/pdf/canmatch-a-fully-automated-tool-for-can-bus-reverse-jlyi7rmqnp.pdf

CANMatch: A Fully Automated Tool for CAN Bus Reverse Engineering based on Frame Matching

Modern intelligent and networked vehicles are increasingly equipped with electronic control units (ECUs) with increased computing power. These electronic devices form an in-vehicle network via the Controller Area Network (CAN) bus, the de facto standard for modern vehicles. Although many ECUs provide convenience to drivers and passengers, they also increase the potential for cyber security threats in motor vehicles. Numerous attacks on vehicles have been reported, and the commonality among these attacks is that they inject malicious messages into the CAN network. To close the security holes of CAN, original equipment manufacturers (OEMs) keep the Database CAN (DBC) file describing the content of CAN messages, confidential. This policy is ineffective against cyberattacks but limits in-depth investigation of CAN messages and hinders the development of in-vehicle intrusion detection systems (IDS) and CAN fuzz testing. Current research reverses CAN messages through tokenization, machine learning, and diagnostic information matching to obtain details of CAN messages. However, the results of these algorithms yield only a fraction of the information specified in the DBC file regarding CAN messages, such as field boundaries and message IDs associated with specific functions. In this study, we propose multiple linear regression-based frameworks for bit-level inversion of CAN messages that can approximate the inversion of DBC files. The framework builds a multiple linear regression model for vehicle behavior and CAN traffic, filters the candidate messages based on the decision coefficients, and finally locates the bits describing the vehicle behavior to obtain the data length and alignment based on the model parameters. Moreover, this work shows that the system has high reversion accuracy and outperforms existing systems in boundary delineation and filtering relevant messages in actual vehicles.

/pdf/bit-level-automotive-controller-area-network-message-reverse-21ghiqk4.pdf

Bit-Level Automotive Controller Area Network Message Reverse Framework Based on Linear Regression

: Controller Area Network (CAN) bus data is used on most vehicles today to report and communicate sensor data. However, this data is generally encoded and is not directly interpretable by simply viewing the raw data on the bus. However, it is possible to decode CAN bus data and reverse engineer the encodings by leveraging knowledge about how signals are encoded and using independently recorded ground-truth signal values for correlation. While methods exist to support the decoding of possible signals, these methods often require additional manual work to label the function of each signal. In this paper, we present CANClassify — a method that takes in raw CAN bus data, and automatically decodes and labels CAN bus signals, using a novel convolutional interpretation method to preprocess CAN messages. We evaluate CANClassify’s performance on a previously undecoded vehicle and confirm the encodings manually. We demonstrate performance comparable to the state of the art while also providing automated labeling. Examples and code are available at https://github.com/ngopaul/CANClassify .

CANClassify: Automated Decoding and Labeling of CAN Bus Signals

This study was motivated by the desire to provide highway managers/operators with more frequent and spatially dense information about the prevailing friction conditions in their networks. A new data-driven method was outlined for this purpose, wherein the prevailing tire–pavement grip potential is estimated from vehicle vibrations recorded during normal/regular usage of the infrastructure. The method was based on the underlying premise that transverse vehicle accelerations are related to wheel side-force oscillations, and therefore carry information related to the ride surface texture. It involved performing a short-time Fourier transform over vibration signals and analyzing the resulting spectral amplitudes. Two field experiments were carried out to validate the method. The first provided evidence of a statistical link between transverse vehicle vibrations and wheel side-force oscillations. The second tested the statistical link between skid resistance measured over a 26 km highway section and corresponding skid resistance estimations based on vehicle vibration data. Overall, transverse vehicle vibration characteristics were found to hold relevant information about the prevailing tire–pavement grip potential; the two were moderately inter-correlated. The newly proposed estimation method seems promising and potentially useful for pavement management applications, especially when considering the emergence of connected car technologies and the increased availability (and affordability) of in-vehicle Internet of Things devices.

Estimating the Tire–Pavement Grip Potential From Vehicle Vibrations

https://doi.org/10.1016/j.xinn.2023.100386

SparkLink: A short-range wireless communication protocol with ultra-low latency and ultra-high reliability

Controller Area Network (CAN) is a masterless serial bus designed and widely used for the exchange of mission and time-critical information within commercial vehicles. Invehicle communication is based on messages sent and received by Electronic Control Units (ECUs) connected to this serial bus network. Although unencrypted, CAN messages are not easy to interpret. In fact, Original Equipment Manufacturers (OEMs) attempt to achieve security through obscurity by encoding the data in their proprietary format, which is kept secret from the general public. As a result, the only way to obtain clear data is to reverse engineer CAN messages. Driven by the need for in-vehicle message interpretation, which is highly valuable in the automotive industry, researchers and companies have been working to make this process automated, fast, and standardized. In this paper, we provide a comprehensive review of the state of the art and summarize the major advances in CAN bus reverse engineering. We are the first to provide a taxonomy of CAN tokenization and translation techniques. Based on the reviewed literature, we highlight an important issue: the lack of a public and standardized dataset for the quantitative evaluation of translation algorithms. In response, we define a complete set of requirements for standardizing the data collection process. We also investigate the risks associated with the automation of CAN reverse engineering, in particular with respect to the security network and the safety and privacy of drivers and passengers. Finally, we discuss future research directions in CAN reverse engineering. 

Alessio Buscemi

Papers

A Survey on Controller Area Network Reverse Engineering