CAN-Trace Attack: Exploit CAN Messages to Uncover Driving Trajectories

TL;DR

This paper presents CAN-Trace, a novel attack exploiting CAN messages to reconstruct driving trajectories, revealing significant privacy risks even when GPS data is unavailable, with high success rates across various conditions.

Contribution

The paper introduces CAN-Trace, a new method for reconstructing driving paths from CAN messages, demonstrating a high attack success rate and highlighting privacy vulnerabilities.

Findings

Achieves up to 90.59% success in urban areas.

Achieves up to 99.41% success in suburban areas.

Effective across different vehicles and regions.

Abstract

Driving trajectory data remains vulnerable to privacy breaches despite existing mitigation measures. Traditional methods for detecting driving trajectories typically rely on map-matching the path using Global Positioning System (GPS) data, which is susceptible to GPS data outage. This paper introduces CAN-Trace, a novel privacy attack mechanism that leverages Controller Area Network (CAN) messages to uncover driving trajectories, posing a significant risk to drivers' long-term privacy. A new trajectory reconstruction algorithm is proposed to transform the CAN messages, specifically vehicle speed and accelerator pedal position, into weighted graphs accommodating various driving statuses. CAN-Trace identifies driving trajectories using graph-matching algorithms applied to the created graphs in comparison to road networks. We also design a new metric to evaluate matched candidates, which allows for potential data gaps and matching inaccuracies. Empirical validation under various real-world conditions, encompassing different vehicles and driving regions, demonstrates the efficacy of CAN-Trace: it achieves an attack success rate of up to 90.59% in the urban region, and 99.41% in the suburban region.