In-vehicle can bus reverse method, system, device and medium based on first-order difference

Abstract

The application discloses a vehicle CAN bus reverse method, system, device and medium based on first-order difference. The method comprises the following steps: acquiring CAN bus communication data of a target vehicle under normal driving conditions, and recording all IDs in the CAN bus communication data to form an ID white list of the CAN bus; extracting ID data tracks corresponding to each ID in the ID white list from the CAN bus communication data; calculating the bit flip rate of each bit of the ID data track; dividing the signal boundary of the ID data track according to a preset signal boundary division rule according to the bit flip rate; extracting the signal track corresponding to each signal from the ID data track according to the signal boundary, and performing first-order difference analysis on the signal track to obtain the first-order difference feature of the signal; and classifying the signal according to the first-order difference feature to obtain the category of the signal. The application can more accurately divide the signal boundary, use a pure mathematical method to classify the signal, and automatically identify and correct the signal format.

Description

Technical Field

[0001] This invention relates to the field of automotive safety technology, and in particular to a method, system, device, and medium for reverse engineering an in-vehicle CAN bus based on first-order differential. Background Technology

[0002] The CAN bus is the main bus constituting the physical network within a vehicle, handling communication related to important vehicle functions (such as the instrument panel and powertrain). However, the CAN bus communication protocol lacks any security mechanisms such as information encryption and authentication, making it highly vulnerable to attacks. To defend against attacks targeting the CAN bus, researchers need to determine whether there are abnormal signals caused by attacks based on the communication content within the CAN bus, which requires knowledge of the target vehicle's CAN bus configuration file. However, vehicle CAN bus configuration files are confidential and are usually held by the automaker, and for security reasons, automakers do not publicly disclose the CAN bus configuration files of their manufactured vehicles. Obtaining the communication content within the CAN bus requires independent decryption, i.e., reverse engineering the CAN bus. Complete CAN bus reverse engineering includes signal boundary delineation and signal translation. Signal boundary delineation involves defining the boundaries of each signal in the data field of the CAN data frame; signal translation identifies the type of signal for each signal and accurately translates the binary signal into a decimal signal.

[0003] In signal boundary segmentation, existing technologies include combinatorial optimization-based methods and bit-flip rate-based methods. The former enumerates all or some combinations of signal boundaries and scores these boundaries using an algorithm, selecting the highest-scoring combination as the final signal boundary segmentation result using a greedy algorithm; however, this method is too simplistic and cannot provide accurate signal segmentation. The latter finds the boundaries of adjacent signals by calculating the flip rate of each bit in the data field of the CAN data frame. This boundary characteristic often manifests as a sharp drop in the bit flip rate; this method is relatively stable, but most existing methods ignore the signal byte order format, do not consider all possible scenarios, making it difficult to correctly delineate signal boundaries when multiple signals are connected, and are prone to missing multiple trailing bits when segmenting long physical signal boundaries.

[0004] In the signal translation section, existing technologies are quite diverse. One major category uses the vehicle diagnostic interface, connecting external devices to the vehicle through this interface. By sending specified diagnostic signals, relevant vehicle signals are acquired, and the types of signals are analyzed based on these feedbacks. However, this method has extremely poor versatility. First, its implementation requires a target vehicle; second, because the CAN configuration files differ for each vehicle model, a different target vehicle is still needed for signal detection if the target vehicle changes. Furthermore, this method requires additional external equipment, making its implementation highly demanding. Another major category starts from the characteristics of the signals themselves, performing mathematical analysis to identify various signals. This category sometimes uses deep learning methods, but these require a large number of existing CAN configuration files to train the model, resources that are difficult to obtain and are only possible through cooperation with automakers. This category does not use machine learning methods and suffers from the following problems: 1) Incomplete signal understanding and insufficient classification; 2) Overly idealistic algorithms that perform poorly on real-world vehicle datasets; 3) A common problem with most signal translation algorithms: ignoring signal format. Summary of the Invention

[0005] The purpose of this invention is to achieve more accurate signal boundary segmentation and more detailed and complete signal translation during CAN bus reverse engineering. To achieve the above objective, this invention provides a method, system, device, and medium for in-vehicle CAN bus reverse engineering based on first-order differential.

[0006] In a first aspect, embodiments of the present invention provide a method for reversing an in-vehicle CAN bus based on first-order differential, comprising:

[0007] Acquire the CAN bus communication data of the target vehicle under normal driving conditions, and record all IDs in the CAN bus communication data to form a whitelist of IDs for the CAN bus;

[0008] Extract the ID data trajectory corresponding to each ID in the ID whitelist from the CAN bus communication data; the ID data trajectory consists of multiple data entries containing the corresponding ID in the CAN bus communication data.

[0009] Calculate the bit flip rate of each bit in the ID data trajectory;

[0010] Based on the bit flip rate, the signal boundary of the ID data trajectory is divided according to a preset signal boundary division rule;

[0011] Based on the signal boundary, the signal trajectory corresponding to each signal is extracted from the ID data trajectory, and first-order difference analysis is performed on the signal trajectory to obtain the first-order difference features of the signal; the first-order difference features include at least the signal length, the number of unique values ​​of the signal trajectory, the mean of the first-order difference sequence of the signal, the standardized variance of the first-order difference sequence of the signal, the number of unique values ​​of the first-order difference sequence of the signal, and the maximum absolute value of the first-order difference sequence of the signal.

[0012] The signal is classified according to the first-order difference feature to obtain the category of the signal; the category includes a predefined signal and an undefined signal, and the predefined signal includes physical signal, check signal, cyclic signal and multi-valued signal.

[0013] Preferably, after classifying the signal according to the first-order difference feature to obtain the signal category, the method further includes:

[0014] The undefined signal is corrected according to the preset format correction rules so that the undefined signal is classified into the corresponding preset defined signal.

