Controller area networks (CANs ) are a broadcast protocol for real-time communication of critical vehicle subsystems. Manufacturers of passenger vehicles hold secret their mappings of CAN data to vehicle signals, and these definitions vary per make, model, and year. Without these mappings, the wealth of real-time vehicle information hidden in  CAN packets is uninterpretable-- severely impeding vehicle-related research including CAN cybersecurity, after-market tuning, efficiency and performance monitoring, and fault diagnosis . Guided by the four-part CAN signal definition, we present CAN-D ( CAN Decoder ), a modular, four-step pipeline for identifying each signal's boundaries (start bit and length), endianness (byte ordering ), signedness (bit-to-integer encoding), and meaningful, physical interpretation (label, unit, scaling factors). En route to CAN-D, we provide a comprehensive review of the CAN signal reverse engineering research. All previous methods ignore endianness and signedness, rendering them simply incapable of decoding many standard CAN signal definitions. We formulate and provide an efficient solution to an optimization problem, allowing identification of the optimal set of signal boundaries and byte orderings. In addition, we provide two novel, state-of-the-art signal boundary classifiers (both superior to previous approaches in precision and recall ) and the first signedness classification algorithm , which exhibits >97 \% F-score. Overall, CAN-D is the only solution with the potential to extract any CAN signal and is the state of the art. In evaluation on ten vehicles of different makes, CAN-D's average \ell^1 error is 5 times better than all preceding methods and exhibits lower average error even when considering only signals that meet prior methods' assumptions. Finally, CAN-D is implemented in lightweight hardware allowing OBD-II plugin for real-time in-vehicle CAN decoding.%DIFDELCMD < \end{abstract} %DIFDELCMD < %%% \\%DIF > F-score. CAN-D is the only solution with the potential to extract any CAN signal. In evaluation on 10 vehicles, CAN-D's average \ell^1 error is 5x better than all previous methods and exhibits lower ave. error, even when considering only signals that meet prior methods' assumptions. CAN-D is implemented in lightweight hardware, allowing for an OBD-II plugin for real-time in-vehicle CAN decoding.
CANs are a broadcast protocol for real-time communication of critical vehicle subsystems. Original equipment manufacturers of passenger vehicles hold secret their mappings of CAN data to vehicle signals, and these definitions vary according to make, model, and year. Without these mappings, the wealth of real-time vehicle information hidden in the CAN packets is uninterpretable, impeding vehicle-related research . Guided by the 4-part CAN signal definition, we present CAN-D ( CAN-Decoder ), a modular, 4-step pipeline for identifying each signal's boundaries (start bit , length), endianness (byte order ), signedness (bit-to-integer encoding), and by leveraging diagnostic standards, augmenting a subset of the extracted signals with physical interpretation. We provide a comprehensive review of the CAN signal reverse engineering research. Previous methods ignore endianness and signedness, rendering them incapable of decoding many standard CAN signal definitions. Incorporating endianness grows the search space from 128 to 4.72E21 signal tokenizations and introduces a web of changing dependencies. We formulate, formally analyze, and provide an efficient solution to an optimization problem, allowing identification of the optimal set of signal boundaries and byte orderings. We provide two novel, state-of-the-art signal boundary classifiers-both superior to previous approaches in precision and recall in three different test scenarios-and the first signedness classification algorithm which exhibits a >97 %DIFDELCMD < \end{abstract} %DIFDELCMD < %%% \\%DIF > F-score. CAN-D is the only solution with the potential to extract any CAN signal. In evaluation on 10 vehicles, CAN-D's average \ell^1 error is 5x better than all previous methods and exhibits lower ave. error, even when considering only signals that meet prior methods' assumptions. CAN-D is implemented in lightweight hardware, allowing for an OBD-II plugin for real-time in-vehicle CAN decoding.
R
Controller area networks (CANs )
CANs
R
Manufacturers
Original equipment manufacturers
R
per
according to
A
the
R
uninterpretable-- severely
uninterpretable,
D
including CAN cybersecurity, after-market tuning, efficiency and performance monitoring, and fault diagnosis
R
four-part
4-part
R
CAN Decoder
CAN-Decoder
R
four-step
4-step
R
and
,
R
ordering
order
R
meaningful, physical interpretation (label, unit, scaling factors). En route to CAN-D, we
by leveraging diagnostic standards, augmenting a subset of the extracted signals with physical interpretation. We
R
All previous
Previous
D
simply
R
We formulate
Incorporating endianness grows the search space from 128 to 4.72E21 signal tokenizations and introduces a web of changing dependencies. We formulate, formally analyze,
R
In addition, we
We
R
classifiers (both
classifiers-both
R
) and
in three different test scenarios-and
R
, which exhibits
which exhibits a
D
\% F-score. Overall, CAN-D is the only solution with the potential to extract any CAN signal and is the state of the art. In evaluation on ten vehicles of different makes, CAN-D's average \ell^1 error is 5 times better than all preceding methods and exhibits lower average error even when considering only signals that meet prior methods' assumptions. Finally, CAN-D is implemented in lightweight hardware allowing OBD-II plugin for real-time in-vehicle CAN decoding.