READ: Reverse Engineering of Automotive Data Frames

Abstract

Security analytics and forensics applied to in-vehicle networks are growing research areas that gained relevance after recent reports of cyber-attacks against unmodified licensed vehicles. However, the application of security analytics algorithms and tools to the automotive domain is hindered by the lack of public specifications about proprietary data exchanged over in-vehicle networks. Since the controller area network (CAN) bus is the de-facto standard for the interconnection of automotive electronic control units, the lack of public specifications for CAN messages is a key issue. This paper strives to solve this problem by proposing READ: a novel algorithm for the automatic Reverse Engineering of Automotive Data frames. READ has been designed to analyze traffic traces containing unknown CAN bus messages in order to automatically identify and label different types of signals encoded in the payload of their data frames. Experimental results based on CAN traffic gathered from a licensed unmodified vehicle and validated against its complete formal specifications demonstrate that the proposed algorithm can extract and classify more than twice the signals with respect to the previous related work. Moreover, the execution time of signal extraction and classification is reduced by two orders of magnitude. Applications of READ to CAN messages generated by real vehicles demonstrate its usefulness in the analysis of CAN traffic.

ACTT: Automotive CAN Tokenization and Translation

“…However, visual inspection of the token plot (bottom) show values vacillating between the 4-bit minimum (2 0 = 0) and maximum (2 3−1 = 15) over a regular period, revealing that it is a Counter Token. The characteristics of Counter Tokens, as well as Checksum Tokens, are described in [13] and are apparently added to prevent particular types of attacks in safety-critical messages (e.g., injections or replay attacks). We note that many of our unmatched tokens may correspond to these Counter or Checksum Tokens.…”

Reversely Discovering and Modifying Properties Based on Active Deep Q-Learning

“…We categorized some typical related works about reverse engineering as below [8][9][10] [ [20][21][22] Multiplayer online game [11] Logic analysis [12][13][14] Semi-automatic tools, including Ollydbg, Windbg, and Cheat Engine, are mature enough for reverse engineering.…”

“…They defined 3 data types of data segment, then designed several data segment byte feature extraction methods to construct feature sequences, and finally presented a deep learning-based approach with feature sequences as input to recognize the data type byte by byte. M. Marchetti [22] proposed a method for the automatic Reverse Engineering of Automotive Data frames. It has been designed to analyze traffic traces containing unknown CAN (controller area network) bus messages in order to automatically identify and label different types of data.…”

A Multiple Rényi Entropy Based Intrusion Detection System for Connected Vehicles

“…Automotive systems based on CAN bus are already in common use, but no security considerations against hacking have been made since the design of the protocol. Since 2010, many instances of car hacking through the on-board diagnostics II (OBD-II) port for in-vehicle diagnosis and the infotainment system have been reported [ 1 , 2 , 3 , 4 , 5 , 6 , 7 , 8 ]. Thus, security measures for modern cars against hacking threats also have been actively researched [ 7 , 9 , 10 ].…”