Controller area networks (CANs) are a broadcast protocol for real-time communication of critical vehicle subsystems. Manufacturers of passenger vehicles hold secret their mappings of CAN data to vehicle signals, and these definitions vary per make, model, and year. Without these mappings, the wealth of real-time vehicle information hidden in CAN packets is uninterpretable-- severely impeding vehicle-related research including CAN cybersecurity, after-market tuning, efficiency and performance monitoring, and fault diagnosis. Guided by the four-part CAN signal definition, we present CAN-D (CAN Decoder), a modular, four-step pipeline for identifying each signal's boundaries (start bit and length), endianness (byte ordering), signedness (bit-to-integer encoding), and meaningful, physical interpretation (label, unit, scaling factors). En route to CAN-D, we provide a comprehensive review of the CAN signal reverse engineering research. All previous methods ignore endianness and signedness, rendering them simply incapable of decoding many standard CAN signal definitions. We formulate and provide an efficient solution to an optimization problem, allowing identification of the optimal set of signal boundaries and byte orderings. In addition, we provide two novel, state-of-the-art signal boundary classifiers (both superior to previous approaches in precision and recall) and the first signedness classification algorithm, which exhibits > 97% F-score. Overall, CAN-D is the only solution with the potential to extract any CAN signal and is the state of the art. In evaluation on ten vehicles of different makes, CAN-D's average $\ell^1$ error is 5 times better than all preceding methods and exhibits lower average error even when considering only signals that meet prior methods' assumptions. Finally, CAN-D is implemented in lightweight hardware allowing OBD-II plugin for real-time in-vehicle CAN decoding.

中文翻译：

---

CAN-D：用于全面解码控制器局域网数据的模块化四步流水线

控制器局域网 (CAN) 是一种用于关键车辆子系统实时通信的广播协议。乘用车制造商对其 CAN 数据到车辆信号的映射保密，这些定义因品牌、型号和年份而异。如果没有这些映射，隐藏在 CAN 数据包中的大量实时车辆信息将无法解释——严重阻碍了与车辆相关的研究，包括 CAN 网络安全、售后调整、效率和性能监控以及故障诊断。在四部分 CAN 信号定义的指导下，我们提出了 CAN-D（CAN 解码器），这是一种模块化的四步流水线，用于识别每个信号的边界（起始位和长度）、字节序（字节顺序）、符号性（位到-整数编码）和有意义的物理解释（标签、单位、缩放因子）。在通往 CAN-D 的途中，我们全面回顾了 CAN 信号逆向工程研究。所有以前的方法都忽略了字节序和符号性，使它们根本无法解码许多标准的 CAN 信号定义。我们制定并提供优化问题的有效解决方案，允许识别信号边界和字节顺序的最佳集合。此外，我们提供了两个新颖的、最先进的信号边界分类器（在精度和召回率方面均优于以前的方法）和第一个符号分类算法，其 F-score > 97%。总的来说，CAN-D 是唯一有可能提取任何 CAN 信号的解决方案，并且是最先进的。在对十辆不同品牌的车辆进行评估时，CAN-D' s 平均 $\ell^1$ 误差比所有先前的方法好 5 倍，即使仅考虑满足先前方法假设的信号，也表现出较低的平均误差。最后，CAN-D 在轻量级硬件中实现，允许 OBD-II 插件用于实时车载 CAN 解码。