j1939db-ids dataset

1. INTRODUCTION

We present the J1939DB-IDS dataset, a collection of signal-decoded SAE J1939 traffic for intrusion detection research in commercial vehicle networks. The dataset comprises three subsets: one built by injecting 11 SAE J1939-specific attack scenarios into a simulator, and two others created by replicating the same attack behaviors on public SAE J1939 datasets to preserve realistic system reactions. All messages were decoded using the standard SAE J1939 DBC format, with each arbitration ID further parsed into PGN, PF, PS, and SA fields. This dataset was constructed as part of an ongoing manuscript submission to an IEEE journal and aims to support reproducible research in anomaly detection and in-vehicle network security.

2. DATASET DESCRIPTION

2-1 File Structure

The dataset comprises three subsets:

Simulator Dataset: Traffic collected from a simulation environment with real-time reactions to 11 injected attacks.
Public Dataset 1: 2011 Freightliner Cascadia (original open dataset) with the same attack reactions injected.
Public Dataset 2: 2014 Kenworth T270 (original open dataset) with the same attack reactions injected.

* The original versions of the public datasets are available at: https://projects-web.engr.colostate.edu/cybersystems/j1939-can-data/.

Each file contains the following columns: Timestamp, PGN, PF, PS, SA, SPN values, and Label (included only in test datasets).

2-2 Message Format

All messages were decoded using the official SAE J1939 DBC format.

Arbitration IDs were parsed into PGN, PF, PS, and SA.
SPN (Suspect Parameter Number) values are extracted from the message payload.

2-3 Attack Labels

The Label column indicates whether each message is normal (0) or malicious (1).

2-4 Suggested Use

For training unsupervised models, use only the training datasets (containing normal data only).
For evaluation, use the test datasets, which include both normal and attack samples.

3. CITATION

Please cite our dataset's page and paper when you use this dataset as follows.

Hwejae Lee, Seonghoon Jeong, and Huy Kang Kim. "J1939DB-IDS: SAE J1939 Dual-Branch Intrusion Detection System against Novel Attacks." IEEE Transactions on Network and Service Management, 2026.
Hwejae Lee and Huy Kang Kim, June 06, 2025, "J1939DB-IDS Dataset (SAE J1939-Decoded Commercial Vehicle Signals for Intrusion Detection)", IEEE Dataport, doi: https://dx.doi.org/10.21227/sd9k-ct72

4. DATASET DOWNLOAD

Download Link: Download

5. CONTACT

Hwejae Lee (hwejae94@korea.ac.kr) or Huy Kang Kim (cenda@korea.ac.kr)

Page updated

Report abuse