Abstract

Modern vehicles rely on the Controller Area Network (CAN) bus, whose design prioritizes low cost and real-time performance (ISO 11898) and consequently provides no message authentication or encryption. An attacker with physical or remote access to the vehicle network can therefore inject arbitrary frames. Regulatory requirements such as UNECE R155 and ISO/SAE 21434 have made intrusion detection an increasingly important defense-in-depth layer. Most published CAN intrusion detection systems are built on presence-based features, meaning they look for novel arbitration IDs, frozen payload bytes, or anomalous DLC values. These features score almost perfectly on public datasets whose own attacks are trivially separated by such rules, yet they fail against the realistic threat in which an attacker reuses legitimate IDs. We present per-ID behavioral residualization, a CAN-specific representation designed for that more challenging setting. It extracts fourteen temporal, protocol, and payload features from per-ID sliding windows and residualizes them against each arbitration IDs normal baseline. Our central claim is that this representation, not any single detector, is what improves detection. Across six unsupervised detectors and two corpora, residualization raises mean F1 in the large-majority of cells (21 of 24 on HCRL and 30 of 36 on ROAD across five seeds), with paired bootstrap confidence intervals favoring the residual representation in most comparisons. The stronger, more conservative test is ROAD, whose attacks reuse legitimate IDs; there the representation sustains recall 0.99 with high ROC-AUC on correlated-signal, speedometer, and reverse-light attacks, while the synthetic, presence-based HCRL set is used chiefly as a failure-mode control for its known attack shortcuts. Two failures are documented and quantified: novel-ID flooding (HCRL DoS, F1 = 0.02) and cross-ID fuzzing (ROAD, F1 = 0.27), both outside the coverage of per-ID conditioning. These limits are stated as open research problems rather than hidden defects.