cs.LGJan 30, 2026

Securing Time Integrity in Energy IoT Against Clock Drift and Y2K38 Failures

Authors: Saeid Jamshidi, Foutse Khomh, Carol Fung, Omar Abdul Wahab, Rolando Herrero

Abstract

Time integrity across distributed Internet of Things (IoT) devices is fundamental to reliable sensing, control, and security in energy cyber-physical systems. However, operational energy IoT systems remain vulnerable to clock-drift escalation, time-synchronization manipulation, and catastrophic timestamp discontinuities, e.g., the Year 2038 (Y2K38) Unix epoch overflow. These failures violate timestamp monotonicity, distort temporal ordering, and introduce structured inconsistencies in system observations. Conventional anomaly detection models, which typically assume reliable and uniformly ordered timestamps, are therefore ill-equipped to capture timing-layer failures. This paper introduces STGAT (Spatio-Temporal Graph Attention Network), a clock-dynamics-aware anomaly detection solution that jointly models temporal distortion and inter-device consistency in energy IoT systems. STGAT integrates drift-aware temporal embeddings and temporal self-attention to capture non-uniform and corrupted time evolution within individual device streams, while graph attention models the spatial propagation of timing inconsistencies across interconnected nodes. A Jacobian-regularized latent representation further promotes geometric separation between nominal clock evolution and anomalous temporal deformation caused by drift escalation, synchronization offsets, jitter accumulation, and epoch-overflow events. Experimental evaluation on energy IoT telemetry augmented with controlled timing-layer perturbations shows that STGAT achieves 95.7% accuracy, 94.0% precision, 92.0% recall, 93.0% F1-score, and 0.97 AUC under the primary test setting. STGAT also reduces detection delay to 2.3 time steps, corresponding to a 26% improvement over the closest baseline, while maintaining stable performance under overflow-induced discontinuities, stealthy drift escalation, and temporally induced physical inconsistencies.

Explore similar work

CardsList
Jun 23, 2026cs.LG

A Hybrid CNN-LSTM Intrusion Detection Framework for Cybersecurity in Smart Renewable Energy Grids

The accelerated digitalization of renewable energy smart grids through IoT sensors, AMI, and SCADA systems has significantly expanded the attack surface for sophisticated cyberattacks, FDI attacks that stealthily distort state estimation and DoS/DDoS attacks that flood communication channels. Current IDS, however, exhibit three inherent limitations: inadequate modeling of the temporal progression of multi-step attacks, degraded scalability under extremely skewed class distributions of standard benchmark datasets, and restricted generalization across heterogeneous network environments. In this study, we present a Hybrid CNN-LSTM IDS that jointly exploits CNN-based spatial feature extraction and LSTM-based temporal sequence modeling, enabling the detection of instantaneous volumetric anomalies and gradually evolving low and slow-attack campaigns in real time. The model was trained using a seven-step preprocessing workflow comprising missing-value imputation, min-max normalization, one-hot encoding, SMOTE class balancing, mutual-information feature selection, causal temporal sequence construction (T=10), and stratified partitioning. LSTM (96.1%), Random Forest (93.5%), SVM (91.2%) and KNN (89.7%); in NSL-KDD, it reaches 98.2% precision versus 96.4% (LSTM), 95.2% (CNN), 92.7% (Random Forest) and 90.8% (SVM), with margins of 2-9 percentage points in all measures. An ablation analysis identified SMOTE balancing as the most influential design choice (-3.7~pp F1 without it). The model achieves a real-time inference throughput of 27,800 flows/s on GPU and 0.082 ms/sample CPU latency in FP32,, with INT8 quantization providing an additional 3.1 x speedup at 0.3% accuracy loss, confirming deployment feasibility on resource-constrained IEDs with <128MB memory and establishing a deployable deep-learning framework for securing next-generation renewable energy smart grid infrastructure.
Sajib Debnath, Remon Das
Intrusion DetectionSmart GridsCnn-LstmCybersecurityAttack SurfaceDigital World
AskPDF
Jun 30, 2026cs.LG

Relational and Sequential Conformal Inference for Energy Time Series over Graphs via Foundation Models

Accurate energy demand forecasting is essential for the reliable operation and planning of modern sustainable energy systems. Spatial-temporal graph neural networks (STGNNs) have recently achieved strong performance in point forecasting by jointly modeling temporal dynamics and relational dependencies across interconnected energy nodes. However, in real-world energy systems, accurate point forecasts alone are insufficient, as operators also require reliable uncertainty estimates to support risk-aware decision-making, grid stability, and operational planning under uncertainty. Conformal prediction provides a principled and model-agnostic framework for uncertainty quantification with statistical coverage guarantees, making it particularly attractive for safety-critical energy applications. However, existing conformal prediction approaches often fail to fully capture the complex spatial-temporal structure of energy systems. To address these limitations, we propose STOIC (Spatial-Temporal Graph Conformal Prediction with In-Context Learning), a novel framework that integrates graph-based forecasting with the zero-shot calibration capabilities of tabular foundation models. STOIC first generates point forecasts using an STGNN and subsequently reformulates spatial-temporal residuals into a tabular representation suitable for in-context learning. Leveraging a tabular foundation model, STOIC calibrates prediction intervals without task-specific retraining, effectively capturing both sequential and relational dependencies. We evaluate STOIC on five diverse benchmarks, including synthetic simulations as well as real-world electricity and district heating networks. Across all datasets, STOIC consistently outperforms existing conformal prediction baselines, delivering more reliable and robust uncertainty estimates for complex graph-structured energy time series.
Keivan Faghih Niresi, Alice Cicirello, Olga Fink
Energy ForecastingTemporal Graph Neural NetworksSpatio-Temporal ForecastingConformal PredictionConformal InferenceFoundation Model
AskPDF
Apr 23, 2026cs.CR

A-THENA: Early Intrusion Detection for IoT with Time-Aware Hybrid Encoding and Network-Specific Augmentation

The proliferation of Internet of Things (IoT) devices has significantly expanded attack surfaces, making IoT ecosystems particularly susceptible to sophisticated cyber threats. To address this challenge, this work introduces A-THENA, a lightweight early intrusion detection system (EIDS) that significantly extends preliminary findings on time-aware encodings. A-THENA employs an advanced Transformer-based architecture augmented with a generalized Time-Aware Hybrid Encoding (THE), integrating packet timestamps to effectively capture temporal dynamics essential for accurate and early threat detection. The proposed system further employs a Network-Specific Augmentation (NA) pipeline, which enhances model robustness and generalization. We evaluate A-THENA on three benchmark IoT intrusion detection datasets-CICIoT23-WEB, MQTT-IoT-IDS2020, and IoTID20-where it consistently achieves strong performance. Averaged across all three datasets, it improves accuracy by 6.88 percentage points over the best-performing traditional positional encoding, 3.69 points over the strongest feature-based model, 6.17 points over the leading time-aware alternatives, and 5.11 points over related models, while achieving near-zero false alarms and false negatives. To assess real-world feasibility, we deploy A-THENA on the Raspberry Pi Zero 2 W, demonstrating its ability to perform real-time intrusion detection with minimal latency and memory usage. These results establish A-THENA as an agile, practical, and highly effective solution for securing IoT networks.
Ioannis Panopoulos, Maria Lamprini A. Bartsioka, Sokratis Nikolaidis +3
Internet Of ThingIntrusion DetectionEarly WarningCloverData Augmentation
AskPDF