Controller Area Network Messages Research Articles

A Novel Architecture for an Intrusion Detection System Utilizing Cross-Check Filters for In-Vehicle Networks.

The Controller Area Network (CAN), widely used for vehicular communication, is vulnerable to multiple types of cyber-threats. Attackers can inject malicious messages into the CAN bus through various channels, including wireless methods, entertainment systems, and on-board diagnostic ports. Therefore, it is crucial to develop a reliable intrusion detection system (IDS) capable of effectively distinguishing between legitimate and malicious CAN messages. In this paper, we propose a novel IDS architecture aimed at enhancing the cybersecurity of CAN bus systems in vehicles. Various machine learning (ML) models have been widely used to address similar problems; however, although existing ML-based IDS are computationally efficient, they suffer from suboptimal detection performance. To mitigate this shortcoming, our architecture incorporates specially designed rule-based filters that cross-check outputs from the traditional ML-based IDS. These filters scrutinize message ID and payload data to precisely capture the unique characteristics of three distinct types of cyberattacks: DoS attacks, spoofing attacks, and fuzzy attacks. Experimental evidence demonstrates that the proposed architecture leads to a significant improvement in detection performance across all utilized ML models. Specifically, all ML-based IDS achieved an accuracy exceeding 99% for every type of attack. This achievement highlights the robustness and effectiveness of our proposed solution in detecting potential threats.

A Mixed-Criticality Traffic Scheduler with Mitigating Congestion for CAN-to-TSN Gateway

The network architecture that Time-Sensitive Networking (TSN) is used as the backbone network and the Controller Area Network (CAN) serves as the intra-domain network is considered as the CAN-TSN interconnection network architecture, which has gained considerable attention within industrial embedded networks, such as spacecraft, intelligent automobiles, and factory automation. The architecture employs the CAN-TSN gateway as a central hub for transmitting and managing a significant volume of communications between the CAN domains and TSN. However, the CAN-TSN gateway faces a high congestion challenge due to the rapid growth in data volume, making it difficult to effectively support different time planning mechanisms provided by TSN. In this paper, we propose a two-stage mixed-criticality traffic scheduler. The scheduler in the first stage adopts a Message Optimization Algorithm (MOA) to aggregate multiple CAN messages into a single TSN message (including the aggregation of critical and non-critical CAN messages), which reduces the number of CAN messages requiring transmission. In the second stage, the scheduler proposes a Message Scheduling Optimization Algorithm (MSOA) to schedule critical TSN messages. This algorithm reassembles all the critical CAN messages (within the un-schedulable TSN messages) to generate new TSN messages for rescheduling. Experimental results show that our proposed scheduler effectively improves the acceptance ratio of critical and non-critical CAN messages and outperforms the state-of-the-art message scheduling method in terms of acceptance ratio while improving the bandwidth utilization and the number of schedule table entries. We further construct a hardware platform to evaluate the performance of MSOA. The consistency between practical results and theoretical results shows the effectiveness of MSOA.

Windowed Hamming Distance-Based Intrusion Detection for the CAN Bus

The use of a Controller Area Network (CAN) bus in the automotive industry for connecting electronic control units (ECUs) poses security vulnerabilities due to the lack of built-in security features. Intrusion Detection Systems (IDSs) have emerged as a practical solution for safeguarding the CAN bus. However, developing an effective IDS for in-vehicle CAN buses encounters challenges in achieving high precision for detecting attacks and meeting real-time requirements with limited computational resources. To address these challenges, we propose a novel method for anomaly detection on CAN data using windowed Hamming distance. Our approach utilizes sliding windows and Hamming distance to extract features from time series data. By creating benchmark windows that span at least one cycle of data, we compare newly generated windows with recorded benchmarks using the Hamming distance to identify abnormal CAN messages. During the experimental phase, we conduct extensive testing on both the public car-hack dataset and a proprietary dataset. The experimental results indicate that our method achieves an impressive accuracy of up to 99.67% in detecting Denial of Service (DoS) attacks and an accuracy of 98.66% for fuzzing attacks. In terms of two types of spoofing attacks, our method achieves detection accuracies of 99.48% and 99.61%, respectively, significantly outperforming the methods relying solely on the Hamming distance. Furthermore, in terms of detection time, our method significantly reduces the time consumption by nearly 20-fold compared to the approach using deep convolutional neural networks (DCNN), decreasing it from 6.7 ms to 0.37 ms.

