lucianpopalp / ecuprint

Repository with details for a ECUPrint dataset (CAN logs and CAN voltage samples)

ECUPrint - Physical Fingerprinting Electronic Control Units on CAN Buses inside Cars and SAE J1939 Compliant Vehicles [pdf]

Information related to our work, the dataset, the publication and contacts are detailed here and on the institution website.

ECUPrint Dataset

The ECUPrint dataset is a collection of raw CAN voltage samples and CAN logs (jump to Download links). Skew and voltage data is collected from 10 vehicles, ranging from small cars to SUVs and a heavy-duty vehicle, totaling 54 ECUs. In order to enable the CAN data collection we employed two devices: a CANcaseXL and a Pico Scope 5000 Series. The voltage collection setup is shown below: the CAN bus is accessed via the OBD-II pins with the previously mentioned tools.

Concept

Voltage data

For each frame carrying a specific ID we have collected samples for an isolated dominant bit which is a transition from recessive to dominant and back (the shape of an isolated bit, along with the features we extract is shown below). We use the following voltage features: i) the mean voltage level, ii) max voltage level and iii) bit time. In addition to these metrics, which are commonly used in other works, we also note that the iv) plateau time of the bit also provides good indications on the sender ECU, so we introduce this as an additional metric.

Skew vs. voltage data fingerprints

To extract the clock skews, we use the CAN logs which contain the frame identifiers and associated timestamps. In order to perform data collection for skews we used the XL Driver Library and recorded the available CAN frames through the diagnostics port. We logged CAN traffic over periods of 5 to 10 minutes for each vehicle while it was operational. Skews provide a good separation for ECUs in the same vehicle, but there are still slight overlaps between multiple ECUs in distinct vehicles. Merging multiple features, i.e., the mean, max, bit and plateau time, makes the separation much clearer. This is visible in the two images shown below.

Skews provide a good separation for ECUs in the same vehicle as shown in the image below.

When merging multiple features, i.e., the mean, max, bit and plateau time, the overlaps almost fully disappear as the image below shows.

Dataset

Dataset content The dataset is structured as described below. We provide the raw CAN voltage samples measured with the PicoScope with a sample interval of 2 nanoseconds (sample rate was set to 500 MS/s) and separate CAN logs with frames collected with a Vector CANCaseXL device. For the Honda Civic and Ford Fiesta additional datasets are available. The first datasets were collected after vehicle startup (cold engine) and other sets after 15 minutes, 30 minutes and 1 hour drive (warm engine). The datasets are available in four distinct packages:

1. CAN voltages collected for 10 cars (181,874 sampled bits). Data is allocated to specific ECUs based on the analysis in our work. Note that this distribution is to the best we could ascertain based on our analysis, we do not claim this separation to be absolute. There are several IDs in folder named unclassified which were on-event and for which skews could not be computed and which are not part of our main analysis.
2. CAN voltages under environmental variations (47,636 sampled bits). These datasets are for 2 of the cars that we analyze: Ford Fiesta and Honda Civic.
3. All voltage as a single archive (229,510 sampled bits) which includes all data for a) and b).
4. CAN logs is the data logged from the bus with the CANCaseXL. For 3 out of the 10 cars (John Deere, Ford Ecosport and Fiesta), the log file contains several IDs which were on-event and for which voltage data was not collected and are not associated to a specific ECU. More details on these are available in the paper.

Summary of devices and associated measurements

Number	Vehicle	Model year	No. of IDs	No. of identified ECUs	No. of collected bits (voltage)	No. of collected frames (skew)
(i)	Honda Civic	2012-2017	43	6	40,073	1,039,512
(ii)	Opel Corsa	2006-2014	29	4	9,187	442,992
(iii)	Hyundai i20	2014-2020	40	7	17,767	616,296
(iv)	John Deere Tractor	2010-2018	33	3	4,021	154,779
(v)	Dacia Duster	2010-2017	12	3	9,086	247,154
(vi)	Dacia Logan	2012-2019	46	6	31,579	629,662
(vii)	Hyundai ix35	2009-2015	26	6	23,104	847,161
(viii)	Ford Fiesta	2017-2020	46	6	43,861	2,243,359
(ix)	Ford Kuga	2013-2019	70	9	28,024	1,233,545
(x)	Ford Ecosport	2018-2021	87	4	22,808	759,421
Total	-	-	432	54	229,510	8,213,881

Numerical data for skews and voltage features determined in our work together with ID classification per ECUs for each vehicle based on the features are presented in the supplemental material.