[0015] Preferably, the step of dividing the signal boundary of the ID data trajectory according to the bit flip rate and a preset signal boundary division rule includes:

[0016] Based on the bit flip rate, the signal boundary of the counter signal with a preset bit flip rate characteristic is defined; the preset bit flip rate characteristic is obtained using the following formula:

[0017]

[0018] Where bfr represents the bit flip rate vector, and n represents the bit length of the signal;

[0019] Determine whether the current bit satisfies any preset boundary condition. If so, the current bit is determined as the signal boundary. The preset boundary conditions include the bit flip rate of the next bit being 0, the next bit being the bit to which the counter signal belongs, the next bit being beyond the bit length of the signal, and the bit flip rate of the next bit being less than the bit flip rate of the current bit and the bit flip rate of the current bit not being greater than a first threshold.

[0020] Preferably, if the current bit satisfies the following preset boundary conditions: the bit flip rate of the next bit is less than the bit flip rate of the current bit and the bit flip rate of the current bit is greater than the first threshold, then it is determined whether the difference between the bit flip rate of the current bit and the bit flip rate of the next bit is not greater than the second threshold. If so, the next bit is assigned to the signal boundary; otherwise, the current bit is determined as the signal boundary.

[0021] Preferably, classifying the signal based on the first-order difference feature to obtain the signal category includes:

[0022] Determine whether the signal meets the cyclic signal determination condition. If so, the signal is determined to be the cyclic signal. The cyclic signal determination condition is that the maximum absolute value of the first-order difference sequence of the signal has the same interval in the first-order difference sequence of the signal.

[0023] If the signal does not meet the cyclic signal determination condition, then it is further determined whether the signal meets the first physical signal determination condition. If so, the signal is determined as the physical signal. The first physical signal determination condition is obtained using the following formula:

[0024] sig_len>4&&uv s <0.9·2 sig_len &&x n <1&&1 <max ad <2 sig_len-1

[0025] Where sig_len represents the signal length, uv s x represents the number of unique values ​​in the signal trajectory. n Max represents the standardized variance of the first-order difference sequence of the signal. ad This represents the maximum absolute value of the first-order difference sequence of the signal;

[0026] If the signal does not meet the first physical signal determination condition, then it is further determined whether the signal meets the first verification signal determination condition. If so, the signal is determined as the verification signal. The first verification signal determination condition is obtained using the following formula:

[0027]

[0028] Among them, uv d This represents the number of unique values ​​in the first-order difference sequence of a signal.

[0029] If the signal does not meet the first verification signal determination condition, then it is further determined whether the signal meets the multi-value signal determination condition. If so, the signal is determined as the multi-value signal. The multi-value signal determination condition is obtained using the following formula:

[0030] μ==0||sig_len<=2||[sig_len>=3&&max ad >1&&(prpo0>0.9||uv d max ad )]

[0031] Where μ represents the mean of the first-order difference sequence of the signal, and prpo0 represents the proportion of 0 in the first-order difference sequence of the signal;

[0032] If the signal does not meet the multi-valued signal determination condition, then the signal is determined to be the undefined signal.

[0033] Preferably, the step of correcting the undefined signal according to a preset format correction rule to classify the undefined signal into the corresponding preset defined signal includes:

[0034] The highest bit of the undefined signal is regarded as the sign bit, and it is determined whether the undefined signal meets the first physical signal determination condition. If so, the undefined signal is determined as the physical signal.

[0035] If the undefined signal does not meet the first physical signal determination condition, the byte order of the undefined signal is updated to LE, and it is determined whether the undefined signal meets any signal determination condition. If so, the undefined signal is determined as the corresponding preset defined signal. The signal determination conditions include a cyclic signal determination condition, a first physical signal determination condition, a first check signal determination condition, and a multi-value signal determination condition.

[0036] If the undefined signal does not meet any of the signal determination conditions, then the highest bit of the undefined signal is again regarded as the sign bit, and it is determined whether the undefined signal meets the first physical signal determination condition. If so, the undefined signal is determined as the physical signal.

[0037] Preferably, the step of again treating the most significant bit of the undefined signal as the sign bit and determining whether the undefined signal satisfies the first physical signal determination condition further includes:

[0038] If the undefined signal does not meet the first physical signal determination condition, then it is determined whether the undefined signal meets the second physical signal determination condition. If so, the undefined signal is determined as the physical signal. The second physical signal determination condition is obtained using the following formula:

[0039] sig_len>4&&max ad ==1&&x n <1&&uv s >0.2·2 sig_len

[0040] Where sig_len represents the signal length, and max ad x represents the maximum absolute value of the first-order difference sequence of the signal. n uv represents the standardized variance of the first-order difference sequence of the signal. sIndicates the number of unique values ​​in the signal trajectory;

[0041] If the undefined signal does not meet the second physical signal determination condition, then it is further determined whether the undefined signal meets the second verification signal determination condition. If so, the undefined signal is determined as the verification signal. The second verification signal determination condition is obtained using the following formula:

[0042] UV s >0.9·2 sig_len &&x n >2

[0043] If the undefined signal does not meet the second verification signal determination condition, then the undefined signal is determined to be the multi-valued signal.

[0044] Secondly, embodiments of the present invention provide an in-vehicle CAN bus reverse engineering system based on first-order differential, comprising:

[0045] The ID whitelist generation module is used to obtain the CAN bus communication data of the target vehicle under normal driving conditions and record all IDs in the CAN bus communication data to form the ID whitelist of the CAN bus.

