Abstract: Aiming at the lack of native security mechanisms in the in-vehicle controller area network (CAN) and the poor explainability of existing intrusion detection methods, this paper investigates "which statistical features can detect specific types of CAN attacks". Seventeen-dimensional statistical features including identifier distribution, data-length code, payload, inter-frame interval and high-frequency identifiers are extracted via sliding windows. Taking linear support vector machine (SVM) as the classifier, a feature-group×attack-type detection matrix is constructed under strict stratified chronological splitting, and permutation importance is adopted to interpret detection mechanisms. On the Car-Hacking dataset, identifier-distribution features achieve recall no less than 99.6% for four injection-type attacks, denial-of-service (DoS), fuzzing, gear spoofing and revolutions per minute spoofing, whereas inter-frame interval features yield only 0.036～0.069 recall for spoofing attacks. Fuzzing attacks are dominated by identifier diversity, while spoofing attacks are governed by Top-1 identifier frequency. Cross-dataset validation on the real ORNL automotive dynamometer (ROAD) shows that masquerade attacks barely perturb identifier distributions; the optimal single feature group yields an receiver operating characteristic-area under curve (ROC-AUC) of only about 0.765, and the combination of all 17 dimensions improves the value to 0.855. The dominant feature migrates from identifier distribution to inter-frame timing, revealing the capability boundary of distribution-based features. The findings provide references for feature reduction and explainable diagnosis of in-vehicle intrusion detection systems.

Key words: CAN bus security; intrusion detection; statistical feature; feature-attack correspondence; interpretability; support vector machine

摘要： 针对车载控制器局域网络（CAN）缺乏安全机制、现有入侵检测方法可解释性不足的 问题，研究“哪类统计特征能检出哪类 CAN 攻击”。以滑动窗口提取标识符分布、数据长度 码、载荷、帧间间隔与高频标识符的 17 维统计特征，以线性支持向量机（SVM）为分类器， 在严格分层时序切分下构建特征组×攻击类型检出矩阵，并以置换重要性揭示机理。在 Car-Hacking 数据集上，标识符分布特征对拒绝服务（DoS）、模糊、挡位欺骗、转速欺骗四类 注入类攻击召回率均不低于 99.6%，帧间间隔特征对欺骗类攻击召回率仅 0.036～0.069；模糊 攻击由标识符多样性主导，欺骗类由 Top-1 频率主导。跨数据集橡树岭国家实验室实车底盘 测功机（ROAD）验证表明，伪装攻击几乎不扰动标识符分布，最强单特征组仅受试者工作 特征-曲线下面积（ROC-AUC）约 0.765（全 17 维联合可提升至 0.855），主导特征由标识符 分布迁移至帧间时序，揭示分布型特征的能力边界。结果为车载入侵检测的特征精简与可解 释诊断提供依据。

关键词: CAN 总线安全；入侵检测；统计特征；特征-攻击对应关系；可解释性；支持向量机