Data links

File	Download	Notes
[ECUPrint] CAN voltage samples with ECU allocation.zip	link1 (University website) link2 (OneDrive)	ECUPrint CAN voltage samples, allocated per ECU
[ECUPrint] CAN voltage samples under environmental variations.zip	link1 (University website) link2 (OneDrive)	ECUPrint CAN voltage samples collected under environmental variations
[ECUPrint] CAN voltage samples (full).zip	link1 (University website) link2 (OneDrive)	ECUPrint complete voltage samples (contains voltage samples from previous two archives)
[ECUPrint] CAN logs.zip	link1 (University website) link2 (OneDrive)	ECUPrint CAN logs

Folder structure

CAN logs
|
|------ Dacia Duster
|
|------ Dacia Logan
|
|------ Ford Ecosport
|
|------ Ford Fiesta
|
|------ Ford Kuga
|
|------ Honda Civic
|
|------ Hyundai i20
|
|------ Hyundai ix35
|
|------ John Deere Tractor
|
|------ Opel Corsa

CAN voltage samples with ECU allocation
|
|------ Dacia Duster
|          |------ ECU1
|          |------ ECU2
|          |------ ECU3
|
|------ Dacia Logan
|          |------ ECU1
|          |------ ECU2
|          |------ ECU3
|          |------ ECU4
|          |------ ECU5
|          |------ ECU6
|
|------ Ford Ecosport
|          |------ ECU1
|          |------ ECU2
|          |------ ECU3
|          |------ ECU4
|          |------ Unclassified
|
|------ Ford Fiesta
|          |------ 1_0min (car start)
|                    |------ ECU1
|                    |------ ECU2
|                    |------ ECU3
|                    |------ ECU4
|                    |------ ECU5
|                    |------ ECU6
|                    |------ Unclassified
|          |------ 2_10min (10 minutes after car start)
|                    |------ ECU1
|                    |------ ECU2
|                    |------ ECU3
|                    |------ ECU4
|                    |------ ECU5
|                    |------ ECU6
|                    |------ Unclassified
|
|------ Ford Kuga
|          |------ ECU1
|          |------ ECU2
|          |------ ECU3
|          |------ ECU4
|          |------ ECU5
|          |------ ECU6
|          |------ ECU7
|          |------ ECU8
|          |------ ECU9
|
|------ Honda Civic
|          |------ ECU1
|          |------ ECU2
|          |------ ECU3
|          |------ ECU4
|          |------ ECU5
|          |------ ECU6
|
|------ Hyundai i20
|          |------ ECU1
|          |------ ECU2
|          |------ ECU3
|          |------ ECU4
|          |------ ECU5
|          |------ ECU6
|          |------ ECU7
|
|------ Hyundai ix35
|          |------ ECU1
|          |------ ECU2
|          |------ ECU3
|          |------ ECU4
|          |------ ECU5
|          |------ ECU6
|
|------ John Deere Tractor
|          |------ ECU1
|          |------ ECU2
|          |------ ECU3
|          |------ Unclassified
|
|------ Opel Corsa
|          |------ ECU1
|          |------ ECU2
|          |------ ECU3
|          |------ ECU4