[0046] The ID data trajectory extraction module is used to extract the ID data trajectory corresponding to each ID in the ID whitelist from the CAN bus communication data; the ID data trajectory is multiple data entries containing the corresponding ID in the CAN bus communication data;

[0047] The bit flip rate calculation module is used to calculate the bit flip rate of each bit in the ID data trajectory;

[0048] The signal boundary division module is used to divide the signal boundary of the ID data trajectory according to the bit flip rate and a preset signal boundary division rule.

[0049] The first-order difference analysis module is used to extract the signal trajectory corresponding to each signal from the ID data trajectory based on the signal boundary, and perform first-order difference analysis on the signal trajectory to obtain the first-order difference features of the signal; the first-order difference features include at least the signal length, the number of unique values ​​of the signal trajectory, the mean of the first-order difference sequence of the signal, the standardized variance of the first-order difference sequence of the signal, the number of unique values ​​of the first-order difference sequence of the signal, and the maximum absolute value of the first-order difference sequence of the signal.

[0050] The signal translation module is used to classify the signal according to the first-order difference feature to obtain the category of the signal; the category includes a preset defined signal and an undefined signal, and the preset defined signal includes physical signal, check signal, cyclic signal and multi-valued signal.

[0051] Thirdly, embodiments of the present invention provide a terminal device, including a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein the processor executes the computer program to implement the in-vehicle CAN bus reverse method as described above.

[0052] Fourthly, embodiments of the present invention provide a computer-readable storage medium, the computer-readable storage medium including a stored computer program, wherein, when the computer program is executed, it controls the device where the computer-readable storage medium is located to execute the in-vehicle CAN bus reverse method as described above.

[0053] Compared with existing technologies, the present invention provides a method, system, device, and medium for in-vehicle CAN bus reverse engineering based on first-order differential. Its advantages include: requiring no additional external devices, CAN configuration files, or prior knowledge of the target vehicle; only the CAN bus communication data of the target vehicle needs to be analyzed, making it highly versatile and easy to implement; considering more practical and complex signal situations, it can more accurately delineate signal boundaries; it does not use deep learning algorithms but instead starts from the signal characteristics themselves, using pure mathematical methods for signal classification, resulting in strong interpretability; and it fully considers and solves the problem of existing methods neglecting signal formats, automatically identifying and correcting signal formats. Attached Figure Description

[0054] Figure 1 This is a flowchart illustrating an in-vehicle CAN bus reverse engineering method based on first-order differential according to an embodiment of the present invention.

[0055] Figure 2 This is a schematic diagram of CAN bus communication data according to an embodiment of the present invention;

[0056] Figure 3 This is a schematic diagram of ID data trajectory extraction according to an embodiment of the present invention;

[0057] Figure 4 This is a schematic diagram illustrating the bit flip rate calculation according to an embodiment of the present invention;

[0058] Figure 5 This is a schematic diagram of the signal boundary division process according to an embodiment of the present invention;

[0059] Figure 6 This is a schematic diagram of the long signal boundary division result according to an embodiment of the present invention;

[0060] Figure 7 This is a schematic diagram of the signal translation process according to an embodiment of the present invention;

[0061] Figure 8 This is a schematic diagram of the signal format correction process according to an embodiment of the present invention;

[0062] Figure 9 This is a schematic flowchart illustrating the process of distinguishing adhesion signals and misjudgment signals according to an embodiment of the present invention;

[0063] Figure 10 This is a schematic diagram of the structure of an in-vehicle CAN bus reverse system based on first-order differential according to an embodiment of the present invention;

[0064] Figure 11 This is a schematic diagram of the structure of a terminal device according to an embodiment of the present invention. Detailed Implementation

[0065] The specific embodiments of the present invention will be described in further detail below with reference to the accompanying drawings and examples. The following examples are for illustrative purposes only and are not intended to limit the scope of the invention.

[0066] like Figure 1 As shown, this embodiment of the invention provides a method for reverse engineering an in-vehicle CAN bus based on first-order differential, including:

[0067] S1. Obtain the CAN bus communication data of the target vehicle under normal driving conditions, and record all IDs in the CAN bus communication data to form a whitelist of IDs for the CAN bus.

[0068] The set of valid IDs in CAN bus communication data is finite and fixed, but this set is unknown. Therefore, it is necessary to record all valid IDs by observing the CAN bus communication data. All valid IDs constitute the ID whitelist of the target vehicle's CAN bus. For easier understanding, please refer to... Figure 2 The CAN bus communication data shown is examined. Observing the ID portion of all data frames, all IDs appearing in the CAN bus communication data under normal vehicle operation are valid IDs.

[0069] S2. Extract the ID data trajectory corresponding to each ID in the ID whitelist from the CAN bus communication data;

[0070] This embodiment is performed for each ID in the ID whitelist. For each ID, the data containing that ID in the CAN bus communication data is first extracted separately. The extracted data is called the ID data trajectory corresponding to this ID. For details, please refer to [link to documentation]. Figure 3 In other words, the ID data trajectory consists of multiple data entries containing the corresponding ID within the CAN bus communication data.

[0071] S3. Calculate the bit flip rate of each bit in the ID data trajectory;

[0072] For each data entry in the ID data trajectory, first convert the hexadecimal data to binary data. Then, for each data entry starting from the second one, perform an XOR operation with the previous data entry. A bit value of 0 indicates that the bit has not been flipped, and a bit value of 1 indicates that the bit has been flipped. Count the number of flips for each bit in this way, and divide the number of flips for each bit by the total number of changes in the ID data trajectory to obtain the bit flip rate for each bit. For details on the calculation process of the bit flip rate, please refer to [link to documentation]. Figure 4 Furthermore, the bit flip rate of each bit can be expressed by the following formula:

[0073]

[0074] Among them, bfr j Let x represent the bit flip rate of the j-th bit, N represent the total number of data entries in the ID data trajectory, M represent the total number of changes in the ID data trajectory, and x represent the total number of changes in the ID data trajectory. ij This represents the value of the i-th bit at the j-th bit position of the ID data trajectory. It can be understood that the total number of changes M in the ID data trajectory is the sum of the number of flips for each bit.

