Resumen
Traditional mechanical parts have been increasingly replaced by in-vehicle electronic control units (ECUs) that communicate via control area networks (CAN). For security reasons, the Database CAN (DBC) file, which defines the contents of CAN messages, is deemed confidential by original equipment manufacturers (OEMs). However, confidentiality has severely hindered research on automotive intrusion detection systems (IDS) and automotive control network testing, which makes automotive aftermarket device development difficult. Previous research has used tokenization algorithms, machine learning algorithms, and diagnostic information to obtain coarse CAN message contents. However, there is a large gap between the results obtained with these methods and the information contained in DBC files. In order to reverse CAN messages in a fine-grained manner, we propose a method to reverse a body-related CAN message based on tagged bits. This method tags data bits by collecting CAN traffic in different vehicle states. The test messages are obtained by fuzzing the CAN messages based on the tagging results, and the candidate messages are obtained by combining them with the results of a packet analysis. The final reverse result was based on the column AND bit-by-bit of the candidate messages. The reverse results showed that the method proposed in this paper could accurately locate the bits representing or controlling the body behavior with high reverse accuracy.