A multidisciplinary detection system for cyber attacks on Powertrain Cyber Physical Systems

With the introduction of external connectivity to modern vehicles, both academic and industry security practitioners addressed the issues related to external communication interfaces exposing internal networks that are used to control the different vehicle’s systems. Despite these issues are considered having little-to-no impact on the functioning of the vehicle itself due to their demand of physical connection, with the advent of cellular connectivity proof-of-concept and demonstrations of remote takeover of the vehicle have been showcased, raising awareness about the risks related to the introduction of external connectivity on the vehicle system. All these remote attacks demonstrated by security researchers exploited several vulnerabilities to gain remote access to the Controller Area Network (CAN), one of the most deployed in-vehicle communication protocol. In these works, the authors demonstrate how to exploit the drive-by-wire features of modern vehicles to jeopardize people inside and outside the vehicle. To address this issue, several researchers designed algorithms to detect the injection of malicious CAN messages. However, these solutions are focused on the only CAN communication, without considering all the other subsystems that can be used by an attacker to hijack the vehicular system. Due to their high complexity, modern vehicle can be seen as Cyber–Physical Systems, in which the physical system (i.e. the mechanics of the vehicle) are controlled via software hosted on microcontrollers that communicate with each other via different communication protocols. Hence, to properly address the cybersecurity of a modern vehicle it is necessary to consider all the different aspects of the system, without focusing on a single one. In this work we investigate the capabilities of a multidisciplinary approach for anomaly detection based for securing the powertrain system of a generic vehicle. The experimental analysis presented in this paper is based on the model of a generic internal combustion engine and a speed controller, communicating via CAN. Four different detection methods from both control theory and computer security are tested against cyber attacks carried out from different contexts. Our threat model is composed by different attack scenarios representative of known cyber-attacks targeting modern vehicles. The experimental evaluation presented in this work highlights the strengths and weaknesses of each detection method against different attack scenarios carried out on the different components of our system. To the best of our knowledge, this is the first paper addressing the cyber security of the connected vehicle with a multidisciplinary approach.

Performance comparison of timing-based anomaly detectors for Controller Area Network: a reproducible study

This work presents an experimental evaluation of the detection performance of eight different algorithms for anomaly detection on the Controller Area Network (CAN) bus of modern vehicles based on the analysis of the timing or frequency of CAN messages. This work solves the current limitations of related scientific literature, that is based on private dataset, lacks of open implementations, and detailed description of the detection algorithms. These drawback prevent the reproducibility of published results, and makes it impossible to compare a novel proposal against related work, thus hindering the advancement of science. This paper solves these issues by publicly releasing implementations, labeled datasets and by describing an unbiased experimental comparisons.

Intrusion Detection in Intelligent Connected Vehicles Based on Weighted Self-Information

The Internet of Vehicles (IoV) empowers intelligent and tailored services for intelligent connected vehicles (ICVs). However, with the increasing number of onboard external communication interfaces, ICVs face the challenges of malicious network intrusions. The closure of traditional vehicles had led to in-vehicle communication protocols, including the most commonly applied controller area network (CAN), and a lack of security and privacy protection mechanisms. Therefore, to protect the connected vehicles and IoV systems from being attacked, an intrusion-detection method is proposed based on the features extracted from the arbitration identifier (ID) field of CAN messages. Specifically, a sliding window is used to continuously extract a frame of streaming CAN messages first. Afterward, the weighted self-information of the CAN message ID is defined, and both the weighted self-information and the normalized value of an ID are extracted as features. Based on the extracted features, a lightweight one-class classifier, the local outlier factor (LOF), is used to identify the outliers and detect malicious network intrusion attacks. Simulation experiments were conducted based on the public CAN dataset provided by the HCR Lab. The proposed method, using four different one-class classifiers, was analyzed, and it is also benchmarked with three information entropy-based intrusion-detection methods in the literature. The experimental results indicate that, compared to the benchmarks, the proposed method dramatically improves the detection accuracy for injection attacks, namely denial-of-service (DoS) and spoofing, especially when the number of injected messages is low.

