ACRE: An Advanced CAN Signal Reverse Engineering Scheme

As modern vehicles become more exposed to the outside world, many efforts have been made to enhance the security of in-vehicle Controller Area Network(CAN). These efforts are facing significant challenges, because the CAN signals that store the driving status of vehicle are encoded into specific format, thus preventing researchers from understanding its meaning. Unfortunately, the Database CAN(DBC) file that contain these encoding patterns are kept strictly confidential by the car manufacturer. Currently, many work has been conducted to reverse engineer CAN signals. However, through our experiments, these studies have shown highly inaccuracy in identifying the boundary of CAN signals. In this paper, we propose ACRE, an advanced CAN signal reverse engineering scheme based on a novel metric of adjacent-bit changing rate (ACR). With ACR, ACRE automatically segments CAN data field. Inspired by ACR, we further present Diagonal-bit Changing Rate (DCR) to determine the endianness of CAN signal, thus accomplishing signal extraction and signedness discrimination. Verified by real-world dataset and corresponding DBC, ACRE achieves 100% coverage, and its vehicle-series compatibility have been proven by extensive experiments on 4 datasets of real car.