Intrusion Detection and Localization for CAN by Extracting Propagation Delay Features from Message Intervals

Learn about a novel cybersecurity approach for automotive networks in this 11-minute conference presentation from VehicleSec '25. Discover how researchers from Georgia Institute of Technology, Qatar Computing Research Institute, and Purdue University developed an innovative intrusion detection system for Controller Area Network (CAN bus) communications in vehicles. Explore the concept of "transmit signatures" (TS), a new timing-based feature that leverages physical distances and propagation delays between Electronic Control Units (ECUs) to identify and locate impersonation attacks such as spoofing and replay attacks. Understand how this method extracts timing signatures from natural message intervals without requiring additional hardware installation or software modifications to existing ECU systems. Examine the theoretical framework behind distance-dependent timing signatures, the experimental validation process, and the practical implementation of detection and localization algorithms that address the inherent security vulnerabilities in automotive CAN bus protocols.