{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,18]],"date-time":"2026-03-18T13:15:56Z","timestamp":1773839756739,"version":"3.50.1"},"reference-count":55,"publisher":"MDPI AG","issue":"3","license":[{"start":{"date-parts":[[2022,1,27]],"date-time":"2022-01-27T00:00:00Z","timestamp":1643241600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["6210070494"],"award-info":[{"award-number":["6210070494"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100002858","name":"China Postdoctoral Science Foundation","doi-asserted-by":"publisher","award":["2021T140074"],"award-info":[{"award-number":["2021T140074"]}],"id":[{"id":"10.13039\/501100002858","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Sensors"],"abstract":"<jats:p>Modern intelligent and networked vehicles are increasingly equipped with electronic control units (ECUs) with increased computing power. These electronic devices form an in-vehicle network via the Controller Area Network (CAN) bus, the de facto standard for modern vehicles. Although many ECUs provide convenience to drivers and passengers, they also increase the potential for cyber security threats in motor vehicles. Numerous attacks on vehicles have been reported, and the commonality among these attacks is that they inject malicious messages into the CAN network. To close the security holes of CAN, original equipment manufacturers (OEMs) keep the Database CAN (DBC) file describing the content of CAN messages, confidential. This policy is ineffective against cyberattacks but limits in-depth investigation of CAN messages and hinders the development of in-vehicle intrusion detection systems (IDS) and CAN fuzz testing. Current research reverses CAN messages through tokenization, machine learning, and diagnostic information matching to obtain details of CAN messages. However, the results of these algorithms yield only a fraction of the information specified in the DBC file regarding CAN messages, such as field boundaries and message IDs associated with specific functions. In this study, we propose multiple linear regression-based frameworks for bit-level inversion of CAN messages that can approximate the inversion of DBC files. The framework builds a multiple linear regression model for vehicle behavior and CAN traffic, filters the candidate messages based on the decision coefficients, and finally locates the bits describing the vehicle behavior to obtain the data length and alignment based on the model parameters. Moreover, this work shows that the system has high reversion accuracy and outperforms existing systems in boundary delineation and filtering relevant messages in actual vehicles.<\/jats:p>","DOI":"10.3390\/s22030981","type":"journal-article","created":{"date-parts":[[2022,1,27]],"date-time":"2022-01-27T22:01:57Z","timestamp":1643320917000},"page":"981","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":16,"title":["Bit-Level Automotive Controller Area Network Message Reverse Framework Based on Linear Regression"],"prefix":"10.3390","volume":"22","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-8458-029X","authenticated-orcid":false,"given":"Zixiang","family":"Bi","sequence":"first","affiliation":[{"name":"School of Cyberspace Security, Beijing University of Posts and Telecommunications, Beijing 100876, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Guoai","family":"Xu","sequence":"additional","affiliation":[{"name":"School of Cyberspace Security, Beijing University of Posts and Telecommunications, Beijing 100876, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-3310-926X","authenticated-orcid":false,"given":"Guosheng","family":"Xu","sequence":"additional","affiliation":[{"name":"School of Cyberspace Security, Beijing University of Posts and Telecommunications, Beijing 100876, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Chenyu","family":"Wang","sequence":"additional","affiliation":[{"name":"School