[0075] S4. Based on the bit flip rate, divide the signal boundary of the ID data trajectory according to the preset signal boundary division rules;

[0076] Specifically, such as Figure 5 As shown, step S4 includes:

[0077] S401. Based on the bit flip rate, define the signal boundary of the counter signal with a preset bit flip rate characteristic;

[0078] First, the signal boundaries of the counter signals with a preset bit flip rate characteristic, i.e., the first type of counter signals, are defined. These first-type counter signals possess unique bit flip rate characteristics. Specifically, the preset bit flip rate characteristics are obtained using the following formula:

[0079]

[0080] Where bfr represents the bit flip rate vector, and n represents the bit length of the signal. It should be noted that not all counter signals exhibit this characteristic. The first type of counter signal is the most unique and can be directly identified by observing the bit flip rate. The second type of counter signal, because it does not cycle back to zero after reaching its maximum value, does not display a unique bit flip rate characteristic. Therefore, it is treated the same as ordinary signals when defining boundaries, and the second type of counter signal is further separated by analyzing its signal characteristics later.

[0081] S402. Determine whether the current bit satisfies any preset boundary condition. If so, determine the current bit as the signal boundary.

[0082] When dividing a normal signal boundary, it is determined whether the current bit satisfies any preset boundary condition. If so, the current bit is determined as the signal boundary. Specifically, the preset boundary conditions include: the bit flip rate of the next bit is 0; the next bit is a bit belonging to a counter signal; the next bit exceeds the bit length of the signal; and the bit flip rate of the next bit is less than the bit flip rate of the current bit, and the bit flip rate of the current bit is not greater than a first threshold. Here, the counter signal refers to a counter signal with the preset bit flip rate characteristic, i.e., a first type of counter signal, and the preferred first threshold in this embodiment is 0.4.

[0083] Furthermore, to address the issue of tail loss in long signals, if the current bit satisfies the following preset boundary conditions: the bit flip rate of the next bit is less than the bit flip rate of the current bit, and the bit flip rate of the current bit is greater than a first threshold, then it is determined whether the difference between the bit flip rate of the current bit and the bit flip rate of the next bit is not greater than a second threshold. If so, the next bit is assigned to the signal boundary; otherwise, the current bit is designated as the signal boundary. In this embodiment, the preferred second threshold is 0.05. That is, if the bit flip rate of the current bit is greater than 0.4, then a redundancy of 0.05 is given to the bit flip rate of the next bit, allowing the bit flip rate of the next bit to decrease by at most 0.05. For easier understanding, the signal boundary division results for long signals can be found in [reference needed]. Figure 6 .

[0084] S5. Based on the signal boundary, extract the signal trajectory corresponding to each signal from the ID data trajectory, and perform first-order difference analysis on the signal trajectory to obtain the first-order difference features of the signal.

[0085] Specifically, the first-order difference features include at least the signal length, the number of unique values ​​in the signal trajectory, the mean of the first-order difference sequence of the signal, the standardized variance of the first-order difference sequence of the signal, the number of unique values ​​in the first-order difference sequence of the signal, and the maximum absolute value of the first-order difference sequence of the signal.

[0086] S6. Classify the signal according to the first-order difference feature to obtain the signal category;

[0087] Specifically, the categories include predefined signals and undefined signals. Predefined signals include physical signals, check signals, cyclic signals, and multi-valued signals. It is understood that a signal that does not conform to any of these four types is called an undefined signal.

[0088] Each predefined signal has its own unique behavior in the corresponding first-order differential feature, where the signal length, i.e., the bit length of the signal, is an empirical parameter for distinguishing physical signals. Since physical signals represent important physical quantities related to vehicle conditions, such as engine temperature, vehicle speed, or engine RPM, they must have a sufficient number of bits to improve numerical resolution and accurately display these values. This embodiment requires physical signals to be more than 4 bits; the bit length of other types of signals is random, but most are less than 8 bits.

[0089] The number of unique values ​​in a signal trajectory: Assuming a signal has n bits, if it is unsigned, then there are at most 2^n unique values. n The seed value ranges from 0 to 2. n-1 For physical signals, because they have many bits and they cannot reach relatively high values ​​most of the time or only remain within a small range, it is difficult to fully utilize all of their values;

[0090] The mean of the first-order difference sequence of the signal; this parameter is used to distinguish multi-valued signals with a reset state. A reset state means that regardless of how the signal changes, it will return to a default state. Multi-valued signals are also called "pulse-like" signals;

[0091] The standardized variance of a signal's first-order difference sequence is a reliable characteristic that distinguishes the physical signal from the check signal. Physical signals tend to have smaller variances because most values ​​in their first-order difference sequences are small; check signals, on the other hand, have significantly higher variances. Specifically, the variance of a signal's first-order difference sequence is expressed by the following formula:

[0092]

[0093] Where X represents the variance of the first-order difference sequence of the signal, N represents the length of the first-order difference sequence of the signal, and d i Let represent the i-th value in the first-order difference sequence of the signal, and μ represent the mean of the first-order difference sequence of the signal. It should be noted that the variance is related to the signal length. For example, comparing the variance of a 10-bit physical signal with the variance of a 3-bit check signal is unfair, because a longer physical signal may have greater absolute fluctuations than a check signal, but this is normal for its length. Therefore, this embodiment uses the following factor to eliminate the influence of signal length:

[0094]

[0095] Where α represents the standardization factor, and sig_len represents the signal length. Furthermore, the standardized variance of the first-order difference sequence of the signal is expressed by the following formula:

[0096]

[0097] Among them, X n This represents the standardized variance of the first-order difference sequence of the signal. The standardized variance of the first-order difference sequence of the signal is introduced to eliminate the influence of signal length, ensuring that the final variance accurately reflects the degree of signal fluctuation.

