Automating the Reverse Engineering of CAN Bus Protocols with Physics-driven Traffic Analysis#

Eric Wagner (University of Luxembourg), Matteo Frigo (Polytechnic University of Turin)

• Why: Signals where the field is heading: passive, fully-automated protocol RE that collapses what took days into minutes — with obvious carry-over to other CPS/OT traffic and an explicit warning about pairing with LLM-driven exploit generation.
• What: A fully automated method that identifies the CAN bitfields encoding physical vehicle features (speed, acceleration, throttle) from raw passive traffic in minutes, on previously unseen models with no documentation — replacing manual/fuzzing/heuristic RE that demanded persistent access and expert time. Demonstrated on multiple vehicles.
• How: Search traffic traces for the bitfields that best fit known physics-based relationships between variables (e.g., the mathematical link between speed and acceleration) — the physics invariant is the oracle.
• Where applicable: CAN-equipped vehicles today; the generalizable idea applies to any CPS/OT protocol whose traffic reflects physical constraints. Needs only passive capture of the target network, which is what makes the impact assessment sobering. (from abstract only)