Ground Fault Diagnostics for Automotive Electronic Control Units

An electronic control unit (ECU) with a floating ground is not able to receive or transmit messages or participate in controller area network (CAN) communication. The absence of any ECU, either temporarily or permanently, negatively impacts vehicle functionalities. The offset ground, which by itself will not affect bus functionalities if the grounding resistance is small, however, may evolve into a floating ground or behave similarly if the resistance is large. In this work, the correlation among ground faults, either offset or floating, and CAN bus voltage or messages are analyzed based on the equivalent circuit models and the bus protocol. A voltage-based solution to detect ground faults is proposed. With the help of bus messages, both faults can be isolated at the ECU level. Considering the inherent system delay between the message fetching and voltage measurement, a normalized voltage-message correlation approach with the bus load estimation is developed as well. All proposed approaches are implemented to an Arduino-based embedded system and validated on a vehicle frame.

Flooding attack mitigator for in-vehicle CAN using fault confinement in CAN protocol

For driver convenience and safety, a number of electronic control units (ECUs) have been installed on modern vehicles. To support communications among ECUs, the controller area network (CAN) is commonly used as in-vehicle network for several decades. However, the CAN protocol lacks security mechanisms, which means that it can be damaged by a number of cyber attacks. In particular, message flooding is one type of DoS attack known to be the easiest to perform because it continuously broadcasts a large number of CAN messages to the in-vehicle CAN without any CAN traffic analysis. To handle message flooding on the in-vehicle CAN, several countermeasures including intrusion detection and prevention have been studied, but unfortunately, these solutions could produce false positive detection rates or cause the communication failures of benign ECUs. In this paper, we introduce a message flooding attack mitigation method for the first time that does not accidentally cause the communication failures of benign ECUs. The proposed method can mitigate flooding attack attempts by using the fault confinement rule that is defined in the CAN protocol. Since the proposed method does not violate the rules of the CAN standard during mitigating, no system modifications are required. Experimental results show that the proposed mitigator guarantees a transmission rate up to 79.22% of normal messages that were not sent due to a flooding attack.

A Survey on Controller Area Network Reverse Engineering

Controller Area Network (CAN) is a masterless serial bus designed and widely used for the exchange of mission and time-critical information within commercial vehicles. Invehicle communication is based on messages sent and received by Electronic Control Units (ECUs) connected to this serial bus network. Although unencrypted, CAN messages are not easy to interpret. In fact, Original Equipment Manufacturers (OEMs) attempt to achieve security through obscurity by encoding the data in their proprietary format, which is kept secret from the general public. As a result, the only way to obtain clear data is to reverse engineer CAN messages. Driven by the need for in-vehicle message interpretation, which is highly valuable in the automotive industry, researchers and companies have been working to make this process automated, fast, and standardized. In this paper, we provide a comprehensive review of the state of the art and summarize the major advances in CAN bus reverse engineering. We are the first to provide a taxonomy of CAN tokenization and translation techniques. Based on the reviewed literature, we highlight an important issue: the lack of a public and standardized dataset for the quantitative evaluation of translation algorithms. In response, we define a complete set of requirements for standardizing the data collection process. We also investigate the risks associated with the automation of CAN reverse engineering, in particular with respect to the security network and the safety and privacy of drivers and passengers. Finally, we discuss future research directions in CAN reverse engineering.

A Novel Detection Approach of Unknown Cyber-Attacks for Intra-Vehicle Networks Using Recurrence Plots and Neural Networks

Proliferation of connected services in modern vehicles could make them vulnerable to a wide range of cyber-attacks through intra-vehicle networks that connect various vehicle systems. Designers usually equip vehicles with predesigned counter-measures, but these may not be effective against novel cyber-attacks. Intrusion Detection Systems (IDSs) serve as an additional layer of defence when conventional measures that are implemented by the designers fail. Several intrusion detection techniques, such as rule-based IDS, have been proposed in the literature but these techniques have limited capability in detecting novel cyber-attacks. This paper proposes a new Machine Learning (ML)-based IDS for detecting novel cyber-attacks in intra-vehicle networks, specifically in Controller Area Networks (CANs). The proposed IDS generates high-level representations of CAN messages transmitted on the bus exploiting their temporal properties as well as the intra and inter message dependencies through the use of Recurrence Plot (RP), which are then fed into a bespoke Neural Network, designed and trained to detect novel intrusions. Evaluations of the performance of the proposed IDS in comparison with that of the state-of-the-art existing IDS schemes namely Decision Tree (DT), Random Forest (RF) and other well-known approaches demonstrate the superiority of the proposed IDS in this paper.

