CAN Bus Security Analysis and Intrusion Detection

Bit-level multi-signal packing and rate-based anomaly detection on a simulated ECU network

01Problem

CAN has been the standard bus between vehicle ECUs since 1986, and it carries no sender authentication. Any node with bus access can transmit any identifier, and every node receives every frame, which is the structural reason spoofing, sniffing, and message injection all work. Our six-person team analysed the data frame field by field and rebuilt a working transmitter, receiver, monitor, and intrusion detector in LabVIEW. Instead of conventional ECU signals we packed six human biometric signals into the payload, which made the bit-packing design something we had to derive rather than copy.

02What I built

A 64-bit signal map for six signals — LFT 10, HEM 19, BRAIN 21, WATER 3, GENDER 1, STRESS 10 bits — that fills the data field exactly, with no overlap and no unused bits.
Symmetric transmit and receive bit packing in LabVIEW Formula Nodes using AND, OR, and shift, verified byte by byte against hand-computed patterns.
A rate-based intrusion detector: the receive loop measures the actual packet interval, switches the hazard LED to red when it exceeds the configured rate, and stops the loop in the same cycle.

03How it works

The demonstrator is a single LabVIEW VI with two loops. The transmit loop takes six signal values, packs them into byte0 through byte7 in a Formula Node, and joins them into a uint8[8] array that stands for the data field of a frame with identifier 5 and DLC 8. The receive loop indexes that array, runs the inverse bit operations, drives the monitoring gauges, and feeds the rate monitor that decides whether traffic looks injected.

The standard CAN data frame: SOF 1 bit, arbitration 12 (11-bit identifier and RTR), control 6, data 0 to 64, CRC 16, ACK 2, EOF 7. Only the data field carries payload, and no field identifies the sender.

The 64-bit payload map. Bit boundaries were computed by hand and chain exactly: 0+10, 10+19, 29+21, 50+3, 53+1, 54+10 = 64. Signals cross byte boundaries, so byte1 holds LFT bits 9 to 8 together with HEM bits 5 to 0.

Packet arrival intervals against the configured rate. While the measured interval matches the threshold the indicator stays green; once it exceeds the threshold the indicator turns red and the receive loop stops on the same iteration.

1PackThe transmit Formula Node masks and shifts the six values into eight bytes, for example byte1 = ((LFT & 0x300) >> 8) | ((HEM & 0x3F) << 2).

2FrameBuild Array joins byte0 through byte7 into the uint8[8] payload, transmitted with identifier 5 and DLC 8.

3UnpackThe receive Formula Node applies the inverse operations, for example LFT = ((byte1 & 0x03) << 8) | byte0, and writes the six values to the front panel indicators.

4CompareA comparison tab shows the transmitted and reconstructed byte arrays side by side, which is how a wrong bit boundary becomes visible immediately.

5DetectThe receive loop measures the packet interval, compares it against the configured rate, raises the hazard LED and terminates the loop when the interval exceeds it.

04Results

Signals in one frame

64 bits

Payload used, DLC = 8

Overlapping or unused bits

Key takeaway With all six signals at maximum (LFT 1023, HEM 524287, BRAIN 2097151, WATER 7, GENDER 1, STRESS 1023) every transmitted byte reads 0xFF and the receiver reconstructs the original values; a mid-range BRAIN of 100000 reproduces the expected pattern across byte3 to byte6. Stepping the receive interval 200 → 210 → 250 → 300 ms against a 200 ms threshold trips the alert and stops the loop within one cycle.

05Engineering decisions

Pack six signals into one frame rather than sending one frame per signal. The data field is fixed at 8 bytes, so six separate frames would carry the same information at six times the bus load.
Detect intrusion by packet rate rather than by payload content. CAN offers no sender authentication, so timing is the only signal available without changing the protocol — and the cost is real: a forged frame sent at the normal rate is invisible to this detector.
Carry fractional and negative values with a x100 scale and a +100 offset instead of widening the fields. Two's complement would consume the whole 10-bit STRESS field, while a shared offset costs no bits at all; the price is that everything below the second decimal is lost.