MicroCAN: Ultra-Fast Windowed Statistical Learning for Real-Time CAN Intrusion Detection

Intrusion detection on Controller Area Network (CAN) traffic must balance high detection accuracy with strict real-time constraints on in-vehicle gateways and ECUs. We present MicroCAN, a lightweight CAN intrusion detection framework that transforms raw CAN streams into per-window, multiview statistical representations and applies efficient classifiers for microsecond-level inference. MicroCAN aggregates complementary signals from (i) CAN identifier (ID) distribution structure, (ii) per-ID timing periodicity and jitter, and (iii) payload dynamics, including bit-level change rates and byte-wise statistics. To ensure credible evaluation, we introduce a per-source windowing scheme that prevents cross-file window mixing and supports time-based and holdout splits without inadvertent leakage. We benchmark MicroCAN against two strong baselines: CAN-asLanguage detectors using ID n-grams with linear models, and ultra-light unsupervised drift detectors based on chi-square and KL divergence of ID distributions. Experiments on mixed CAN datasets demonstrate that MicroCAN achieves near-perfect detection performance while maintaining orders-of-magnitude faster inference than text-style baselines, yielding a favorable accuracylatency trade-off for practical deployment. We further provide an extensible evaluation suite and ablations to characterize the contributions of timing and payload features under different windowing configurations.