# A Method for Translating Automotive Body-Related CAN Messages Based on Labeled Bits
###### Abstract  
Traditional mechanical parts have been increasingly replaced by in-vehicle electronic control units (ECUs) that communicate via control area networks (CAN). For security reasons, the Database CAN (DBC) file, which defines the contents of CAN messages, is deemed confidential by original equipment manufacturers (OEMs). However, confidentiality has severely hindered research on automotive intrusion detection systems (IDS) and automotive control network testing, which makes automotive aftermarket device development difficult. Previous research has used tokenization algorithms, machine learning algorithms, and diagnostic information to obtain coarse CAN message contents. However, there is a large gap between the results obtained with these methods and the information contained in DBC files. In order to reverse CAN messages in a fine-grained manner, we propose a method to reverse a body-related CAN message based on tagged bits. This method tags data bits by collecting CAN traffic in different vehicle states. The test messages are obtained by fuzzing the CAN messages based on the tagging results, and the candidate messages are obtained by combining them with the results of a packet analysis. The final reverse result was based on the column AND bit-by-bit of the candidate messages. The reverse results showed that the method proposed in this paper could accurately locate the bits representing or controlling the body behavior with high reverse accuracy. electronic control units; controller area network; database CAN; reverse; fuzzing; AND bit-by-bit +
Footnote †: journal:  
To prevent the malicious control of ECUs on the CAN network, original equipment manufacturers (OEMs) attempt to hide the database CAN (DBC) [5] files that describe CAN message definitions to prevent attackers from sending malicious control commands to the CAN network. Although this measure can increase the cost of attacks to some extent, it hinders the development of the automotive security research field and the automotive aftermarket. Most affected is research on intrusion detection systems for CAN networks. The proposed CAN intrusion detection techniques are based on the use of message transfer characteristics to detect anomalies and are practically independent of the behavior and state of the vehicle [6; 7; 8; 9], which leads to limitations in the efficiency of existing solutions. In addition, security researchers usually use fuzzy test automation to test the security of communication protocols [2; 10]. However, the lack of DBC files defining the CAN message format leads to inefficient and blind fuzzy tests against the CAN bus [11; 12; 13]. Moreover, the privatization of DBC files leads to ineffective access to vehicle status data for devices in the automotive aftermarket, which renders automotive driver assistance devices and status display tools meaningless. In order to obtain a more effective basis for CAN bus intrusion detection and fuzz testing, research in the security field is also trying to obtain a clear definition of CAN messages. Initial research focused on the tagging of CAN message data types, mainly through FBCA [14], READ [15], and LibreCAN [16], which were limited to the classification of data according to its variability. Such methods cannot obtain vehicle-specific data. Later research attempted to identify vehicle behavior in CAN traces using machine learning algorithms [17; 18], the efficiency of which depends on the coverage of the training data set. However, the application of these methods is limited by the fact that each vehicle has a unique CAN message definition. Some other researchers have tried to obtain a description of the vehicle state with CAN messages through the Unified Diagnostic Services (UDS) protocol [19; 20]. However, these studies relied on vehicle state data supported by the UDS protocol, causing the final results to have limitations. In recent work, we used cheap sensor devices to accurately obtain the bits describing vehicle driving data in CAN messages [21].