ECUPrint (Datasets)
Physical Fingerprinting Electronic Control Units on CAN Buses inside Cars and SAE J1939 Compliant Vehicles [pdf]
Abstract: We fingerprint 54 ECUs from 10 cars, one of which is a heavy-duty vehicle compliant to the SAE J1939 standard. These later specifications implemented in commercial vehicles offer concrete sender addresses in every CAN frame, making physical characteristics easier to link to specific ECUs. This is not the case for traffic collected inside passenger cars where the allocation of CAN bus identifiers is non-uniform, without explicit sender and receiver addresses, making ECU identification more challenging. While previous research has shown good separation between ECUs even when single features are used, e.g., skews or maximum voltage level, prior results are based on a small number of cars, while our larger experimental basis proves that single features are likely insufficient to separate between a large number of ECUs. Concretely, for a crisp separation, at least four features seem to be needed, i.e., mean voltage, max voltage, bit time and plateau time, while clock skews or any single voltage feature lead to overlaps. We provide clear experimental bounds on the intra and inter-distances of skews and voltage features, not neglecting environmental variations which may occur when the car is running.
1. Concept
Skew and voltage data is collected from 10 vehicles, ranging from small cars to SUVs and a heavy-duty vehicle, totaling 54 ECUs. In order to enable the CAN data collection we employed two devices: a CANcaseXL and a Pico Scope 5000 Series. The voltage collection setup is shown below: the CAN bus is accessed via the OBD-II pins with the previously mentioned tools.
Voltage data
For each frame carrying a specific ID we have collected samples for an isolated dominant bit which is a transition from recessive to dominant and back (the shape of an isolated bit, along with the features we extract is shown below). We use the following voltage features: i) the mean voltage level, ii) max voltage level and iii) bit time. In addition to these metrics, which are commonly used in other works, we also note that the iv) plateau time of the bit also provides good indications on the sender ECU, so we introduce this as an additional metric.
Skew vs. voltage data fingerprints
To extract the clock skews, we use the CAN logs which contain the frame identifiers and associated timestamps. In order to perform data collection for skews we used the XL Driver Library and recorded the available CAN frames through the diagnostics port. We logged CAN traffic over periods of 5 to 10 minutes for each vehicle while it was operational.
Skews provide a good separation for ECUs in the same vehicle, but there are still slight overlaps between multiple ECUs in distinct vehicles. Merging multiple features, i.e., the mean, max, bit and plateau time, makes the separation much clearer. This is visible in the two images shown below.
Skew-based separation
Voltage-based separation
2. Dataset
Dataset content
The dataset is structured as described below. We provide the raw CAN voltage samples measured with the PicoScope with a sample interval of 2 nanoseconds (sample rate was set to 500 MS/s) and separate CAN logs with frames collected with a Vector CANCaseXL device. For the Honda Civic and Ford Fiesta additional datasets are available. The first datasets were collected after vehicle startup (cold engine) and other sets after 15 minutes, 30 minutes and 1 hour drive (warm engine). The datasets are available in four distinct packages:
a) CAN voltages collected for 10 cars (181,874 sampled bits). Data is allocated to specific ECUs based on the analysis in our work. Note that this distribution is to the best we could ascertain based on our analysis, we do not claim this separation to be absolute. There are several IDs in folder named unclassified which were on-event and for which skews could not be computed and which are not part of our main analysis.
b) CAN voltages under environmental variations (47,636 sampled bits). These datasets are for 2 of the cars that we analyze: Ford Fiesta and Honda Civic.
c) All voltage as a single archive (229,510 sampled bits) which includes all data for a) and b).
d) CAN logs is the data logged from the bus with the CANCaseXL. For 3 out of the 10 cars (John Deere, Ford Ecosport and Fiesta), the log file contains several IDs which were on-event and for which voltage data was not collected and are not associated to a specific ECU. More details on these are available in the paper.
