Understanding Feature-Level Limitations in Unsupervised IDS for Automotive CAN Networks

Modern vehicles rely heavily on the Controller Area Network (CAN) for real-time communication among Electronic Control Units (ECUs). As connectivity increases, in-vehicle networks face escalating cybersecurity risks from message spoofing, denial-of-service, and replay attacks. While recent Intrusion Detection Systems (IDS) employ deep learning and hybrid architectures to achieve high detection accuracy, their feature-level robustness and interpretability remain underexplored.This study investigates the feature-space limitations of unsupervised anomaly detection for CAN traffic using an IsolationForest-based baseline. CAN datasets comprising normal, DoS, spoofing, replay, and fuzzy attacks were virtually generated in a controlled Bash\/Linux simulation environment, ensuring reproducible message patterns and attack timing. The model achieved a moderate ROC-AUC of 0.78, with low recall, revealing that anomalies are not statistically distinct in conventional feature dimensions (CAN ID, DLC, payload bytes b0\u2013b7, and inter-frame timing).Detailed diagnostics\u2014including feature distribution analysis, anomaly score histograms, and ID overlap evaluation\u2014demonstrate that all attack IDs overlap fully with normal IDs, and payload distributions are nearly identical. Consequently, unsupervised IDS approaches such as IsolationForest struggle to separate attack and normal frames based purely on statistical outlier detection.These findings expose a critical research gap: the absence of discriminative features in raw CAN traffic limits anomaly-based IDS performance. The study motivates future work on temporal correlation modeling, multimodal feature fusion, and hybrid deep-learning IDS to enhance recall and reliability in automotive cybersecurity.