Physical CAN and CAN-FD networks were designed in the 1980s without built-in security: arbitration is strictly based on numerical ID priority, and any connected ECU can broadcast any message. As vehicles gain cellular connectivity, software supply-chain compromises allow adversaries to pivot from the telematics unit into safety-critical chassis buses. In this article, we explain how to build an ultra-fast ML intrusion detection pipeline that executes in under 50 microseconds per frame.
Raw CAN message content is difficult for ML models to interpret directly due to varying endianness and bitpacking. The most discriminative feature for intrusion detection is hardware timestamp deltas (`Delta_t = t_n - t_{n-1}`). A rolling window of 16 intervals per CAN ID captures the characteristic mechanical clock drift of legitimate quartz oscillators. When an external microcontroller injects spoofed frames, the clock drift signature collapses, triggering the ML classifier instantly.