of Cyberspace Security, Beijing University of Posts and Telecommunications, Beijing 100876, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Sutao","family":"Zhang","sequence":"additional","affiliation":[{"name":"School of Cyberspace Security, Beijing University of Posts and Telecommunications, Beijing 100876, China"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"1968","published-online":{"date-parts":[[2022,1,27]]},"reference":[{"key":"ref_1","unstructured":"(2019, May 15). Number of Automotive Ecus Continues to Rise. Available online: https:\/\/www.eenewsautomotive.com\/news\/number-automotive-ecus-continues-rise."},{"key":"ref_2","unstructured":"(2020, December 11). CANbus\u2014All You Need to Know. Available online: https:\/\/www.rs-online.com\/designspark\/canbus-all-you-need-to-know."},{"key":"ref_3","doi-asserted-by":"crossref","unstructured":"Bozdal, M., Samie, M., Aslam, S., and Jennions, I. (2020). Evaluation of can bus security challenges. Sensors, 20.","DOI":"10.3390\/s20082364"},{"key":"ref_4","doi-asserted-by":"crossref","unstructured":"Farag, W.A. CANTrack: Enhancing automotive CAN bus security using intuitive encryption algorithms. Proceedings of the 2017 7th International Conference on Modeling, Simulation, and Applied Optimization (ICMSAO), Sharjah, United Arab Emirates, 4\u20136 April 2017.","DOI":"10.1109\/ICMSAO.2017.7934878"},{"key":"ref_5","unstructured":"Van Herrewege, A., Singelee, D., and Verbauwhede, I. (2011, January 28\u201329). CANAuth\u2014A simple, backward compatible broadcast authentication protocol for CAN bus. Proceedings of the ECRYPT Workshop on Lightweight Cryptography, Louvain-la-Neuve, Belgium."},{"key":"ref_6","doi-asserted-by":"crossref","unstructured":"Bozdal, M., Samie, M., and Jennions, I. A survey on can bus protocol: Attacks, challenges, and potential solutions. Proceedings of the 2018 International Conference on Computing, Electronics & Communications Engineering (iCCECE), Southend, UK, 16\u201317 August 2018.","DOI":"10.1109\/iCCECOME.2018.8658720"},{"key":"ref_7","unstructured":"Miller, C., and Valasek, C. (2015, January 1\u20138). Remote exploitation of an unaltered passenger vehicle. Proceedings of the Black Hat USA, Las Vegas, NV, USA."},{"key":"ref_8","unstructured":"(2020, April 28). TBONE\u2014A Zero-Click Exploit for Tesla MCUs. Available online: https:\/\/kunnamon.io\/tbone\/tbone-v1.0-redacted.pdf."},{"key":"ref_9","unstructured":"(2020, August 06). Tesla Model S Can Be Hacked, and Fixed. Available online: https:\/\/www.npr.org\/sections\/alltechconsidered\/2015\/08\/06\/429907506\/tesla-model-s-can-be-hacked-and-fixed-which-is-the-real-news."},{"key":"ref_10","unstructured":"(2015, July 21). Hackers Remotely Kill a Jeep on the Highway\u2014With Me in It. Available online: https:\/\/www.wired.com\/2015\/07\/hackers-remotely-kill-jeep-highway\/."},{"key":"ref_11","unstructured":"(2019, March 29). Tencent Keen Security Lab: Experimental Security Research of Tesla Autopilot. Available online: https:\/\/keenlab.tencent.com\/en\/2019\/03\/29\/Tencent-Keen-Security-Lab-Experimental-Security-Research-of-Tesla-Autopilot\/."},{"key":"ref_12","doi-asserted-by":"crossref","unstructured":"Koscher, K., Czeskis, A., Roesner, F., Patel, S., Kohno, T., Checkoway, S., McCoy, D., Kantor, B., Anderson, D., and Shacham, H. Experimental security analysis of a modern automobile. Proceedings of the 2010 IEEE Symposium on Security and Privacy, Berleley\/Oakland, California, 16\u201319 May 2010.","DOI":"10.1109\/SP.2010.34"},{"key":"ref_13","unstructured":"(2021, May 10). CAN DBC File Explained\u2014A Simple Intro. Available online: https:\/\/www.csselectronics.com\/pages\/can-dbc-file-database-intro."},{"key":"ref_14","unstructured":"(2021, September 20). DBC File Format Documentation. Available online: https:\/\/ishare.iask.sina.com.cn\/f\/3Yjd8GR3d.html."