CANShield

The CANShield_V2 dataset has been developed to support research in Automotive Cybersecurity, particularly in Intrusion Detection Systems (IDS) for Controller Area Network (CAN) environments. It represents real-world and simulated CAN traffic collected from both legitimate and fuzzed (malicious) communication scenarios.

This dataset is designed to enable machine learning and deep learning–based anomaly detection, fuzzing pattern recognition, and payload-level behavioural studies for in-vehicle networks.

Each entry in the dataset corresponds to a single CAN frame and includes the following key features:
1. timestamp --> Packet capture timestamp in microsecond precision.
2. interface --> The virtual CAN interface (e.g., vcan0) used during traffic capture.
3. can_id --> Unique CAN message identifier in hexadecimal format.
4. dlc --> Data Length Code: denotes the size of the data field (0–8 bytes).
5. data_bytes --> Raw payload bytes transmitted within the CAN frame.
6. decoded_signal --> Reverse-engineered interpretation of the payload bytes. This field was generated by decoding CAN signals to human-readable parameters such as vehicle speed, door status, or unknown signal references. It adds semantic richness to the dataset by linking raw bytes to real-world vehicle functionalities.
7. Class --> Target label representing the traffic type – either Legitimate or Fuzzing.