关键词: CAN 总线安全；入侵检测；统计特征；特征-攻击对应关系；可解释性；支持向量机

Abstract: Aiming at the lack of native security mechanisms in the in-vehicle controller area network (CAN) and the poor explainability of existing intrusion detection methods, this paper investigates "which statistical features can detect specific types of CAN attacks". Seventeen-dimensional statistical features including identifier distribution, data-length code, payload, inter-frame interval and high-frequency identifiers are extracted via sliding windows. Taking linear support vector machine (SVM) as the classifier, a feature-group×attack-type detection matrix is constructed under strict stratified chronological splitting, and permutation importance is adopted to interpret detection mechanisms. On the Car-Hacking dataset, identifier-distribution features achieve recall no less than 99.6% for four injection-type attacks, denial-of-service (DoS), fuzzing, gear spoofing and revolutions per minute spoofing, whereas inter-frame interval features yield only 0.036～0.069 recall for spoofing attacks. Fuzzing attacks are dominated by identifier diversity, while spoofing attacks are governed by Top-1 identifier frequency. Cross-dataset validation on the real ORNL automotive dynamometer (ROAD) shows that masquerade attacks barely perturb identifier distributions; the optimal single feature group yields an receiver operating characteristic-area under curve (ROC-AUC) of only about 0.765, and the combination of all 17 dimensions improves the value to 0.855. The dominant feature migrates from identifier distribution to inter-frame timing, revealing the capability boundary of distribution-based features. The findings provide references for feature reduction and explainable diagnosis of in-vehicle intrusion detection systems.

Key words: CAN bus security; intrusion detection; statistical feature; feature-attack correspondence; interpretability; support vector machine