The prototype watched messages on a car’s internal network while using less than 2 percent of the main processor’s capacity.
The system adds a small security processor to an electronic control unit, the embedded computer that manages vehicle functions. It monitors Controller Area Network traffic and looks for unusual timing and statistical patterns, leaving the main processor available for other tasks.
The researchers implemented the design in programmable hardware connected to an ARM Cortex-R5-based system and tested it with simulated vehicle traffic and attack scenarios. Compared with the software-based system used in their evaluation, the hardware-assisted design reported faster detection, fewer false positives and lower processor overhead.
What the prototype detected
In the reported tests, the hardware-assisted intrusion detector had an average detection latency of 14 microseconds, compared with 220 microseconds for the software-based comparison. Its false-positive rate was below 1.2 percent, versus 6.5 percent for the software system, meaning fewer benign messages were classified as attacks.
The detector used less than 2 percent of the main processor, compared with 18.2 percent for the software comparison. The hardware logic added 32 milliwatts in the power analysis, while the comparison table reported total power of 0.58 watts for the hardware-assisted system and 0.94 watts for the software system. On the test FPGA, the design used 8 percent of lookup tables, 6 percent of flip-flops and 10 percent of block memory.
Why lower overhead matters
Vehicle functions increasingly depend on electronic control units that communicate over internal networks. A detector that handles monitoring on a separate processor could identify suspicious network activity without taking as much time or processing capacity from the control unit’s main tasks.
The reported resource use also suggests that the design could fit the constraints of some embedded automotive systems. The authors describe the architecture as compatible with ISO/SAE 21434 and AUTOSAR-related security requirements, although the reported experiments tested a prototype rather than an installed production vehicle.
Tests and open questions
The evidence comes from a hardware prototype built with programmable logic and an ARM Cortex-R5-based system, combined with simulations of vehicle traffic and attack conditions. The tests included message injection, spoofing, flooding and electronic control unit impersonation, and compared the results with a software-based intrusion detector.
The abstract and excerpts do not report testing on a road-going vehicle or on a production automotive control unit. The attack scenarios were simulated, and the results apply directly to the tested prototype and conditions. The authors identify adaptation to higher-bandwidth Ethernet vehicle networks and adaptive, artificial-intelligence-based detection as future work, so the current findings do not establish performance in those settings.
// Source
SCCTS Journal of Embedded Systems Design and Applications · 2026 · DOI: 10.31838/esa/03.02.04
Authors: Vishnupriya.T, Sumit Ramswami Punam
Institutions: Kalinga University
