모바일 메뉴 열기

모빌리티 사이버보안 연구실

     

    DATASET

    AutoHack Dataset

    A Physically Verified Multi-Bus CAN Dataset for Intrusion Detection System Evaluation

    Real-Vehicle CAN Traffic · Multi-Bus CAN Logs · Physically Verified Attacks · USENIX VehicleSec '26

    Download Dataset & Benchmark

    DOI: 10.5281/zenodo.20321379 · CC BY 4.0

    1. Overview

    AutoHack is a vehicle cybersecurity dataset collected from a 2023 Hyundai production vehicle during real-world driving. It contains CAN traffic from C-CAN, P-CAN, and B-CAN aligned on a shared time axis, together with six traffic classes: Normal, DoS, Fuzzing, Spoofing, Replay, and UDS_Spoofing.

    The dataset was designed for training and benchmarking automotive intrusion detection systems under realistic vehicle-network conditions. Attack traffic was injected into the live vehicle and labeled after confirming the corresponding physical effects on the vehicle.

    AutoHack served as the official dataset of the AutoHack 2025 on-vehicle hacking competition and is released for academic research and educational use.

    2. Key Features

    Real-Vehicle CAN Traffic

    Collected from a production vehicle on real roads, reflecting the variability of actual driving traffic.

    Multi-Bus CAN Logs

    Includes C-CAN, P-CAN, and B-CAN traffic aligned on a common time axis for cross-domain analysis.

    Physically Verified Attacks

    Attack traffic was injected live and labeled after confirming observable effects on the vehicle.

    Aperiodic UDS Traffic

    Includes genuine diagnostic communication and UDS-based attack traffic.

    Timing-Precise Replay

    Replay attacks reproduce the timing characteristics of previously collected legitimate traffic.

    Independent Train/Test Sessions

    Training and test sets originate from independent driving sessions rather than a random frame split.

    3. Data Collection

    Vehicle 2023 Hyundai production vehicle
    Driving Environment Public roads under acceleration, deceleration, and turning conditions
    CAN Networks C-CAN, P-CAN, B-CAN
    Logger Kvaser Hybrid 2×CAN dual-channel logger
    Attacker Environment Windows 11 with Kvaser CANlib
    Diagnostic Traffic OBD2 scanner generating genuine UDS traffic

    C-CAN was captured continuously. P-CAN was captured while driving, and B-CAN was captured while the vehicle was parked.

    4. Dataset Composition

    Traffic Classes

    Normal · DoS · Fuzzing · Spoofing · Replay · UDS_Spoofing

    Dataset Statistics

    Metric Train Test
    Total Frames 6,922,600 2,711,497
    Driving Duration (s) 1,400.82 583.15
    Unique CAN IDs 2,048 2,048
    Normal Frames 6,593,770 2,557,180
    Attack Frames 328,830 154,317

    Frames by CAN Bus

    Bus Train Test
    C-CAN 4,026,488 1,678,489
    P-CAN 2,655,149 883,323
    B-CAN 240,963 149,685

    Train / Test Split

    • Session-based split: Train and test sets were collected from independent driving sessions.
    • Mutually exclusive spoofing IDs: Spoofing target IDs differ between train and test.
    • Cross-bus ID overlap: 40 CAN IDs appear on more than one bus.

    5. Attack Scenarios

    Attack Method Physical Response
    DoS Flood ID 0x000 at a strict 0.2 ms interval Warning lights and error alarms on major ECUs
    Fuzzing Random ID, DLC, and payload injection at 1 ms intervals Sudden vehicle stop and unintended eCall activation
    Replay Retransmit previously collected traffic using original timing information Interference with normal vehicle functions
    Spoofing Inject consecutive frames using valid CAN IDs RPM fluctuation, EPB warning, and PAS logic errors
    UDS Spoofing Reproduce genuine diagnostic sequences against safety-critical ECUs Unauthorized diagnostic states and ECU function restriction

    All attacks were injected into the live vehicle and labeled in real time after confirming their physical effects.

    6. Data Format

    Directory Structure

    AutoHack2025_IDS_Dataset/
└── Interface/
├── train/
│   ├── autohack2025_train_data_interface.csv
│   └── autohack2025_train_label_interface.csv
└── test/
├── autohack2025_test_data_interface.csv
└── autohack2025_test_label_interface.csv

    Data Fields

    Field Description Example
    Interface Source CAN bus C-CAN
    Timestamp Relative time in seconds 0.00059
    Arbitration_ID CAN identifier 329
    DLC Data Length Code 8
    Data CAN payload bytes 40 B2 81 14 12 20 00 14

    Labels are stored in separate files and aligned 1:1 with data rows. Label values are Normal, DoS, Fuzzing, Spoofing, Replay, and UDS_Spoofing.

    7. Benchmark Highlights

    • DoS (F1 1.000), Fuzzing (0.982), and UDS Spoofing (0.931) showed comparatively high detection performance.
    • Replay (0.680) and Spoofing (0.786) were substantially more difficult to distinguish from legitimate traffic.
    • Removing UDS messages from training increased Normal-to-Fuzzing errors from 966 to 5,296.
    • Joint multi-bus training produced lower baseline performance than training each bus separately.

    8. Download & Publication

    Dataset & Benchmark

    Zenodo: https://zenodo.org/records/20321379 
    DOI: 10.5281/zenodo.20321379
    License: CC BY 4.0

    Publication

    Yuchan Song, Sejun Ahn, Seungjin Baek, Hyeonseong Kim, Huy Kang Kim, and Sanghoon Jeon.
     “AutoHack: A Physically Verified Multi-Bus CAN Dataset for Intrusion Detection System Evaluation.” 
    USENIX Symposium on Vehicle Security and Privacy (VehicleSec '26), 2026.

    Related Page

    AutoHack 2025 Competition