SEOUL, August 13 (AJP) - A record of real cyberattacks carried out on a moving car has won the best artifact award at the USENIX Symposium on Vehicle Security and Privacy, the main international meeting on the subject, held in Baltimore on Monday and Tuesday alongside the 35th USENIX Security Symposium, Kookmin University said Thursday.
The winning submission cleared all three checks the symposium applies to research materials. Reviewers confirmed that the data was publicly available, that the accompanying software ran as described, and that an outside party could reproduce the results in the paper. Awards at the event went to two entries, one for the best paper and one for the best artifact, the term the field uses for the data, code and documentation that sit behind a published result.
The dataset came out of a joint project between the Mobility Cybersecurity Lab at Kookmin University, led by Jeon Sang-hoon, and the Hacking and Countermeasure Research Lab at Korea University, led by Kim Huy-kang. Ahn Se-jun of Kookmin and Song Yu-chan of Korea University share first authorship on the paper, with Kim Hyeon-seong and Baek Seung-jin as co-authors. Jeon and Kim are joint corresponding authors.
Their paper, titled "AutoHack: A Physically Verified Multi-Bus CAN Dataset for Intrusion Detection System Evaluation," argues that the field has been grading itself on an easy test. Systems designed to spot hacking inside a car have been reporting near-perfect accuracy for years, but most were measured against data recorded in simulations or on a workbench, where messages arrive at tidy intervals. A detector trained on that kind of traffic learns to flag anything irregular, which works until it meets a real car, where a great deal of perfectly normal communication is irregular.
Cars carry an internal network called a Controller Area Network, which lets the dozens of small computers inside a vehicle send instructions to one another. The Controller Area Network (CAN) standard dates to the 1980s and was never built with security in mind, so it has no way to verify that a message came from where it claims. Modern vehicles run several CAN lines at once, divided by function into powertrain, chassis, and body, linked through a central gateway. Almost every public dataset covers only one of them.
The Kookmin and Korea University team recorded three at the same time. Using a single two-channel capture device so that both channels shared one internal clock, they logged the chassis, powertrain and body lines with the traffic aligned to within a millionth of a second, which lets a researcher see how a message on one line relates to activity on another.
The car was a 2023 Hyundai vehicle, and the researchers ran it on internal roads on a university campus, closed to public traffic. They stripped out interior components to reach the wiring behind the central gateway, then injected attacks from a laptop while the vehicle was being driven. The paper does not identify the model, and the vulnerabilities exploited are structural features of the CAN standard rather than defects specific to one manufacturer.
What separates the dataset from earlier ones is that the team confirmed each attack by watching what the car actually did. Flooding the powertrain and body lines with randomized messages stopped the vehicle while it was in Drive and, on another run, placed an automatic call to an emergency call center with no crash having occurred. Impersonating the diagnostic tool a mechanic would plug in allowed the researchers to switch off the forward-facing camera and restrict power steering assistance while the car was moving. Lesser attacks triggered parking brake warnings, false fuel alerts and unrequested operation of the turn signals and windows.
The finished dataset runs to roughly 9.6 million messages drawn from about 33 minutes of driving, covering 2,048 distinct message identifiers, with attack and normal traffic labeled at the moment each injected frame finished transmitting rather than when the attack script started.
The team then handed it to 10 teams of undergraduates at a three-day competition Kookmin ran last year, giving each team five submission attempts against a live leaderboard. Final scores ranged from 39 percent to 66 percent on a combined measure of how many attacks a system caught and how often it cried wolf. The strongest entry in the room missed roughly a third of the attacks.
The researchers' own reference models fared similarly. A standard machine learning classifier handled denial-of-service flooding perfectly and caught most randomized injections, but scored 0.68 on replayed traffic and 0.79 on impersonated messages, the two attack types that most closely resemble ordinary driving data.
The paper is direct about what the results do not show. All of it comes from one vehicle model over a limited set of driving conditions, so the benchmark cannot be read as evidence that a detector will generalize across manufacturers, and message identifiers, payload meanings and gateway routing differ from car to car. The attacks covered representative categories rather than every known technique, and all of them required physical access to wiring inside the car. The researchers describe the risk of the work being turned to vehicle theft or worse as negligible, because the weaknesses involved are already documented properties of the protocol.
The dataset and the benchmark code are archived on Zenodo under a Creative Commons Attribution license, with the code released separately under the MIT license, and the team disclosed the targeted message identifiers only for the chassis line to avoid publishing more of the manufacturer's internal specifications than the paper required.
The work was funded through the Convergence and Open Sharing System program run by the Ministry of Education and the National Research Foundation of Korea, under which Kookmin leads the future mobility field and says it stages the attack and defense competition annually. Jeon said he hopes the published data becomes "a shared asset for automotive cybersecurity research and for training people in the field, in South Korea and abroad."
Copyright ⓒ Aju Press All rights reserved.