT intrusion detection datasets, namely TON_IoT, Edge-IIoTset, and X-IIoTID. Experimental results show that STAG-GuardNet achieves 97.7% accuracy, a 97.7% weighted F1-score, and a 98.4% area under the receiver operating characteristic curve (AUC) on the primary dataset. The framework also maintains stable performance under noisy telemetry, missing observations, heterogeneous traffic distributions, and charging-node outages. These findings demonstrate the potential of STAG-GuardNet for resilient and spatially informed security monitoring in UAV-assisted IoT-enabled EV charging infrastructures.