CAN Studio — certified CAN-bus analysis
A steering ECU claimed 940.5°. The wheel stops at 500. Watch it get caught — and named.
A vehicle-network monitor that doesn't score frames with a confidence — it proves each one NORMAL, ANOMALY, or REJECT and cites the exact CAN invariant it checked. Real Toyota RAV4 frames, decoded and verified in microseconds, deterministic to the bit.
Every attack, its frame, and the rule that named it
Four injections. Four proofs.
Each is a real candump frame decoded and proven to break one named
invariant — never a black-box score. The verdict strings below are verbatim from the
vulcan can CLI.
Details
The honest floor, the worst number, and the whole rulebook
A tool you can put in a safety case has to show its floor and its failure mode, not just its highlight reel. It's all here — expand what you want to inspect.
The honest floor — what NORMAL and REJECT actually mean
NORMAL isn't the absence of a flag — it's a completed proof of conformance. A clean RAV4 window, every applicable invariant proven to hold (counts grow per-ID as each cadence window accrues):
frame 3 0x0B4 SPEED NORMAL — all 6 invariants hold
frame 8 0x0AA WHEEL_SPEEDS NORMAL — all 5 invariants hold
REJECT is reserved for the genuinely uncheckable — ask it something outside the CAN claim grammar and it refuses rather than bluff. (An unknown arbitration id is a proven ANOMALY, not a shrug.)
query "the door is open" → REJECT — objective but not a CAN claim
Full disclosure — the same detector on 53,802 real frames
The scenarios above are proofs against a curated DBC. This is the detector's first run on a real, nominal on-road capture (comma2k19, Toyota RAV4). No injected attacks — so every flag here is a false positive, and we say so.
Verdict distribution
| Verdict | Count | Share |
|---|---|---|
| NORMAL | 21,573 | 40.1% |
| ANOMALY | 32,229 | 59.9% |
| REJECT | 0 | 0.0% |
Anomalies by first-failing invariant
The number that matters: 40.8% false positives on
known-DBC ids. The catalog was tuned on synthetic data and is too strict for a
messy real bus — the open DBC maps only 31 of the 90 ids seen, so undocumented-but-benign
ECUs trip valid_id_whitelist by construction, and real timing jitter
over-trips cadence. Every verdict is still a sound proof against the
catalog; the fix is a baseline-observed whitelist and measured cadence bands, not a
softer model. That gap is tracked openly.
The invariant catalog — the whole rulebook, in plain sight
There is no hidden model weight deciding a verdict. Every frame is checked against this fixed, ordered catalog of decidable CAN invariants; the first one that fails names the anomaly.