Active Cryptographically-Induced Timing Fingerprinting for Lightweight Intrusion Detection in CAN Networks

This paper presents an active cryptographically induced timing-fingerprinting method for lightweight intrusion detection in Controller Area Network (CAN)-based in-vehicle networks. A monitoring node sends a fresh nonce to each enrolled electronic control unit (ECU), inducing the execution of a deterministic HMAC-SHA256 routine. Each ECU returns a 64-bit truncated authentication tag within one Classical CAN data frame. The monitor verifies the tag and analyzes the round-trip latency over repeated exchanges to determine whether the response is consistent with the enrolled ECU timing profile. The resulting decision combines cryptographic authentication with a probabilistic device-profile check without requiring additional analog sensing hardware. The method was implemented on a testbed comprising an Infineon AURIX TC375 monitoring node and four Arduino UNO R4 responders. With natural timing differences, the classifier achieved 72.8% accuracy using 10,000 observations and 76.6% using 12,500 observations. ECU-specific deterministic calibration increased the 10,000-observation accuracy to 96.6%, demonstrating both its effectiveness and the dependence of the identical-board configuration on calibrated timing separation. At ten challenges per second per ECU, the IDS generates 80 additional frames per second, corresponding to an estimated 2.16-2.56% utilization of a 500-kbit/s Classical CAN bus. The observed responder execution time corresponds to less than 0.40% processor utilization, while the monitor requires approximately 6.2 kB for four enrolled profiles. A preliminary chamber experiment on one responder between approximately 25,° C and 84,° C showed a gradual decrease in the smoothed node-specific accuracy trend from about 95.9% to 95.1%. The results demonstrate feasibility on the evaluated platform, while larger ECU populations, voltage and workload variations, long-term drift, and adaptive timing-emulation attacks remain to be investigated.