Researchers at Clemson University and the University of Michigan have developed CARdea, a two-phase anomaly detection scheme that catches vehicles broadcasting malicious Basic Safety Messages over V2V links, and say it is fast and light enough to run on today’s cars.
The threat model is the compromised vehicle: authentication stops external attackers, but a hacked car inside the network can still broadcast fake safety messages that nearby control systems trust. Prior detection work leaned on heavy machine learning or expensive sensor fusion that automakers have not deployed.
CARdea splits the job. A lightweight statistical phase runs on the vehicle and flags anomalous messages with up to 98% sensitivity in about 0.1 ms. A second machine learning phase handles the hard cases the first pass cannot classify, and can execute on the vehicle, at the edge, or in the cloud depending on available resources.
The team validated the scheme with 108 hours of simulated basic safety message data covering realistic traffic scenarios and multiple attack types. They presented the work at VehicleSec ’26 in Baltimore.
The approach matters because V2V safety applications are starting to reach production, and a car that lies about its position, speed, or braking intent could force unsafe maneuvers from everyone around it. Practical, deployable detection is the missing layer between authentication and safe operation.
