Short: Is Your ECU Really Yours?

Abbas Ali and Hafiz Malik, University of Michigan-Dearborn

Vehicular networks rely on embedded devices (Electronic Control Units (ECUs), CAN bus nodes, and sensor modules) that communicate via digital ON/OFF switching signals. A compromised or counterfeit device that passes cryptographic checks poses a critical threat to vehicle safety. We present a hardware fingerprinting framework that authenticates embedded devices by analyzing the intrinsic analog characteristics of their digital switching behavior. The key insight is that every digital transition (a CAN bus bit transition, an ECU command pulse, a GPIO toggle) forces hardware through abrupt state changes where manufacturing variations in output drivers, clock sources, and passive components become observable as device-specific imperfections. We extract 211 features from captured waveforms and propose a hybrid classification strategy combining a cycle-based Random Forest (Approach A) and an OVA stacked ensemble (Approach B), achieving 99.5% real-time accuracy under controlled mounting conditions (93.6% without) and 100% device type accuracy across 8 devices spanning 4 hardware types, including same-model clone pairs. We demonstrate this framework on embedded development platforms as a proof-of-concept step toward automotive ECU authentication, laying the groundwork for physical-layer authentication in CAN bus and ECU security contexts, subject to validation on automotive hardware.

Open Access Media

USENIX is committed to Open Access to the research presented at our events. Papers and proceedings are freely available to everyone once the event begins. Any video, audio, and/or slides that are posted after the event are also free and open to everyone. Support USENIX and our commitment to Open Access.

BibTeX
@inproceedings {320299,
author = {Abbas Ali and Hafiz Malik},
title = {Short: Is Your {ECU} Really Yours?},
booktitle = {4th USENIX Symposium on Vehicle Security and Privacy (VehicleSec 26)},
year = {2026},
isbn = {978-1-939133-56-4},
address = {Baltimore, MD},
pages = {359--370},
url = {https://www.usenix.org/conference/vehiclesec26/presentation/ali},
publisher = {USENIX Association},
month = aug
}

Presentation Video