CAN voltage samples under environmental variations
|
|------ Ford Fiesta
|          |------ 1_30min (30 minutes after car start)
|                    |------ ECU1
|                    |------ ECU2
|                    |------ ECU3
|                    |------ ECU4
|                    |------ ECU5
|                    |------ ECU6
|                    |------ Unclassified
|          |------ 2_60min (60 minutes after car start)
|                    |------ ECU1
|                    |------ ECU2
|                    |------ ECU3
|                    |------ ECU4
|                    |------ ECU5
|                    |------ ECU6
|                    |------ Unclassified
|------ Honda Civic
|          |------ 1_10min_static (10 minutes after car start, stationary car)
|                    |------ ECU1
|                    |------ ECU2
|                    |------ ECU3
|                    |------ ECU4
|                    |------ ECU5
|                    |------ ECU6
|          |------ 2_30min_static (30 minutes after car start, stationary car)
|                    |------ ECU1
|                    |------ ECU2
|                    |------ ECU3
|                    |------ ECU4
|                    |------ ECU5
|                    |------ ECU6
|          |------ 3_60min_static (60 minutes after car start, stationary car)
|                    |------ ECU1
|                    |------ ECU2
|                    |------ ECU3
|                    |------ ECU4
|                    |------ ECU5
|                    |------ ECU6
|          |------ 4_10min_dynamic (10 minutes after car start, moving car)
|                    |------ ECU1
|                    |------ ECU2
|                    |------ ECU3
|                    |------ ECU4
|                    |------ ECU5
|                    |------ ECU6
|          |------ 5_30min_dynamic (30 minutes after car start, moving car)
|                    |------ ECU1
|                    |------ ECU2
|                    |------ ECU3
|                    |------ ECU4
|                    |------ ECU5
|                    |------ ECU6
|          |------ 6_60min_dynamic (60 minutes after car start, moving car)
|                    |------ ECU1
|                    |------ ECU2
|                    |------ ECU3
|                    |------ ECU4
|                    |------ ECU5
|                    |------ ECU6

CAN voltage samples (full)
|
|------ Dacia Duster
|
|------ Dacia Logan
|
|------ Ford Ecosport
|
|------ Ford Fiesta
|          |------ 1_0min (car start)
|          |------ 2_10min (10 minutes after car start)
|          |------ ENVIRONMENTAL_1_30min (30 minutes after car start)
|          |------ ENVIRONMENTAL_2_60min (60 minutes after car start)
|
|------ Ford Kuga
|
|------ Honda Civic
|          |------ 1_0min (car start)
|          |------ ENVIRONMENTAL_1_10min_static (10 minutes after car start, stationary car)
|          |------ ENVIRONMENTAL_2_30min_static (30 minutes after car start, stationary car)
|          |------ ENVIRONMENTAL_3_60min_static (60 minutes after car start, stationary car)
|          |------ ENVIRONMENTAL_4_10min_dynamic (10 minutes after car start, moving car)
|          |------ ENVIRONMENTAL_5_30min_dynamic (30 minutes after car start, moving car)
|          |------ ENVIRONMENTAL_6_60min_dynamic (60 minutes after car start, moving car)
|
|------ Hyundai i20
|
|------ Hyundai ix35
|
|------ John Deere Tractor
|
|------ Opel Corsa

File structure

CAN logs are stored in txt format and have data structured based on the XL driver library output from Vector (see documents from Vector XL webpage for more details).

Voltage data is stored in csv format and have some metadata included before the raw voltage samples. Every file name contains a series of artifacts:

[001]_0FD_extracted_extracted_ZERO_[0].csv includes
[001] as frame number ,
0FD as frame identifier (hexadecimal) ,
ZERO which means it is an isolated dominant bit ,
[0] that number of isolated dominant bit from specified frame

The metadata contains the following information in the first rows from each csv file:

[ID (hexadecimal)],
[ID (decimal)],
[DLC (decimal)],
[Timestamp, Channel A (CANH), Channel B (CANL)],
[Measurement unit],

The metadata is followed by the actual raw voltage samples:

[Voltage data (2000 samples/file for cars and 2700 samples/file for the John Deere tractor)].

ECUPrint Paper

Feel free to use our dataset for research purposes by giving credit to our paper below.

L. Popa, B. Groza, C. Jichici and P-S. Murvay, "ECUPrint—Physical Fingerprinting Electronic Control Units on CAN Buses Inside Cars and SAE J1939 Compliant Vehicles." IEEE Transactions on Information Forensics and Security 17 (2022): 1185-1200. pdf

@article{popa2022ecuprint,
title={ECUPrint—Physical Fingerprinting Electronic Control Units on CAN Buses Inside Cars and SAE J1939 Compliant Vehicles},
author={Popa, Lucian and Groza, Bogdan and Jichici, Camil and Murvay, Pal-Stefan},
journal={IEEE Transactions on Information Forensics and Security},
volume={17},
pages={1185--1200},
year={2022},
publisher={IEEE}
}

Contacts

• lucian.popa [at] aut.upt.ro
• bogdan.groza [at] aut.upt.ro