GitHub - Zain-Naqvi-tech/ARM-baremetal-CAN-IDS: A bare-metal multi-ECU automotive CAN network simulation and Intrusion Detection System (IDS) built on the ARM Cortex-M4 (MSP432E401Y)

CAN Bus Intrusion Detection System

Platform: ARM Cortex-M4 MSP432E401Y Toolchain: Keil MDK v5 (firmware), Python (host dashboard) Language: Bare-metal C + Python

Overview

A two-node car network and a firmware intrusion detection system that catches five classes of attack in real time. Everything from raw registers on an MSP432E401Y. No CAN library, no vendor HAL.

CAN has almost no built-in security. Any node can claim to be any other node. That is the actual problem automotive security teams work on, not a toy. I wanted proof that I can read a thousand-page reference manual, bring a peripheral up from nothing, and reason about real attacks.

The short version

• A simulated car: four ECUs (RPM, throttle, speed, coolant) broadcasting on a real CAN bus at realistic rates.
• Two physical nodes on one chip. CAN0 is the car and transmits. CAN1 is the security module and listens. Wired through real SN65HVD230 transceivers over a twisted pair.
• A firmware IDS on the same core that flags five kinds of malicious or broken traffic.
• A live Python dashboard on my laptop. It decodes every signal and lets me fire attacks at the bus with a single keypress.

Hardware and Bring-Up

• Two on-chip CAN controllers, each routed to its own transceiver, sharing one physical bus.
• Twisted pair for the CANH and CANL backbone to keep noise down. The transceivers carry the 120 ohm termination.
• Bit timing calculated by hand from the bit-rate formula (BRP 14, TSEG1 12, TSEG2 3) for a stable 500 kbps link.
• Every message object configured through the IF1 and IF2 indirect interface. This was the part that forced me to actually understand the controller instead of copying a driver.