},{"key":"ref_15","doi-asserted-by":"crossref","unstructured":"Lee, H., Jeong, S.H., and Kim, H.K. OTIDS: A novel intrusion detection system for in-vehicle network by using remote frame. Proceedings of the 2017 15th Annual Conference on Privacy, Security and Trust (PST), Calgary, AB, Canada, 28\u201330 August 2017.","DOI":"10.1109\/PST.2017.00017"},{"key":"ref_16","doi-asserted-by":"crossref","unstructured":"Yu, K.S., Kim, S.H., Lim, D.W., and Kim, Y.S. (2020). A multiple R\u00e9nyi entropy based intrusion detection system for connected vehicles. Entropy, 22.","DOI":"10.3390\/e22020186"},{"key":"ref_17","first-page":"100198","article-title":"In-vehicle network intrusion detection using deep convolutional neural network","volume":"21","author":"Song","year":"2020","journal-title":"Veh. Commun."},{"key":"ref_18","doi-asserted-by":"crossref","unstructured":"Cho, K.T., and Shin, K.G. (2017, January 30). Viden: Attacker identification on in-vehicle networks. Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, Dallas, TX, USA.","DOI":"10.1145\/3133956.3134001"},{"key":"ref_19","doi-asserted-by":"crossref","unstructured":"Marchetti, M., and Stabili, D. Anomaly detection of CAN bus messages through analysis of ID sequences. Proceedings of the 2017 IEEE Intelligent Vehicles Symposium (IV), Los Angeles, CA, USA, 11\u201314 June 2017.","DOI":"10.1109\/IVS.2017.7995934"},{"key":"ref_20","doi-asserted-by":"crossref","first-page":"101857","DOI":"10.1016\/j.cose.2020.101857","article-title":"CAN-ADF: The controller area network attack detection framework","volume":"94","author":"Tariq","year":"2020","journal-title":"Comput. Secur."},{"key":"ref_21","doi-asserted-by":"crossref","unstructured":"Seo, E., Song, H.M., and Kim, H.K. Gids: Gan based intrusion detection system for in-vehicle network. Proceedings of the 2018 16th Annual Conference on Privacy, Security and Trust (PST), Belfast, UK, 28\u201330 August 2018.","DOI":"10.1109\/PST.2018.8514157"},{"key":"ref_22","doi-asserted-by":"crossref","unstructured":"Jin, S., Chung, J.G., and Xu, Y. Signature-Based Intrusion Detection System (IDS) for In-Vehicle CAN Bus Network. Proceedings of the 2021 IEEE International Symposium on Circuits and Systems (ISCAS), Daegu, Korea, 22\u201328 May 2021.","DOI":"10.1109\/ISCAS51556.2021.9401087"},{"key":"ref_23","doi-asserted-by":"crossref","first-page":"184","DOI":"10.1186\/s13638-019-1484-3","article-title":"Intrusion detection system for automotive Controller Area Network (CAN) bus system: A review","volume":"2019","author":"Lokman","year":"2019","journal-title":"EURASIP J. Wirel. Commun. Netw."},{"key":"ref_24","doi-asserted-by":"crossref","unstructured":"Fowler, D.S., Bryans, J., Shaikh, S.A., and Wooderson, P. Fuzz testing for automotive cyber-security. Proceedings of the 2018 48th Annual IEEE\/IFIP International Conference on Dependable Systems and Networks Workshops (DSN-W), Luxembourg, 25\u201328 June 2018.","DOI":"10.1109\/DSN-W.2018.00070"},{"key":"ref_25","doi-asserted-by":"crossref","unstructured":"Lee, H., Choi, K., Chung, K., Kim, J., and Yim, K. Fuzzing can packets into automobiles. Proceedings of the 2015 IEEE 29th International Conference on Advanced Information Networking and Applications, Gwangiu, Korea, 24\u201327 March 2015.","DOI":"10.1109\/AINA.2015.274"},{"key":"ref_26","doi-asserted-by":"crossref","first-page":"62","DOI":"10.1007\/s38314-021-0690-z","article-title":"CAN Bus Fuzz Testing with Artificial Intelligence","volume":"16","author":"McShane","year":"2021","journal-title":"ATZelectronics Worldw."