CANarchy: A Streaming CAN Bus Analysis Runtime for Automation and Security Research

CANarchy is an open-source tool designed for automotive cybersecurity research, using a stream-first architecture to process CAN bus data into structured JSONL event streams. It supports the J1939 protocol and agent-driven workflows, enabling automated analysis and operations. Its core design philosophy aligns with modern data streaming platforms (e.g., Apache Kafka, Flink), making it suitable for in-vehicle cybersecurity scenarios requiring real-time response and automated processing.

With the increasing intelligence of automobiles, the security of the CAN bus— the core communication protocol for in-vehicle networks— has received growing attention. Existing CAN tools (e.g., candump, Wireshark) are powerful but primarily designed for interactive use, lacking toolchains tailored for automation and integration. CANarchy fills this gap by supporting automation, security research, and agent-driven workflows.

CANarchy takes a "stream-first" approach as its core architecture:

1. Event Stream Priority: Converts CAN messages into structured, pipeable JSONL event streams with real-time performance, composability, scalability, and observability;
2. JSONL Line Format: Uses JSONL as the event stream format, balancing human readability, tool-friendliness, stream processing, and schema flexibility;
3. CLI Design: Follows Unix philosophy with standardized command outputs, enabling seamless integration into shell scripts, Python pipelines, or container platforms;
4. Native J1939 Support: Treats J1939 as a first-class workflow, supporting PGN parsing, multi-packet transmission reassembly, address claim management, and diagnostic message processing;
5. Agent-Driven Workflows: Supports AI agent integration, providing structured outputs, tool call interfaces, and automated playbooks.

CANarchy applies to three types of scenarios:

1. Automotive Cybersecurity Research: Traffic capture and analysis, fuzz testing, reverse engineering, vulnerability validation;
2. Automated Testing: Regression testing (ECU firmware update verification), performance benchmarking (message latency/throughput), compatibility testing (interoperability between different ECUs);
3. Fleet Monitoring and Diagnosis: Remote diagnostic systems, predictive maintenance, driving behavior analysis.

CANarchy has a comprehensive documentation system (hosted on GitHub Pages):

• Operator Documentation: Quick start guide, event schema, command specifications;
• Developer Documentation: Architecture design, contribution process, code and documentation version synchronization;
• Tutorials and Cases: J1939 heavy vehicle analysis, test scenario generation and capture, tool feature matrix comparison.

The value of CANarchy is reflected in:

1. Filling Toolchain Gaps: Offers an automation and integration-focused toolchain to address the limitations of existing tools;
2. Promoting Standardization: Facilitates reproducibility and sharing of automotive cybersecurity research results through standardized event schemas and CLI interfaces;
3. Embracing the AI Era: The agent-driven workflow design aligns with the application trends of AI in cybersecurity, laying the foundation for building autonomous analysis systems.

CANarchy is a future-oriented CAN bus analysis tool. Its stream-first architecture, JSONL event streams, native J1939 support, and agent integration capabilities give it a unique position in the field of automotive cybersecurity automation. It provides a modern, scalable toolset for engineers and researchers in automotive cybersecurity research, in-vehicle system development, or fleet management, and is expected to become one of the de facto standard tools in this field.