Rajput, Pruthvish (Indian Institute of Science), Zaman, Ashhar (Indian Institute of Science, Bengaluru), Katewa, Vaibhav (Indian Institute of Science), Rathore, Punit (Indian Institute of Science)

PrefixCAN-Signal: PrefixSpan-Based Automatic Controller Area Network Signal Extraction

Scheduled for presentation during the Regular Session "S39a-Data-Driven Optimization in Intelligent Transportation Systems" (FR-LM-T39), Friday, November 21, 2025, 12:10−12:30, Coolangata 3

2025 IEEE 28th International Conference on Intelligent Transportation Systems (ITSC), November 18-21, 2025, Gold Coast, Australia

This information is tentative and subject to change. Compiled on October 18, 2025

Abstract

Modern vehicles rely heavily on Controller Area Network (CAN) communication for time-critical functions such as engine control and powertrain management. As vehicles become increasingly connected, they are more susceptible to cyber-attacks, making CAN-based intrusion detection essential. A robust intrusion detection system often leverages both the structural characteristics of CAN frames and the semantic content of their payloads. However, a major challenge in payload-based intrusion detection is the proprietary nature of CAN signal encoding, which varies across manufacturers and is typically not publicly available. This paper proposes PrefixCAN-Signal, a three-stage, sequential data mining-based method for extracting signal boundaries from raw CAN data. The approach leverages the PrefixSpan algorithm to identify frequent patterns of adjacent bit transitions that characterize individual signals. It involves preprocessing CAN logs to construct a transition-based sequence database, applying sequential pattern mining, and pruning spurious patterns to isolate true signal boundaries. We evaluate PrefixCAN-Signal on two open-source datasets spanning six vehicles. The method achieves signal boundary detection accuracies ranging from 77.98% to 89.77%, outperforming existing techniques by 2–10%. The sensitivity analysis and feasibility assessment further demonstrate the robustness of the approach, its generalizability across diverse vehicle types, and its suitability for real-time applications.