[0098] The number of unique values ​​in the first-order difference sequence of a signal is a characteristic used to measure the randomness of the signal. Theoretically, an n-bit signal has at most 2^n unique values ​​in its first-order difference sequence. n+1 -1 values. For a check signal, it can typically have more than half of the maximum first-order difference unique values, which is difficult for other signals to achieve;

[0099] The maximum absolute value of the first-order difference sequence of a signal represents the most dramatic change in the signal trajectory. Physical signals have small values ​​for this characteristic because they are continuous and shouldn't vary too much. However, for verification signals, due to their randomness, their values ​​can fluctuate significantly.

[0100] Furthermore, the first-order difference characteristics also include the proportion of 1, -1, and 0 in the first-order difference sequence of the signal. If many of the values ​​in the first-order difference sequence are 1 or -1, it is considered to be a counter signal because the counter increases or decreases by one unit each time. If most of the values ​​in the first-order difference sequence are 0, it is considered to be a multi-valued signal because it does not change its state frequently.

[0101] Furthermore, such as Figure 7 As shown, step S6 includes:

[0102] S601. Determine whether the signal meets the condition for determining a cyclic signal. If so, determine the signal as a cyclic signal.

[0103] The determination of a cyclic signal depends on whether the occurrence of the maximum changes in its first-order difference sequence exhibits periodicity. Specifically, the criterion for determining a cyclic signal is that the maximum absolute values ​​of the first-order difference sequence of the signal have the same interval within the sequence. In this embodiment, the signal is determined to be cyclic by observing whether the occurrence positions of the first ten and last ten maximum changes have the same interval.

[0104] S602. If the signal does not meet the cyclic signal determination condition, then continue to determine whether the signal meets the first physical signal determination condition. If it does, then determine the signal as a physical signal.

[0105] Specifically, the first physical signal determination condition is obtained using the following formula:

[0106] sig_len>4&&uv s <0.9·2 sig_len &&x n <1&&1 <maxad <2 sig_len-1

[0107] Where sig_len represents the signal length, uv s x represents the number of unique values ​​in the signal trajectory. n Max represents the standardized variance of the first-order difference sequence of the signal. ad It represents the maximum absolute value of the first-order difference sequence of the signal.

[0108] S603. If the signal does not meet the first physical signal determination condition, then continue to determine whether the signal meets the first verification signal determination condition. If it does, then determine the signal as a verification signal.

[0109] Specifically, the first verification signal determination condition is obtained using the following formula:

[0110]

[0111] Among them, uv d This represents the number of unique values ​​in the first-order difference sequence of the signal.

[0112] S604. If the signal does not meet the first verification signal determination condition, then continue to determine whether the signal meets the multi-value signal determination condition. If so, then determine the signal as a multi-value signal.

[0113] Specifically, the determination criteria for multi-valued signals are obtained using the following formula:

[0114] μ==0||sig_len<=2||[sig_len>=3&&max ad >1&&(prpo0>0.9||uv d max ad )]

[0115] Where μ represents the mean of the first-order difference sequence of the signal, and prpo0 represents the proportion of 0 in the first-order difference sequence of the signal.

[0116] S605. If the signal does not meet the criteria for determining a multi-valued signal, then the signal is determined to be an undefined signal.

[0117] It should be noted that step S6 is actually the first round of signal translation. The goal of the first round of signal translation is to successfully translate signals in the default format, namely BE byte order signals and unsigned signals, and to identify signals in non-default formats. First-order difference analysis is used to obtain the first-order difference features of various default format signals; these features are then used to filter and classify the default format signals. Meanwhile, translating non-default format signals under the default format will cause serious errors, making it impossible for the first-order difference features of these signals to match the first-order difference features of any default format signal. Therefore, step S6, i.e., the first round of signal translation, can identify non-default format signals while translating default format signals.

[0118] For signals determined to be undefined in step S6, there are three possibilities: 1. The signal is not a default format signal, i.e., its byte order is LE or it is a signed signal; 2. An error occurred during signal boundary division, resulting in signal sticking; 3. Some default format signals happen to be under extreme conditions and are mistakenly judged as undefined signals. It is understandable that if a signal is not in the default format, then after changing it to the correct format, it will definitely conform to a certain preset definition signal; however, for incorrectly divided signals, no matter how its format is changed, it will not conform to any preset definition signal.

[0119] To automatically identify and correct the signal format, after step S6, the following is also included:

[0120] S7. Correct the undefined signals according to the preset format correction rules so that the undefined signals are classified into the corresponding preset defined signals.

[0121] Specifically, such as Figure 8 As shown, step S7 includes:

[0122] S701. Treat the highest bit of the undefined signal as the sign bit, and determine whether the undefined signal meets the first physical signal determination condition. If so, determine the undefined signal as a physical signal.

[0123] For each undefined signal, its sign format is first checked, treating the highest bit of the undefined signal as the sign bit before translation. If the first physical signal determination condition is met after changing the sign format, the undefined signal correction is complete. It's understandable that the sign format only affects the physical signal.

[0124] S702. If the undefined signal does not meet the first physical signal determination condition, the byte order of the undefined signal is updated to LE, and it is determined whether the undefined signal meets any signal determination condition. If so, the undefined signal is determined as the corresponding preset defined signal.

