Systems and methods for detecting vehicle controller spoofing

A vehicle configured to detect vehicle controller spoofing comprising:

• a plurality of vehicle controllers including first and second vehicle controllers;
• a vehicle network switch comprising a plurality of ports, wherein a first port of the plurality of ports is designated to only receive data frames from the first vehicle controller and the first vehicle controller is associated with a first media access control (MAC) address;
• and
• a content addressable memory (CAM) configured to:
• receive a first data frame including a source MAC address at the first port;
• retrieve a stored association between the first port and the first MAC address;
• determine whether the source MAC address is an invalid source MAC address based on a comparison of the source MAC address with the first MAC address;
• and
• generate an anomaly event based on the determination, wherein the anomaly event is indicative of the first vehicle controller masquerading as the second vehicle controller using a second MAC address as the source MAC address, the second MAC address being associated with the second vehicle controller.

A system for detecting vehicle controller spoofing comprising:

• at least one processor;
• and
• at least one memory communicatively coupled to the at least one processor, the at least one memory comprising instructions that upon execution by the at least one processor, cause the at least one processor to:
• receive a first data frame including a source MAC address at a first port of a plurality of ports of a vehicle network switch;
• retrieve a stored association between the first port and a first media access control (MAC) address from the at least one memory, wherein the first port is designated to only receive data frames from a first vehicle controller of a plurality of vehicle controllers in the vehicle and the first vehicle controller is associated with the first MAC address;
• determine whether the source MAC address is an invalid source MAC address based on a comparison of the source MAC address with the first MAC address;
• and
• generate an anomaly event based on the determination, wherein the anomaly event is indicative of the first vehicle controller masquerading as a second vehicle controller of the plurality of vehicle controllers using a second MAC address as the source MAC address, the second MAC address being associated with the second vehicle controller.