Summary of devices and associated measurements
Number |
Vehicle |
Model year |
No. of IDs |
No. of identified ECUs |
No. of collected bits (voltage) |
No. of collected frames (skew) |
| (i) | Honda Civic | 2012-2017 | 43 | 6 | 40,073 | 1,039,512 |
| (ii) | Opel Corsa | 2006-2014 | 29 | 4 | 9,187 | 442,992 |
| (iii) | Hyundai i20 | 2014-2020 | 40 | 7 | 17,767 | 616,296 |
| (iv) | John Deere Tractor | 2010-2018 | 33 | 3 | 4,021 | 154,779 |
| (v) | Dacia Duster | 2010-2017 | 12 | 3 | 9,086 | 247,154 |
| (vi) | Dacia Logan | 2012-2019 | 46 | 6 | 31,579 | 629,662 |
| (vii) | Hyundai ix35 | 2009-2015 | 26 | 6 | 23,104 | 847,161 |
| (viii) | Ford Fiesta | 2017-2020 | 46 | 6 | 43,861 | 2,243,359 |
| (ix) | Ford Kuga | 2013-2019 | 70 | 9 | 28,024 | 1,233,545 |
| (x) | Ford Ecosport | 2018-2021 | 87 | 4 | 22,808 | 759,421 |
| Total | - | - | 432 | 54 | 229,510 | 8,213,881 |
Numerical data for skews and voltage features determined in our work together with ID classification per ECUs for each vehicle based on the features are presented in the supplemental material.
Data links
| [ECUPrint] CAN voltage samples with ECU allocation.zip |
| [ECUPrint] CAN voltage samples under environmental variations.zip |
| [ECUPrint] CAN voltage samples (full).zip |
| [ECUPrint] CAN logs.zip |
Folder structure
CAN voltage samples with ECU allocation
|
|------ Dacia Duster
| |------ ECU1
| |------ ECU2
| |------ ECU3
|
|------ Dacia Logan
| |------ ECU1
| |------ ECU2
| |------ ECU3
| |------ ECU4
| |------ ECU5
| |------ ECU6
|
|------ Ford Ecosport
| |------ ECU1
| |------ ECU2
| |------ ECU3
| |------ ECU4
| |------ Unclassified
|
|------ Ford Fiesta
| |------ 1_0min (car start)
| |------ ECU1
| |------ ECU2
| |------ ECU3
| |------ ECU4
| |------ ECU5
| |------ ECU6
| |------ Unclassified
| |------ 2_10min (10 minutes after car start)
| |------ ECU1
| |------ ECU2
| |------ ECU3
| |------ ECU4
| |------ ECU5
| |------ ECU6
| |------ Unclassified
|
|------ Ford Kuga
| |------ ECU1
| |------ ECU2
| |------ ECU3
| |------ ECU4
| |------ ECU5
| |------ ECU6
| |------ ECU7
| |------ ECU8
| |------ ECU9
|
|------ Honda Civic
| |------ ECU1
| |------ ECU2
| |------ ECU3
| |------ ECU4
| |------ ECU5
| |------ ECU6
|
|------ Hyundai i20
| |------ ECU1
| |------ ECU2
| |------ ECU3
| |------ ECU4
| |------ ECU5
| |------ ECU6
| |------ ECU7
|
|------ Hyundai ix35
| |------ ECU1
| |------ ECU2
| |------ ECU3
| |------ ECU4
| |------ ECU5
| |------ ECU6
|
|------ John Deere Tractor
| |------ ECU1
| |------ ECU2
| |------ ECU3
| |------ Unclassified
|
|------ Opel Corsa
| |------ ECU1
| |------ ECU2
| |------ ECU3
| |------ ECU4
CAN voltage samples under environmental variations
|
|------ Ford Fiesta
| |------ 1_30min (30 minutes after car start)
| |------ ECU1
| |------ ECU2
| |------ ECU3
| |------ ECU4
| |------ ECU5
| |------ ECU6
| |------ Unclassified
| |------ 2_60min (60 minutes after car start)
| |------ ECU1
| |------ ECU2
| |------ ECU3
| |------ ECU4
| |------ ECU5
| |------ ECU6
| |------ Unclassified
|------ Honda Civic
| |------ 1_10min_static (10 minutes after car start, stationary car)
| |------ ECU1
| |------ ECU2
| |------ ECU3
| |------ ECU4
| |------ ECU5
| |------ ECU6
| |------ 2_30min_static (30 minutes after car start, stationary car)
| |------ ECU1
| |------ ECU2
| |------ ECU3
| |------ ECU4
