2019 · Conference paper
LibreCAN: Automated CAN Message Translator
LibreCAN reverse-engineers proprietary CAN message formats from traffic recorded at a vehicle's OBD-II port, without the OEM's DBC translation files. Phase 0 extracts candidate signal boundaries from bit-flip behaviour, extending the earlier READ algorithm; Phase 1 correlates extracted signals with standard OBD-II PIDs and smartphone IMU data to identify kinematic signals and estimate their scale and offset; Phase 2 filters the CAN IDs recorded while a driver performs 53 scripted body-related events to shortlist candidate IDs for each event.
Scope and limitations
Evaluated on four newer vehicles from a single OEM, using DBC files the authors obtained as ground truth and their own judgement of which CAN signals correspond to each reference signal; they call the evaluation partly subjective because the OEM was not involved. Phase 0 recovered 51.6–62.4% of DBC signals, but only 21.0–36.4% of extracted signals had correct boundaries, partly because normal driving rarely exercises high value ranges. With extracted boundaries, Phase 1 precision was 61.1–78.1% and recall 25.6–57.3%; Phase 2 cut candidates more than tenfold, with 8.5–15.0% precision. Only buses reachable through OBD-II were analysed, so signals on other buses were missed. The system reads traffic only and recovers a partial translation table, not complete DBC files, ECU logic or validated injection.
Why it fits this collection
Adds automated reverse engineering of proprietary in-vehicle CAN message formats from passive traffic and reference signals, complementing the catalog's CAN tooling and network-protocol inference research.
Publication and review details
- Venue
- ACM CCS 2019
- Status
- Conference paper
- Publication / posting date
- November 6, 2019
- Date source
- ACM's Crossref deposit gives 2019-11-06 for both print and online publication. The November 11–15 conference dates are not substituted.
- DOI
- 10.1145/3319535.3363190
Crossref records the title LibreCAN with the subtitle Automated CAN Message Translator, the six-author order and pages 2283–2300. The reviewed 18-page copy on the University of Michigan Real-Time Computing Laboratory site is an ACM-formatted author version created on 2019-09-25; it is not asserted to be identical to the proceedings PDF, which returned HTTP 403 to automated requests. The paper reports roughly 40 minutes of manual data collection (a 30-minute drive and a 10-minute event session) and 70–79 seconds of computation per vehicle; its 10-participant event-recording study received IRB approval. Data came from an ELM327 dongle, an OpenXC dongle on a Y-cable and the Torque Pro Android app, and computation used Python 3 on Ubuntu 16.04. No author code is recorded: the mdp93/LibreCAN_CCS repository at e10aea7 contains only a project README and site configuration, with no license or implementation, and no DBC ground truth or vehicle traces were found in the reviewed sources. No vehicle, trace or code was used.
Sources reviewed
Source review only; experiments were not rerun for this collection. Cite the original authors using the linked paper or BibTeX.
Primary sources
- https://dl.acm.org/doi/10.1145/3319535.3363190
- https://api.crossref.org/works/10.1145/3319535.3363190
- https://rtcl.eecs.umich.edu/rtclweb/assets/publications/2019/fv075-peseA.pdf
- README.md GitHub · mdp93/LibreCAN_CCS · Revision e10aea7