Provided herein are systems and methods for authenticating controlled area network (CAN) transmissions using physical layer characteristics. In one or more examples, a device that is configured to authenticate CAN transmissions can be connected to an existing CAN. The device can be configured to undergo a training phase in which average transition waveforms of one or more electronic control units (ECUs) are created. When the device is in operation, each CAN transmission received by the device can be compared against the average transition waveforms to determine the ECU that is most likely to have sent the transmission. In one or more examples, the identified most likely ECU can be compared against the ECU identified by an arbitration ID of the transmission. If there is a mismatch then in one or more examples the device can alert to the possibility of a suspicious ECU transmission.