Multimodal LLM-Guided Sequential Detection of Cyber Threats in Electric Vehicle Charging Systems

Modern electric vehicle (EV) charging systems are highly sophisticated and connected cyber-physical systems that are prone to cybersecurity threats, resulting in consequences such as billing fraud, energy theft, and load-altering attacks that can disrupt grid stability. Traditional machine learning-based anomaly detection approaches often struggle with high false positive rates and poor generalization to novel attack patterns due to their reliance on labeled data and static thresholds. In this paper, we propose a multimodal anomaly detection framework that integrates sequential time-series forecasting with large language model (LLM)-based visual reasoning for real-time threat detection in EV charging systems. Our approach utilizes an LSTM model to forecast battery state-of-charge (SOC) trajectories, which are then visually compared to actual measurements. The resulting SOC plots are analyzed by GPT-4o through a structured prompt to classify anomalies across categories such as denial-of-service, overcharging, and billing fraud. A progressive, percentage-based windowing strategy enables early-stage detection while preserving classification reliability. Experimental results on real-world and synthetic datasets demonstrate that our LLM-guided framework significantly improves detection accuracy and timeliness over baseline methods, achieving up to 60% energy loss reduction through proactive intervention. This methodology provides a scalable and interpretable solution for securing EV charging infrastructure against evolving cyber threats.