Disclosed embodiments relate to identifying Electronic Control Unit (ECU) anomalies in a vehicle. Operations may include monitoring, in the vehicle, data representing real-time processing activity of the ECU; accessing, in the vehicle, historical data relating to processing activity of the ECU, the historical data representing expected processing activity of the ECU; comparing, in the vehicle, the real-time processing activity data with the historical data, to identify at least one anomaly in the real-time processing activity of the ECU; and implementing a control action for the ECU when the at least one anomaly is identified.