A CAN Bus Security Testbed Framework for Automotive Cyber-Physical Systems

The popularization of electronic devices and the enrichment of external interfaces have increased the attack surface of the automotive cyber-physical system (CPS). As a vital part of the CPS, the controller area network (CAN) is more vulnerable to security threats due to the lack of corresponding security protection mechanisms. This kind of security problem has also attracted extensive attention from academia and industry. Researchers have proposed numerous intrusion detection models for the in-vehicle CAN bus, solving some security problems to a certain extent. However, vehicle manufacturers seldom disclose the internal details of vehicle ECUs due to safety concerns. Thus, it is difficult for researchers to investigate the operation mechanism of the bus. Meanwhile, there is a risk of personal safety in completing attack experiments on real vehicles, which can also lead to the lack and diversification of in-vehicle network data, especially the data of attack behavior. Based on real vehicle data, an open, adaptable, and low-risk CAN bus security testbed framework in the automotive CPS is proposed in this study, aiming to enrich the operation data of the CAN bus and enhance the personal safety of researchers. Besides, the delay of the testbed sending and receiving periodic and aperiodic CAN messages is theoretically explored. The results demonstrate that the generated timestamp in the dataset is mainly associated with the timestamp of the real vehicle data and that the transmission and collection of time series data are completed by Algorithm 1 and Algorithm 2. In the evaluation of the security testbed, the stability of the security testbed is studied from the two indicators of delay and packet loss rate. The experiment reveals that the testbed has a small relative delay difference and a low packet loss rate. Moreover, the DTW algorithm is employed to calculate the distance between the real vehicle and the testbed, and the experimental results demonstrate that the testbed is featured with high similarity and simulation.

Illegal Intrusion Detection for In-Vehicle CAN Bus Based on Immunology Principle

The controller area network (CAN) bus has become one of the most commonly used protocols in automotive networks. Some potential attackers inject malicious data packets into the CAN bus through external interfaces for implementing illegal operations (intrusion). Anomaly detection is a technique for network intrusion detection which can detect malicious data packs by comparing the normal data packets with incoming data packets obtained from the network traffic. The data of a normal network is in a symmetric and stable state, which will become asymmetric when compromised. Considering the in-vehicle network, the CAN bus is symmetrically similar to the immune system in terms of internal network structure and external invasion threats. In this work, we use an intrusion detection method based on the dendritic cell algorithm (DCA). However, existing studies suggest the use of optimization methods to improve the accuracy of classification algorithms, and the current optimization of the parameters of the detection method mostly relies on the manual tuning of the parameters, which is a large workload. In view of the above challenges, this paper proposes a new detection algorithm based on the particle swarm optimization algorithm (PSO) and gravitational search algorithm (GSA) to improve the dendritic cell algorithm (PSO-GSA-DCA). PSO-GSA-DCA achieves adaptive parameter tuning and improves detection accuracy by mixing optimization algorithms and using them to optimize the dendritic cell algorithm classifier. Additionally, DCA-based CAN message attribute matching rules (measured by information gain and standard deviation of CAN data) are proposed for matching the three input signals (PAMP, DS, SS) of the DCA. The experimental results show that our proposed scheme has a significant improvement in accuracy, which can reach 91.64%, and lower time loss compared with other correlation anomaly detection schemes. Our proposed method also enables adaptive tuning, which solves the problem that most models now rely on manual tuning.

Bit-Level Automotive Controller Area Network Message Reverse Framework Based on Linear Regression.

Modern intelligent and networked vehicles are increasingly equipped with electronic control units (ECUs) with increased computing power. These electronic devices form an in-vehicle network via the Controller Area Network (CAN) bus, the de facto standard for modern vehicles. Although many ECUs provide convenience to drivers and passengers, they also increase the potential for cyber security threats in motor vehicles. Numerous attacks on vehicles have been reported, and the commonality among these attacks is that they inject malicious messages into the CAN network. To close the security holes of CAN, original equipment manufacturers (OEMs) keep the Database CAN (DBC) file describing the content of CAN messages, confidential. This policy is ineffective against cyberattacks but limits in-depth investigation of CAN messages and hinders the development of in-vehicle intrusion detection systems (IDS) and CAN fuzz testing. Current research reverses CAN messages through tokenization, machine learning, and diagnostic information matching to obtain details of CAN messages. However, the results of these algorithms yield only a fraction of the information specified in the DBC file regarding CAN messages, such as field boundaries and message IDs associated with specific functions. In this study, we propose multiple linear regression-based frameworks for bit-level inversion of CAN messages that can approximate the inversion of DBC files. The framework builds a multiple linear regression model for vehicle behavior and CAN traffic, filters the candidate messages based on the decision coefficients, and finally locates the bits describing the vehicle behavior to obtain the data length and alignment based on the model parameters. Moreover, this work shows that the system has high reversion accuracy and outperforms existing systems in boundary delineation and filtering relevant messages in actual vehicles.