},{"key":"ref_27","doi-asserted-by":"crossref","unstructured":"Fowler, D.S., Bryans, J., Cheah, M., Wooderson, P., and Shaikh, S.A. A method for constructing automotive cybersecurity tests, a CAN fuzz testing example. Proceedings of the 2019 IEEE 19th International Conference on Software Quality, Reliability and Security Companion (QRS-C), Sofia, Bulgaria, 22\u201326 July 2019.","DOI":"10.1109\/QRS-C.2019.00015"},{"key":"ref_28","doi-asserted-by":"crossref","unstructured":"Fowler, D.S. (2019). A Fuzz Testing Methodology for Cyber-Security Assurance of the Automotive CAN Bus. [Ph.D. Thesis, Coventry University].","DOI":"10.1109\/DSN-W.2018.00070"},{"key":"ref_29","first-page":"43","article-title":"Field classification, modeling and anomaly detection in unknown CAN bus networks","volume":"9","author":"Markovitz","year":"2017","journal-title":"Veh. Commun."},{"key":"ref_30","doi-asserted-by":"crossref","first-page":"1083","DOI":"10.1109\/TIFS.2018.2870826","article-title":"READ: Reverse engineering of automotive data frames","volume":"14","author":"Marchetti","year":"2018","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"ref_31","doi-asserted-by":"crossref","unstructured":"Pes\u00e9, M.D., Stacer, T., Campos, C.A., Newberry, E., Chen, D., and Shin, K.G. (2019, January 11\u201315). LibreCAN: Automated CAN message translator. Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security, London, UK.","DOI":"10.1145\/3319535.3363190"},{"key":"ref_32","doi-asserted-by":"crossref","first-page":"105149","DOI":"10.1016\/j.dib.2020.105149","article-title":"ReCAN\u2013Dataset for reverse engineering of Controller Area Networks","volume":"29","author":"Zago","year":"2020","journal-title":"Data Brief"},{"key":"ref_33","doi-asserted-by":"crossref","unstructured":"Jaynes, M., Dantu, R., Varriale, R., and Evans, N. Automating ECU identification for vehicle security. Proceedings of the 2016 15th IEEE International Conference on Machine Learning and Applications (ICMLA), Anaheim, CA, USA, 18\u201320 December 2016.","DOI":"10.1109\/ICMLA.2016.0111"},{"key":"ref_34","doi-asserted-by":"crossref","unstructured":"Buscemi, A., Castignani, G., Engel, T., and Turcanu, I. A Data-Driven Minimal Approach for CAN Bus Reverse Engineering. Proceedings of the 2020 IEEE 3rd Connected and Automated Vehicles Symposium (CAVS), Victoria, BC, Canada, 18 November\u201316 December 2020.","DOI":"10.1109\/CAVS51000.2020.9334650"},{"key":"ref_35","doi-asserted-by":"crossref","first-page":"50","DOI":"10.1109\/MCE.2020.3023538","article-title":"Reverse Engineering Controller Area Network Messages using Unsupervised Machine Learning","volume":"11","author":"Ezeobi","year":"2020","journal-title":"IEEE Consum. Electron. Mag."},{"key":"ref_36","doi-asserted-by":"crossref","first-page":"93","DOI":"10.1109\/MDAT.2020.3011036","article-title":"Discovering can specification using on-board diagnostics","volume":"38","author":"Song","year":"2020","journal-title":"IEEE Des. Test"},{"key":"ref_37","unstructured":"Blaauwendraad, B., and Kieberl, V. (2022, January 23). Automated reverse-engineering of CAN messages using OBD-II and correlation coefficients. Available online: https:\/\/www.os3.nl\/_media\/2019-2020\/courses\/rp2\/p103_report.pdf."},{"key":"ref_38","doi-asserted-by":"crossref","unstructured":"Wen, H., Zhao, Q., Chen, Q.A., and Lin, Z. (2020, January 23\u201326). Automated cross-platform reverse engineering of CAN bus commands from mobile apps. Proceedings of the 2020 Network and Distributed System Security Symposium (NDSS\u201920), San Diego, CA, USA.","DOI":"10.14722\/ndss.2020.24231"},{"key":"ref_39","unstructured":"(2021, September 10). CAN Specification. Available online: http:\/\/esd.cs.ucr.edu\/webres\/can20.pdf."},{"key":"ref_40","unstructured":"Texas Instruments (2022, January 22). Introduction to the Controller Area Network (CAN), Available online: https:\/\/www.rpi.edu\/dept\/ecse\/mps\/sloa101.pdf."},{"key":"ref_41","doi-asserted-by":"crossref","first-page":"234","DOI":"10.1016\/j.sbspro.2013.12.027","article-title":"A study on multiple linear regression analysis","volume":"106","year":"2013","journal-title":"Procedia-Soc. Behav. Sci."