| |------ ECU5
| |------ ECU6
| |------ 3_60min_static (60 minutes after car start, stationary car)
| |------ ECU1
| |------ ECU2
| |------ ECU3
| |------ ECU4
| |------ ECU5
| |------ ECU6
| |------ 4_10min_dynamic (10 minutes after car start, moving car)
| |------ ECU1
| |------ ECU2
| |------ ECU3
| |------ ECU4
| |------ ECU5
| |------ ECU6
| |------ 5_30min_dynamic (30 minutes after car start, moving car)
| |------ ECU1
| |------ ECU2
| |------ ECU3
| |------ ECU4
| |------ ECU5
| |------ ECU6
| |------ 6_60min_dynamic (60 minutes after car start, moving car)
| |------ ECU1
| |------ ECU2
| |------ ECU3
| |------ ECU4
| |------ ECU5
| |------ ECU6
CAN voltage samples (full)
|
|------ Dacia Duster
|
|------ Dacia Logan
|
|------ Ford Ecosport
|
|------ Ford Fiesta
| |------ 1_0min (car start)
| |------ 2_10min (10 minutes after car start)
| |------ ENVIRONMENTAL_1_30min (30 minutes after car start)
| |------ ENVIRONMENTAL_2_60min (60 minutes after car start)
|
|------ Ford Kuga
|
|------ Honda Civic
| |------ 1_0min (car start)
| |------ ENVIRONMENTAL_1_10min_static (10 minutes after car start, stationary car)
| |------ ENVIRONMENTAL_2_30min_static (30 minutes after car start, stationary car)
| |------ ENVIRONMENTAL_3_60min_static (60 minutes after car start, stationary car)
| |------ ENVIRONMENTAL_4_10min_dynamic (10 minutes after car start, moving car)
| |------ ENVIRONMENTAL_5_30min_dynamic (30 minutes after car start, moving car)
| |------ ENVIRONMENTAL_6_60min_dynamic (60 minutes after car start, moving car)
|
|------ Hyundai i20
|
|------ Hyundai ix35
|
|------ John Deere Tractor
|
|------ Opel Corsa
CAN logs
|
|------ Dacia Duster
|
|------ Dacia Logan
|
|------ Ford Ecosport
|
|------ Ford Fiesta
|
|------ Ford Kuga
|
|------ Honda Civic
|
|------ Hyundai i20
|
|------ Hyundai ix35
|
|------ John Deere Tractor
|
|------ Opel Corsa
File structure
CAN logs are stored in txt format and have data structured based on the XL driver library output from Vector (see documents from Vector XL Webpage for more details).
Voltage data is stored in csv format and have some metadata included before the raw voltage samples. The metadata contains the following information in the first rows from each file:
[ID (hexadecimal)],
[ID (decimal)],
[DLC (decimal)],
[Timestamp, Channel A (CANH), Channel B (CANL)],
[Measurement unit],
The metadata is followed by the actual raw voltage samples:
[Voltage data (2000 samples/file for cars and 2700 samples/file for the John Deere tractor)].
Feel free to use our dataset for research purposes by giving credit to our paper below.
3. Publication
L. Popa, B. Groza, C. Jichici and P-S. Murvay, "ECUPrint - Physical Fingerprinting Electronic Control Units on CAN Buses inside Cars and SAE J1939 Compliant Vehicles", IEEE Transactions on Information Forensics & Security, accepted 2022. [pdf]
@article{Popa22ECUPrint,
title={ECUPrint - Physical Fingerprinting Electronic Control Units on CAN Buses inside Cars and SAE J1939 Compliant Vehicles},
author={Popa, Lucian and Groza, Bogdan and Jichici, Camil and Murvay, Pal-Stefan},
journal={IEEE Transactions on Information Forensics & Security},
year={2022},
publisher={IEEE}
}
4. Contact
For any questions about our work and dataset, don't hesitate to contact us:
lucian.popa [at] aut.upt.ro
bogdan.groza [at] aut.upt.ro