Discovering CAN specification using On-Board Diagnostics

Controller area network (CAN) is a de facto standard for in-vehicle network (IVN) that provides an efficient communication channel between electronic control units (ECUs). As the external connectivity of modern vehicles increase, concerns about cyber threats to in-vehicle networks are increasing. However, since global vehicle manufacturers do not release CAN specifications, it is difficult to know which CAN ID carries which vehicle parameter data and actually affects the operation of the vehicle. To solve this problem, this research proposes a method to discover CAN specification that related to major vehicle parameters using on-board diagnostics (OBD). The proposed algorithm is designed to analyze CAN bus messages by comparing with the OBD-II diagnostic responses to identify the CAN ID and their specific data field information that contains the same vehicle parameter data as the diagnostic responses. Experimental results performed on a real vehicle manufactured by a global car manufacturer show that the proposed algorithm can find CAN information related to major vehicle parameters including engine RPM, vehicle speed and throttle position and its effectiveness in vehicle security research.