Efficient ECU Analysis Technology Through Structure-Aware CAN Fuzzing

Modern vehicles are equipped with a number of electronic control units (ECUs), which control vehicles efficiently by communicating with each other through the controller area network (CAN). However, the CAN is known to be vulnerable to cyber attacks because it does not have any security mechanisms. To find vulnerable CAN messages that can control safety-critical functions in ECUs, researchers have studied CAN fuzzing methods. In existing CAN fuzzing methods, fuzzing input values are generally generated at random without considering the structure of CAN messages, resulting in non-negligible CAN fuzzing time. In addition, existing fuzzing solutions have limited monitoring capabilities of the fuzzing results. In this paper, we propose a Structure-aware CAN Fuzzing protocol, in which the structure of CAN messages is considered and fuzzing input values are systematically generated to locate vulnerable functions in ECUs. Our proposed Structure-aware CAN Fuzzing system takes less time to run than existing solutions, meaning that problematic CAN messages that may have originated from SW implementation errors or CAN DBC (database CAN) design errors can be found quickly and, subsequently, appropriate action can be taken. Finally, we evaluated the performance of our Structure-aware CAN Fuzzing system on two real vehicles. We proved that our proposed method can find CAN messages that control safety-critical functions in ECUs faster than existing fuzzing solutions.

GAN model using field fuzz mutation for in-vehicle CAN bus intrusion detection.

Controller area network (CAN) are widely used in smart vehicles to realize information interactions between electronic control units and other devices in vehicles. Owing to an increase in external communication interfaces, the cybersecurity of in-vehicle CAN bus networks is threatened. In-vehicle CAN intrusion detection systems with high detection rates and low false-negative rates have become important security protection measures for automotive networks. The boundary of the current machine learning-based in-vehicle CAN bus intrusion detection algorithm to determine the anomalous behavior triggered by CAN messages is unclear, and a validity check is required after the intrusion detection algorithm is designed. To solve the low coverage rate problem in the process of validating intrusion detection algorithms, an in-vehicle CAN fuzz-testing message generation model, the field-associative mutation generation adversarial network (FAMGAN), is proposed. To improve the defects of high randomness in generating messages in traditional fuzz-testing algorithms, FAMGAN adopts field division based on a conditional random field and the field association method based on the Apriori algorithm. Experiments were conducted on a real car using a code-built intrusion detection algorithm. The results demonstrate that FAMGAN can efficiently generate anomalous CAN messages and evaluate the performance of an in-vehicle CAN intrusion detection algorithm.

Asymmetric Symbol and Skew Sender Identification for Automotive Networks

Over recent years, many vulnerabilities have been exposed in vehicles, whose probability of occurrence will rise in the future due to connectivity and increasing system complexity. Even more serious that the Controller Area Network (CAN), widely used by Electronic Control Units (ECUs) to exchange safety-critical messages within a vehicle, does not provide any security measures. In this context, Intrusion Detection Systems (IDSs) have recently been proposed that use time characteristics in the analog transmission signal to identify the sending ECU and detect unauthorized messages. However, realistic application of proposed approaches is not yet tangible, with the full potential of time-based systems yet to be determined. In this elaboration, we therefore establish a foundation by working out robust time characteristics first and analyze root causes for their variation between ECUs. Combining the results with insights from related research, we deduce properties which help to design reliable and feasible IDSs for CAN. Finally, we emphasize these properties by presenting ASSASSIN, an IDS that uses time characteristics to identify the sender of a CAN message and assess authenticity. Achieving an average detection rate of 99.02 %, real-time capable classification and an adaptability to temperature fluctuations, we demonstrate the potential of time-based IDSs on a prototype setup and a real vehicle using resource-limited hardware, also contrasting them with well-elaborated voltage-based IDSs.