},{"key":"ref_42","first-page":"1","article-title":"Multiple linear regression","volume":"5","author":"Tranmer","year":"2008","journal-title":"Cathie Marsh Cent. Census Surv. Res. (CCSR)"},{"key":"ref_43","unstructured":"(2021, May 12). Amazon-Acceleration Sensors. Available online: https:\/\/www.amazon.com\/High-Stability-Inclinometer-High-Precision-Accelerometer-Navigation\/dp\/B072ZZ83JZ\/ref=sr_1_3?crid=D2ETL9PC5TBQ&keywords=ten-axis+GPS+inertial+navigation+sensor&qid=1642921112&sprefix=ten-axis+gps+inertial+navigation+sensor%2Caps%2C855&sr=8-3."},{"key":"ref_44","doi-asserted-by":"crossref","unstructured":"Chen, D., Cho, K.-T., Han, S., Jin, Z., and Shin, K.G. Invisible sensing of vehicle steering with smartphones. Proceedings of the 13th Annual International Conference on Mobile Systems, Applications, and Services, Florence, Italy, 18\u201322 May 2015.","DOI":"10.1145\/2742647.2742659"},{"key":"ref_45","unstructured":"(2021, January 10). Opendbcfromcomma.ai. Available online: https:\/\/github.com\/commaai\/opendbc."},{"key":"ref_46","doi-asserted-by":"crossref","unstructured":"Benesty, J., Chen, J., Huang, Y., and Cohen, I. (2009). Pearson correlation coefficient. Noise Reduction in Speech Processing, Springer.","DOI":"10.1007\/978-3-642-00296-0_5"},{"key":"ref_47","unstructured":"(2021, September 20). OBD-II PIDs. Available online: https:\/\/en.wikipedia.org\/wiki\/OBD-II_PIDs."},{"key":"ref_48","unstructured":"(2021, January 10). On-Board Diagnostics. Available online: https:\/\/en.wikipedia.org\/wiki\/On-_board_diagnostics#OBD-%20II_diagnostic_connector."},{"key":"ref_49","unstructured":"(2021, August 10). OBD II Generic PID Diagnosis. Available online: https:\/\/www.motor.com\/magazinepdfs\/092007_09.pdf."},{"key":"ref_50","unstructured":"(2022, January 10). Is Your Vehicle OBD II Compliant?. Available online: https:\/\/www.plxdevices.com\/obdii-compliant-vehicles-s\/153.htm."},{"key":"ref_51","unstructured":"EPC (European Parliament and Council) (2022, January 23). Directive 98\/69\/EC of the European Parliament and of the Council of 13 October 1998 relating to measures to be taken against air pollution by emissions from motor vehicles and amending Council Directive 70\/220\/EEC. Available online: https:\/\/eur-lex.europa.eu\/LexUriServ\/LexUriServ.do?uri=CONSLEG:1998L0069:19981228:EN:PDF."},{"key":"ref_52","unstructured":"(2022, January 20). ISO 15765-4:2005 Road vehicles\u2014Diagnostics on Controller Area Networks (CAN)\u2014Part 4: Requirements for emissions-related systems. Available online: https:\/\/www.iso.org\/standard\/33619.html."},{"key":"ref_53","unstructured":"(2022, January 20). CAN Bus Explained\u2014A Simple Intro. Available online: https:\/\/www.csselectronics.com\/pages\/can-bus-simple-intro-tutorial."},{"key":"ref_54","unstructured":"(2022, January 20). Limits and Measurement Methods for Emissions from Light-Duty Vehicles (CHINA 6). Available online: https:\/\/www.chinesestandard.net\/PDF\/BOOK.aspx\/GB18352.6-2016."},{"key":"ref_55","doi-asserted-by":"crossref","first-page":"8","DOI":"10.1145\/2983185.2983186","article-title":"Open source model and simulator for real-time performance analysis of automotive network security","volume":"13","author":"Mundhenk","year":"2016","journal-title":"ACM Sigbed Rev."}],"container-title":["Sensors"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1424-8220\/22\/3\/981\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,10]],"date-time":"2025-10-10T22:08:46Z","timestamp":1760134126000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1424-8220\/22\/3\/981"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,1,27]]},"references-count":55,"journal-issue":{"issue":"3","published-online":{"date-parts":[[2022,2]]}},"alternative-id":["s22030981"],"URL":"https:\/\/doi.org\/10.3390\/s22030981","relation":{},"ISSN":["1424-8220"],"issn-type":[{"value":"1424-8220","type":"electronic"}],"subject":[],"published":{"date-parts":[[2022,1,27]]}}}