ECUPrint - Physical Fingerprinting Electronic Control Units on CAN Buses inside Cars and SAE J1939 Compliant Vehicles [pdf]
Information related to our work, the dataset, the publication and contacts are detailed here and on the institution website.
The ECUPrint dataset is a collection of raw CAN voltage samples and CAN logs (jump to Download links). Skew and voltage data is collected from 10 vehicles, ranging from small cars to SUVs and a heavy-duty vehicle, totaling 54 ECUs. In order to enable the CAN data collection we employed two devices: a CANcaseXL and a Pico Scope 5000 Series. The voltage collection setup is shown below: the CAN bus is accessed via the OBD-II pins with the previously mentioned tools.
Voltage data
For each frame carrying a specific ID we have collected samples for an isolated dominant bit which is a transition from recessive to dominant and back (the shape of an isolated bit, along with the features we extract is shown below). We use the following voltage features: i) the mean voltage level, ii) max voltage level and iii) bit time. In addition to these metrics, which are commonly used in other works, we also note that the iv) plateau time of the bit also provides good indications on the sender ECU, so we introduce this as an additional metric.
Skew vs. voltage data fingerprints
To extract the clock skews, we use the CAN logs which contain the frame identifiers and associated timestamps. In order to perform data collection for skews we used the XL Driver Library and recorded the available CAN frames through the diagnostics port. We logged CAN traffic over periods of 5 to 10 minutes for each vehicle while it was operational. Skews provide a good separation for ECUs in the same vehicle, but there are still slight overlaps between multiple ECUs in distinct vehicles. Merging multiple features, i.e., the mean, max, bit and plateau time, makes the separation much clearer. This is visible in the two images shown below.
Skews provide a good separation for ECUs in the same vehicle as shown in the image below.
When merging multiple features, i.e., the mean, max, bit and plateau time, the overlaps almost fully disappear as the image below shows.
Dataset content The dataset is structured as described below. We provide the raw CAN voltage samples measured with the PicoScope with a sample interval of 2 nanoseconds (sample rate was set to 500 MS/s) and separate CAN logs with frames collected with a Vector CANCaseXL device. For the Honda Civic and Ford Fiesta additional datasets are available. The first datasets were collected after vehicle startup (cold engine) and other sets after 15 minutes, 30 minutes and 1 hour drive (warm engine). The datasets are available in four distinct packages:
- CAN voltages collected for 10 cars (181,874 sampled bits). Data is allocated to specific ECUs based on the analysis in our work. Note that this distribution is to the best we could ascertain based on our analysis, we do not claim this separation to be absolute. There are several IDs in folder named unclassified which were on-event and for which skews could not be computed and which are not part of our main analysis.
- CAN voltages under environmental variations (47,636 sampled bits). These datasets are for 2 of the cars that we analyze: Ford Fiesta and Honda Civic.
- All voltage as a single archive (229,510 sampled bits) which includes all data for a) and b).
- CAN logs is the data logged from the bus with the CANCaseXL. For 3 out of the 10 cars (John Deere, Ford Ecosport and Fiesta), the log file contains several IDs which were on-event and for which voltage data was not collected and are not associated to a specific ECU. More details on these are available in the paper.
Summary of devices and associated measurements
| Number | Vehicle | Model year | No. of IDs | No. of identified ECUs | No. of collected bits (voltage) | No. of collected frames (skew) |
|---|---|---|---|---|---|---|
| (i) | Honda Civic | 2012-2017 | 43 | 6 | 40,073 | 1,039,512 |
| (ii) | Opel Corsa | 2006-2014 | 29 | 4 | 9,187 | 442,992 |
| (iii) | Hyundai i20 | 2014-2020 | 40 | 7 | 17,767 | 616,296 |
| (iv) | John Deere Tractor | 2010-2018 | 33 | 3 | 4,021 | 154,779 |
| (v) | Dacia Duster | 2010-2017 | 12 | 3 | 9,086 | 247,154 |
| (vi) | Dacia Logan | 2012-2019 | 46 | 6 | 31,579 | 629,662 |
| (vii) | Hyundai ix35 | 2009-2015 | 26 | 6 | 23,104 | 847,161 |
| (viii) | Ford Fiesta | 2017-2020 | 46 | 6 | 43,861 | 2,243,359 |
| (ix) | Ford Kuga | 2013-2019 | 70 | 9 | 28,024 | 1,233,545 |
| (x) | Ford Ecosport | 2018-2021 | 87 | 4 | 22,808 | 759,421 |
| Total | - | - | 432 | 54 | 229,510 | 8,213,881 |
Numerical data for skews and voltage features determined in our work together with ID classification per ECUs for each vehicle based on the features are presented in the supplemental material.
