Target-Adaptive CAN Intrusion Detection Across Heterogeneous Vehicle Datasets via Robust Residual Modeling and Empirical Block-Rank Calibration

Vehicle-specific CAN identifiers, timing, and payload encodings complicate intrusion detection across vehicles. This study proposes a 12-dimensional residual representation that measures deviations from each vehicle’s normal communication and combines it with Isolation Forest (IF) and empirical block-rank (EBR) calibration. The method uses normal-only target adaptation: trusted target-normal commissioning data define the residual references, fit the detector, and calibrate block-level alarms. Across four can-train-and-test scenarios with five random seeds each, the mean area under the receiver operating characteristic curve (AUROC) was 0.918, the area under the precision–recall curve (AUPRC) was 0.622, and the Matthews correlation coefficient (MCC) was 0.573. Capture-disjoint and leave-one-capture-out AUPRC values decreased to 0.553 and 0.521. At α = 0.05, the block false-positive rate (FPR) was 0.072, and the attack-block recall was 0.786; the pooled false-alarm event rate after event aggregation was 11.1 per hour. Repeating the commissioning procedure on ROAD with newly fitted target-specific models achieved an AUPRC of 0.503, with split-level recall ranging from 0 to 0.571. Matched comparisons showed the contribution of the residual representation, while capture-separated and ROAD results identified commissioning coverage and alarm stability as central operational challenges.