Third-Party Vehicle Data Collection for Advanced Driver Assistance Systems Analysis

Logs of vehicle controller area network (CAN) bus traffic supplemented by accelerometer and GPS data can provide valuable information about the use and operation of advanced driver assistance systems (ADAS) to the broader safety research community. Although CAN bus message codes are often manufacturer-specific, third-party libraries provide partial decoding of messages from many vehicle models, which can be augmented by reverse-engineering additional signals. This study explored the value of CAN bus, accelerometer, and GPS data that were logged on a variety of light vehicle models with an emphasis on availability of lane keep assist/lane departure warning, and adaptive cruise control. This study demonstrated that in-vehicle ADAS variables such as system on/off status and whether the system is actively controlling the vehicle could be determined on a variety of vehicle types. Associated control variables such as steering wheel angle, gas pedal state, and brake pedal state could also be determined from most vehicles tested. CAN messages, together with roadway features identified via GPS location, can provide a richer understanding of ADAS efficacy. Comparisons of message structure between models may also inform standardization efforts for electronic data recorders and telematics.

Response Time Analysis for Nonperiodic CAN Message Based on GI/G/1 Queue Model

Controller area network (CAN) has wide applications in modern industrial control systems. Automobile manufacturers use this communication protocol for vehicle control, which is subject to real-time and high-reliability performance. However, with the increasing actuators gathered in the vehicle, time delay will lead to a serious problem for the vehicle safety and performance control. Thus, the information transmission stability of the CAN message needs to be investigated. In order to find out the delay response time of nonperiodic CAN message in the vehicle bus area, the response of the message transmitted in the CAN bus is modeled based on the GI/G/1 queue theory. The test platform is developed to verify the methodology. In the experimental test, some conditions with different IDs, load ratios, and priorities are investigated. Experimental results are compared with the theoretical results, and the simulation results show that the method is valid and verify the real response delay time of nonperiodic CAN message.

Deep Transfer Learning Based Intrusion Detection System for Electric Vehicular Networks.

The Controller Area Network (CAN) bus works as an important protocol in the real-time In-Vehicle Network (IVN) systems for its simple, suitable, and robust architecture. The risk of IVN devices has still been insecure and vulnerable due to the complex data-intensive architectures which greatly increase the accessibility to unauthorized networks and the possibility of various types of cyberattacks. Therefore, the detection of cyberattacks in IVN devices has become a growing interest. With the rapid development of IVNs and evolving threat types, the traditional machine learning-based IDS has to update to cope with the security requirements of the current environment. Nowadays, the progression of deep learning, deep transfer learning, and its impactful outcome in several areas has guided as an effective solution for network intrusion detection. This manuscript proposes a deep transfer learning-based IDS model for IVN along with improved performance in comparison to several other existing models. The unique contributions include effective attribute selection which is best suited to identify malicious CAN messages and accurately detect the normal and abnormal activities, designing a deep transfer learning-based LeNet model, and evaluating considering real-world data. To this end, an extensive experimental performance evaluation has been conducted. The architecture along with empirical analyses shows that the proposed IDS greatly improves the detection accuracy over the mainstream machine learning, deep learning, and benchmark deep transfer learning models and has demonstrated better performance for real-time IVN security.

An Enhanced Method for Reverse Engineering CAN Data Payload

Recently, numerous electronic components are installed in vehicles, providing drivers and passengers with increased safety and convenience. The electronic components construct an in-vehicle network that internally shares relevant status information about the vehicle. As modern vehicles become more computerized, the potential for automotive cyber-security threats also increases a fact that has been illustrated clearly by various car-hacking demonstrations. Using the controller area network (CAN), the de facto standard protocol in the automotive industry that facilitates in-vehicle network communication, car-hacking demonstrations inject critical CAN messages to control vehicular functions. In efforts to address this security issue, car manufacturers, in turn, have made confidential the CAN database (i.e., DBC format file), where signal information assigned in the CAN data payload is specified. However, it has since become known that this policy does not hermetically seal a vehicular network against cyber attacks. On the contrary, in-depth automotive security research has been hindered significantly because of the limited information accessible by researchers. For example, automotive intrusion detection systems (IDS) identify and alert when there is a vehicular break-in, and this technology is a major area of study in automotive cyber security research. For the automotive IDS that analyzes CAN traffic, information in the DBC format file greatly improves detection veracity. However, most IDS technologies to date have been independently developed without the confidential CAN DB information and, as a result, do not mitigate threats to a satisfactory standard. In this paper, we propose an enhanced method that identifies signal boundaries in a CAN data payload, which is specified in the DBC format file. Unlike an existing method that is designed based on total bit-flip rates, our method analyzes bit-flip time series not total bit-flip rates so that signal boundaries can be more clearly identified. In this paper, we use a publicly available DBC format file called OpenDBC as a reference, and show that our method outperforms the existing method.