| File | Download | Notes |
|---|---|---|
| [ECUPrint] CAN voltage samples with ECU allocation.zip | link1 (University website) link2 (OneDrive) |
ECUPrint CAN voltage samples, allocated per ECU |
| [ECUPrint] CAN voltage samples under environmental variations.zip | link1 (University website) link2 (OneDrive) |
ECUPrint CAN voltage samples collected under environmental variations |
| [ECUPrint] CAN voltage samples (full).zip | link1 (University website) link2 (OneDrive) |
ECUPrint complete voltage samples (contains voltage samples from previous two archives) |
| [ECUPrint] CAN logs.zip | link1 (University website) link2 (OneDrive) |
ECUPrint CAN logs |
CAN logs
|
|------ Dacia Duster
|
|------ Dacia Logan
|
|------ Ford Ecosport
|
|------ Ford Fiesta
|
|------ Ford Kuga
|
|------ Honda Civic
|
|------ Hyundai i20
|
|------ Hyundai ix35
|
|------ John Deere Tractor
|
|------ Opel Corsa
CAN voltage samples with ECU allocation
|
|------ Dacia Duster
| |------ ECU1
| |------ ECU2
| |------ ECU3
|
|------ Dacia Logan
| |------ ECU1
| |------ ECU2
| |------ ECU3
| |------ ECU4
| |------ ECU5
| |------ ECU6
|
|------ Ford Ecosport
| |------ ECU1
| |------ ECU2
| |------ ECU3
| |------ ECU4
| |------ Unclassified
|
|------ Ford Fiesta
| |------ 1_0min (car start)
| |------ ECU1
| |------ ECU2
| |------ ECU3
| |------ ECU4
| |------ ECU5
| |------ ECU6
| |------ Unclassified
| |------ 2_10min (10 minutes after car start)
| |------ ECU1
| |------ ECU2
| |------ ECU3
| |------ ECU4
| |------ ECU5
| |------ ECU6
| |------ Unclassified
|
|------ Ford Kuga
| |------ ECU1
| |------ ECU2
| |------ ECU3
| |------ ECU4
| |------ ECU5
| |------ ECU6
| |------ ECU7
| |------ ECU8
| |------ ECU9
|
|------ Honda Civic
| |------ ECU1
| |------ ECU2
| |------ ECU3
| |------ ECU4
| |------ ECU5
| |------ ECU6
|
|------ Hyundai i20
| |------ ECU1
| |------ ECU2
| |------ ECU3
| |------ ECU4
| |------ ECU5
| |------ ECU6
| |------ ECU7
|
|------ Hyundai ix35
| |------ ECU1
| |------ ECU2
| |------ ECU3
| |------ ECU4
| |------ ECU5
| |------ ECU6
|
|------ John Deere Tractor
| |------ ECU1
| |------ ECU2
| |------ ECU3
| |------ Unclassified
|
|------ Opel Corsa
| |------ ECU1
| |------ ECU2
| |------ ECU3
| |------ ECU4
CAN voltage samples under environmental variations
|
|------ Ford Fiesta
| |------ 1_30min (30 minutes after car start)
| |------ ECU1
| |------ ECU2
| |------ ECU3
| |------ ECU4
| |------ ECU5
| |------ ECU6
| |------ Unclassified
| |------ 2_60min (60 minutes after car start)
| |------ ECU1
| |------ ECU2
| |------ ECU3
| |------ ECU4
| |------ ECU5
| |------ ECU6
| |------ Unclassified
|------ Honda Civic
| |------ 1_10min_static (10 minutes after car start, stationary car)
| |------ ECU1
| |------ ECU2
| |------ ECU3
| |------ ECU4
| |------ ECU5
| |------ ECU6
| |------ 2_30min_static (30 minutes after car start, stationary car)
| |------ ECU1
| |------ ECU2
| |------ ECU3
| |------ ECU4
| |------ ECU5
| |------ ECU6
| |------ 3_60min_static (60 minutes after car start, stationary car)
| |------ ECU1
| |------ ECU2
| |------ ECU3
| |------ ECU4
| |------ ECU5
| |------ ECU6
