Techniques for using a detector coupled to a controller area network (CAN) bus of a vehicle system to identify and generate alerts in response to wake-up attacks on the vehicle system. Techniques include an electronic control unit (ECU) sending a wake-up message across the CAN bus that is detected by the detector. The detector includes memory and a processor to identify the timestamp of the wake-up message when the vehicle ignition is off. The detector determines a total operational time for the ECU over an observation time period and generates a notification of a wake-up anomaly when the total operational time over the observation time period exceeds a predetermined threshold.