Embedded networks & security
CAN Bus Anomaly Lab
How can unusual CAN traffic be explained through inspectable rules?
Completed · Tested · 2026
Context
It demonstrates transparent embedded-network monitoring without transmitting frames or connecting to a safety-critical system.
Design problem
How can unusual CAN traffic be explained through inspectable rules?
Approach
Validate frames before applying allowlist, rate, payload, and counter rules; report the violated rule and observed value.
Validation
Synthetic benign and anomalous traffic, explainable rule findings, and a public unittest suite.
Result
The documented demo distinguishes a benign baseline from synthetic anomalies without transmitting or modifying frames.
Limitations
No physical CAN connection. Static rules can miss slow or context-dependent attacks and need system-specific calibration.
What I would improve next
A hardware extension would use an isolated development bus and recorded benign traffic within strict safety boundaries.
Repository & documentation
Documentation checked Sep 3, 2026. The summaries describe the repository’s validation approach; they do not claim new hardware or deployment results.