Lightweight Orthogonal Multilayer IDS Designed and Implemented on Physical CAN Network Testbed

The transition toward Software-Defined Vehicles has expanded the attack surface of the In-Vehicle Network, where the Controller Area Network (CAN) remains the de facto standard despite its lack of native security mechanisms. Cryptographic countermeasures such as AUTOSAR Secure Onboard Communication impose non-negligible overhead and cannot be retrofitted on legacy electronic control units, motivating lightweight Intrusion Detection System (IDS) as a practical alternative. This work proposes an orthogonal multi-layer IDS that analyzes complementary characteristics of each incoming CAN frame across the data-link and application layers. The first module, ML-Detector, employs a lightweight binary classifier that combines a logarithmic temporal feature, a one-hot encoding of nominal transmission periods, and the raw payload bytes. The second module, DBC-Verifier, deterministically verifies identifier whitelists, Data Length Code (DLC), and message periodicity constraints derived from the CAN database. The IDS firmware is partially generated via the MATLAB Embedded Coder toolchain, deployed on an automotive-grade NXP S32K3X4EVB-T172 board hosting an ARM Cortex-M7 core, and validated on VAGILETTA, a custom Hardware-in-the-Loop CAN testbed generating realistic traffic from eight ECUs over 56 CAN identifiers. Experimental results on five representative scenarios spanning DoS, black-/gray-box fuzzing, whitelist-aware payload spoofing, and a timing-compliant ECU-takeover condition show detection accuracies between 86.3% and 97.6%, while the complete IDS executes in only 38.84\, \mathrm{\mu s} and occupies 3.12\, \rm{kB} of Flash memory, demonstrating its suitability for real-time deployment on resource-constrained automotive ECUs.