| |------ 4_10min_dynamic (10 minutes after car start, moving car)
| |------ ECU1
| |------ ECU2
| |------ ECU3
| |------ ECU4
| |------ ECU5
| |------ ECU6
| |------ 5_30min_dynamic (30 minutes after car start, moving car)
| |------ ECU1
| |------ ECU2
| |------ ECU3
| |------ ECU4
| |------ ECU5
| |------ ECU6
| |------ 6_60min_dynamic (60 minutes after car start, moving car)
| |------ ECU1
| |------ ECU2
| |------ ECU3
| |------ ECU4
| |------ ECU5
| |------ ECU6
CAN voltage samples (full)
|
|------ Dacia Duster
|
|------ Dacia Logan
|
|------ Ford Ecosport
|
|------ Ford Fiesta
| |------ 1_0min (car start)
| |------ 2_10min (10 minutes after car start)
| |------ ENVIRONMENTAL_1_30min (30 minutes after car start)
| |------ ENVIRONMENTAL_2_60min (60 minutes after car start)
|
|------ Ford Kuga
|
|------ Honda Civic
| |------ 1_0min (car start)
| |------ ENVIRONMENTAL_1_10min_static (10 minutes after car start, stationary car)
| |------ ENVIRONMENTAL_2_30min_static (30 minutes after car start, stationary car)
| |------ ENVIRONMENTAL_3_60min_static (60 minutes after car start, stationary car)
| |------ ENVIRONMENTAL_4_10min_dynamic (10 minutes after car start, moving car)
| |------ ENVIRONMENTAL_5_30min_dynamic (30 minutes after car start, moving car)
| |------ ENVIRONMENTAL_6_60min_dynamic (60 minutes after car start, moving car)
|
|------ Hyundai i20
|
|------ Hyundai ix35
|
|------ John Deere Tractor
|
|------ Opel Corsa
CAN logs are stored in txt format and have data structured based on the XL driver library output from Vector (see documents from Vector XL webpage for more details).
Voltage data is stored in csv format and have some metadata included before the raw voltage samples. Every file name contains a series of artifacts:
[001]_0FD_extracted_extracted_ZERO_[0].csv includes
[001] as frame number ,
0FD as frame identifier (hexadecimal) ,
ZERO which means it is an isolated dominant bit ,
[0] that number of isolated dominant bit from specified frame
The metadata contains the following information in the first rows from each csv file:
[ID (hexadecimal)],
[ID (decimal)],
[DLC (decimal)],
[Timestamp, Channel A (CANH), Channel B (CANL)],
[Measurement unit],
The metadata is followed by the actual raw voltage samples:
[Voltage data (2000 samples/file for cars and 2700 samples/file for the John Deere tractor)].
Feel free to use our dataset for research purposes by giving credit to our paper below.
L. Popa, B. Groza, C. Jichici and P-S. Murvay, "ECUPrint—Physical Fingerprinting Electronic Control Units on CAN Buses Inside Cars and SAE J1939 Compliant Vehicles." IEEE Transactions on Information Forensics and Security 17 (2022): 1185-1200. pdf
@article{popa2022ecuprint,
title={ECUPrint—Physical Fingerprinting Electronic Control Units on CAN Buses Inside Cars and SAE J1939 Compliant Vehicles},
author={Popa, Lucian and Groza, Bogdan and Jichici, Camil and Murvay, Pal-Stefan},
journal={IEEE Transactions on Information Forensics and Security},
volume={17},
pages={1185--1200},
year={2022},
publisher={IEEE}
}
- lucian.popa [at] aut.upt.ro
- bogdan.groza [at] aut.upt.ro