[0125] If the signal remains undefined after changing the symbol format, then the byte order of the signal is changed, i.e., from BE to LE. The signal with the modified byte order is then translated. If the signal now meets any of the signal determination conditions, the signal correction is complete. These signal determination conditions include a cyclic signal determination condition, a first physical signal determination condition, a first check signal determination condition, and a multi-valued signal determination condition.

[0126] S703. If the undefined signal does not meet any signal determination condition, then the highest bit of the undefined signal is again regarded as the sign bit, and it is determined whether the undefined signal meets the first physical signal determination condition. If so, the undefined signal is determined as a physical signal.

[0127] If the signal remains undefined after modifying the byte order, then its symbol format is changed based on the modified byte order signal. If the first physical signal determination condition is met after changing the symbol format, then the signal correction is complete.

[0128] After correcting each undefined signal in turn, if there are no more undefined signals, it proves that all undefined signals have been successfully corrected, and the correction of signals for this ID ends. If undefined signals still exist, there are only two possibilities: stuck signals or misjudged signals. Therefore, in order to further identify undefined signals, such as... Figure 9 As shown, step S703 further includes:

[0129] S703-A: If the undefined signal does not meet the first physical signal determination condition, then determine whether the undefined signal meets the second physical signal determination condition. If so, then determine the undefined signal as a physical signal.

[0130] Specifically, the second physical signal determination condition is obtained using the following formula:

[0131] sig_len>4&&max ad ==1&&x n <1&&uv s >0.2·2 sig_len

[0132] Where sig_len represents the signal length, and max ad x represents the maximum absolute value of the first-order difference sequence of the signal. n uv represents the standardized variance of the first-order difference sequence of the signal. s This indicates the number of unique values ​​in the signal trajectory.

[0133] S703-B: If the undefined signal does not meet the second physical signal determination condition, then continue to determine whether the undefined signal meets the second verification signal determination condition. If it does, then the undefined signal is determined as a verification signal.

[0134] Specifically, the second verification signal determination condition is obtained using the following formula:

[0135] UV s >0.9·2 sig_len &&x n >2

[0136] S703-C: If an undefined signal does not meet the second verification signal determination condition, then the undefined signal is determined as a multi-valued signal.

[0137] It should be noted that misclassified signals only apply to physical signals; adhesion signals are not classified separately but are mixed with check signals and multi-valued signals. In fact, almost all adhesion signals are eventually classified as multi-valued signals.

[0138] This invention provides a first-order differential method for in-vehicle CAN bus reverse engineering. It requires no additional external devices, CAN configuration files, or prior knowledge of the target vehicle; it only requires analysis of the target vehicle's CAN bus communication data. This method is highly versatile and easy to implement. It considers more practical and complex signal scenarios, enabling more precise signal boundary delineation. Instead of using deep learning algorithms, it starts from the signal characteristics themselves and uses pure mathematical methods for signal classification, resulting in strong interpretability. It fully considers and solves the problem of existing methods neglecting signal format, and can automatically identify and correct signal formats.

[0139] Based on the above in-vehicle CAN bus reverse engineering method, such as Figure 10 As shown, this embodiment of the invention provides an in-vehicle CAN bus reverse engineering system based on first-order differential, comprising:

[0140] ID whitelist generation module 1 is used to obtain CAN bus communication data of the target vehicle under normal driving conditions and record all IDs in the CAN bus communication data to form an ID whitelist for the CAN bus.

[0141] ID data trajectory extraction module 2 is used to extract the ID data trajectory corresponding to each ID in the ID whitelist from the CAN bus communication data; the ID data trajectory is multiple data entries containing the corresponding ID in the CAN bus communication data;

[0142] Bit flip rate calculation module 3 is used to calculate the bit flip rate of each bit in the ID data trajectory;

[0143] Signal boundary division module 4 is used to divide the signal boundary of the ID data trajectory according to the bit flip rate and a preset signal boundary division rule;

[0144] The first-order difference analysis module 5 is used to extract the signal trajectory corresponding to each signal from the ID data trajectory based on the signal boundary, and perform first-order difference analysis on the signal trajectory to obtain the first-order difference features of the signal; the first-order difference features include at least the signal length, the number of unique values ​​of the signal trajectory, the mean of the first-order difference sequence of the signal, the standardized variance of the first-order difference sequence of the signal, the number of unique values ​​of the first-order difference sequence of the signal, and the maximum absolute value of the first-order difference sequence of the signal.

[0145] The signal translation module 6 is used to classify signals based on first-order difference features to obtain the signal category; the category includes predefined signals and undefined signals. The predefined signals include physical signals, check signals, cyclic signals and multi-valued signals.

[0146] It should be noted that the modules in the aforementioned in-vehicle CAN bus reverse engineering system based on first-order differential can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can call and execute the corresponding operations of each module. For specific limitations regarding the in-vehicle CAN bus reverse engineering system based on first-order differential, please refer to the limitations of the in-vehicle CAN bus reverse engineering method based on first-order differential above; both have the same function and role, and will not be repeated here.

[0147] This invention also provides a terminal device, which includes:

[0148] Processor, memory, and bus;

[0149] The bus is used to connect the processor and the memory;

[0150] The memory is used to store operation instructions;

[0151] The processor is configured to execute operations corresponding to the in-vehicle CAN bus reverse engineering method based on first-order differential as described above by invoking the operation instructions.

[0152] In one alternative embodiment, a terminal device is provided, such as Figure 11 As shown, Figure 11 The terminal device 5000 shown includes a processor 5001 and a memory 5003. The processor 5001 and the memory 5003 are connected, for example, via a bus 5002. Optionally, the terminal device 5000 may also include a transceiver 5004. It should be noted that in practical applications, the transceiver 5004 is not limited to one type, and the structure of this terminal device 5000 does not constitute a limitation on the embodiments of the present invention.

[0153] Processor 5001 may be a CPU, a general-purpose processor, a DSP, an ASIC, an FPGA, or other programmable logic device, transistor logic device, hardware component, or any combination thereof. It may implement or execute the various exemplary logic blocks, modules, and circuits described in connection with this disclosure. Processor 5001 may also be a combination that implements computational functions, such as including one or more microprocessor combinations, a combination of a DSP and a microprocessor, etc.

[0154] Bus 5002 may include a path for transmitting information between the aforementioned components. Bus 5002 may be a PCI bus or an EISA bus, etc. Bus 5002 can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 11 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0155] The memory 5003 may be a ROM or other type of static storage device capable of storing static information and instructions, RAM or other type of dynamic storage device capable of storing information and instructions, or it may be an EEPROM, CD-ROM or other optical disc storage, optical disc storage (including compressed optical discs, laser discs, optical discs, digital universal optical discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but is not limited thereto.

[0156] The memory 5003 is used to store application code that executes the present invention, and its execution is controlled by the processor 5001. The processor 5001 is used to execute the application code stored in the memory 5003 to implement the content shown in any of the foregoing method embodiments.

[0157] Terminal devices include, but are not limited to: mobile terminals such as mobile phones, laptops, digital radio receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), and in-vehicle terminals (such as in-vehicle navigation terminals), as well as fixed terminals such as digital TVs and desktop computers.

[0158] This invention also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the above-described in-vehicle CAN bus reverse engineering method based on first-order differential.

[0159] Another embodiment of the present invention provides a computer-readable storage medium storing a computer program that, when run on a computer, enables the computer to execute the corresponding content in the foregoing method embodiments.

[0160] Furthermore, embodiments of the present invention also provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the above-described method.

[0161] In summary, the present invention provides a method, system, device, and medium for in-vehicle CAN bus reverse engineering based on first-order differential. It requires no additional external devices, CAN configuration files, or any prior knowledge of the target vehicle; it only requires analysis of the target vehicle's CAN bus communication data. This makes it highly versatile and easy to implement. It considers more practical and complex signal situations, enabling more accurate signal boundary delineation. Instead of using deep learning algorithms, it starts from the signal characteristics themselves and uses pure mathematical methods for signal classification, resulting in strong interpretability. It fully considers and solves the problem of existing methods neglecting signal format, and can automatically identify and correct signal formats.

[0162] The various embodiments in this specification are described in a progressive manner. For directly identical or similar parts of the embodiments, refer to each other. Each embodiment focuses on its differences from other embodiments. In particular, the system embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments. It should be noted that the technical features of the above embodiments can be combined arbitrarily. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as the combination of these technical features does not contradict each other, it should be considered within the scope of this specification.

[0163] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and substitutions can be made without departing from the technical principles of the present invention, and these improvements and substitutions should also be considered within the scope of protection of the present invention.

Claims

1. A method for reverse engineering an in-vehicle CAN bus based on first-order differential, characterized in that, include: Acquire the CAN bus communication data of the target vehicle under normal driving conditions, and record all IDs in the CAN bus communication data to form a whitelist of IDs for the CAN bus; Extract the ID data trajectory corresponding to each ID in the ID whitelist from the CAN bus communication data; the ID data trajectory consists of multiple data entries containing the corresponding ID in the CAN bus communication data. Calculate the bit flip rate of each bit in the ID data trajectory; Based on the bit flip rate, the signal boundary of the ID data trajectory is divided according to a preset signal boundary division rule; Based on the signal boundary, extract the signal trajectory corresponding to each signal from the ID data trajectory, and perform first-order difference analysis on the signal trajectory to obtain the first-order difference features of the signal; The first-order difference features include at least the signal length, the number of unique values ​​in the signal trajectory, the mean of the first-order difference sequence of the signal, the standardized variance of the first-order difference sequence of the signal, the number of unique values ​​in the first-order difference sequence of the signal, and the maximum absolute value of the first-order difference sequence of the signal. The signal is classified according to the first-order difference feature to obtain the category of the signal; the category includes a predefined signal and an undefined signal, and the predefined signal includes physical signal, check signal, cyclic signal and multi-valued signal.

2. The in-vehicle CAN bus reverse engineering method according to claim 1, characterized in that, After classifying the signal according to the first-order difference feature to obtain the signal category, the method further includes: The undefined signal is corrected according to the preset format correction rules so that the undefined signal is classified into the corresponding preset defined signal.

3. The in-vehicle CAN bus reverse engineering method according to claim 1, characterized in that, The step of dividing the signal boundary of the ID data trajectory according to the bit flip rate and a preset signal boundary division rule includes: Based on the bit flip rate, the signal boundary of the counter signal with a preset bit flip rate characteristic is defined; the preset bit flip rate characteristic is obtained using the following formula: Where bfr represents the bit flip rate vector, and n represents the bit length of the signal; Determine whether the current bit satisfies any preset boundary condition. If so, the current bit is determined as the signal boundary. The preset boundary conditions include the bit flip rate of the next bit being 0, the next bit being the bit to which the counter signal belongs, the next bit being beyond the bit length of the signal, and the bit flip rate of the next bit being less than the bit flip rate of the current bit and the bit flip rate of the current bit not being greater than a first threshold.

4. The in-vehicle CAN bus reverse engineering method according to claim 3, characterized in that, If the current bit satisfies the following preset boundary conditions: the bit flip rate of the next bit is less than the bit flip rate of the current bit and the bit flip rate of the current bit is greater than the first threshold, then it is determined whether the difference between the bit flip rate of the current bit and the bit flip rate of the next bit is not greater than the second threshold. If so, the next bit is assigned to the signal boundary; otherwise, the current bit is determined as the signal boundary.

5. The in-vehicle CAN bus reverse engineering method according to claim 2, characterized in that, The step of classifying the signal based on the first-order difference feature to obtain the signal category includes: Determine whether the signal meets the cyclic signal determination condition. If so, the signal is determined to be the cyclic signal. The cyclic signal determination condition is that the maximum absolute value of the first-order difference sequence of the signal has the same interval in the first-order difference sequence of the signal. If the signal does not meet the cyclic signal determination condition, then it is further determined whether the signal meets the first physical signal determination condition. If so, the signal is determined as the physical signal. The first physical signal determination condition is obtained using the following formula: sig_len>4&&uv s <0.9·2 sig_len &&x n <1&&1<max ad <2 sig_len-1 Where sig_len represents the signal length, uv s x represents the number of unique values ​​in the signal trajectory. n Max represents the standardized variance of the first-order difference sequence of the signal. ad This represents the maximum absolute value of the first-order difference sequence of the signal; If the signal does not meet the first physical signal determination condition, then it is further determined whether the signal meets the first verification signal determination condition. If so, the signal is determined as the verification signal. The first verification signal determination condition is obtained using the following formula: Among them, uv d This represents the number of unique values ​​in the first-order difference sequence of a signal. If the signal does not meet the first verification signal determination condition, then it is further determined whether the signal meets the multi-value signal determination condition. If so, the signal is determined as the multi-value signal. The multi-value signal determination condition is obtained using the following formula: μ==0||sig_len<=2||[sig_len>=3&&max ad >1&&(prpo0>0.9||uv d >max ad )] Where μ represents the mean of the first-order difference sequence of the signal, and prpo0 represents the proportion of 0 in the first-order difference sequence of the signal; If the signal does not meet the multi-valued signal determination condition, then the signal is determined to be the undefined signal.

6. The in-vehicle CAN bus reverse engineering method according to claim 5, characterized in that, The step of correcting the undefined signal according to a preset format correction rule, so that the undefined signal is classified into the corresponding preset defined signal, includes: The highest bit of the undefined signal is regarded as the sign bit, and it is determined whether the undefined signal meets the first physical signal determination condition. If so, the undefined signal is determined as the physical signal. If the undefined signal does not meet the first physical signal determination condition, the byte order of the undefined signal is updated to LE, and it is determined whether the undefined signal meets any signal determination condition. If so, the undefined signal is determined as the corresponding preset defined signal. The signal determination conditions include a cyclic signal determination condition, a first physical signal determination condition, a first check signal determination condition, and a multi-value signal determination condition. If the undefined signal does not meet any of the signal determination conditions, then the highest bit of the undefined signal is again regarded as the sign bit, and it is determined whether the undefined signal meets the first physical signal determination condition. If so, the undefined signal is determined as the physical signal.

7. The in-vehicle CAN bus reverse engineering method according to claim 6, characterized in that, The step of again treating the highest bit of the undefined signal as the sign bit and determining whether the undefined signal satisfies the first physical signal determination condition further includes: If the undefined signal does not meet the first physical signal determination condition, then it is determined whether the undefined signal meets the second physical signal determination condition. If so, the undefined signal is determined as the physical signal. The second physical signal determination condition is obtained using the following formula: sig_len>4&&max ad ==1&&x n <1&&uv s >0.2·2 sig_len Where sig_len represents the signal length, and max ad x represents the maximum absolute value of the first-order difference sequence of the signal. n uv represents the standardized variance of the first-order difference sequence of the signal. s Indicates the number of unique values ​​in the signal trajectory; If the undefined signal does not meet the second physical signal determination condition, then it is further determined whether the undefined signal meets the second verification signal determination condition. If so, the undefined signal is determined as the verification signal. The second verification signal determination condition is obtained using the following formula: uv s >0.9·2 sig_len &&x n >2 If the undefined signal does not meet the second verification signal determination condition, then the undefined signal is determined to be the multi-valued signal.

8. A vehicle-mounted CAN bus reverse engineering system based on first-order differential, characterized in that, include: The ID whitelist generation module is used to obtain the CAN bus communication data of the target vehicle under normal driving conditions and record all IDs in the CAN bus communication data to form the ID whitelist of the CAN bus. The ID data trajectory extraction module is used to extract the ID data trajectory corresponding to each ID in the ID whitelist from the CAN bus communication data; the ID data trajectory is multiple data entries containing the corresponding ID in the CAN bus communication data; The bit flip rate calculation module is used to calculate the bit flip rate of each bit in the ID data trajectory; The signal boundary division module is used to divide the signal boundary of the ID data trajectory according to the bit flip rate and a preset signal boundary division rule. The first-order difference analysis module is used to extract the signal trajectory corresponding to each signal from the ID data trajectory according to the signal boundary, and perform first-order difference analysis on the signal trajectory to obtain the first-order difference features of the signal. The first-order difference features include at least the signal length, the number of unique values ​​in the signal trajectory, the mean of the first-order difference sequence of the signal, the standardized variance of the first-order difference sequence of the signal, the number of unique values ​​in the first-order difference sequence of the signal, and the maximum absolute value of the first-order difference sequence of the signal. The signal translation module is used to classify the signal according to the first-order difference feature to obtain the category of the signal; the category includes a preset defined signal and an undefined signal, and the preset defined signal includes physical signal, check signal, cyclic signal and multi-valued signal.

9. A terminal device, characterized in that, It includes a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein the processor, when executing the computer program, implements the in-vehicle CAN bus reverse method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored computer program, wherein, when the computer program is executed, it controls the device where the computer-readable storage medium is located to perform the in-vehicle CAN bus reverse method as described in any one of claims 1 to 7.

Images