Towards Explainable Automotive Intrusion Detection: A Chunk-based Framework forCAN Traffic

In this work, we propose an explainable intrusion detection framework for Controller Area Network bus traffic using the ROAD dataset. By segmenting raw traffic into fixed-size chunks, we extract features that capture timing behavior, entropy, payload statistics, and CAN ID survival rates. We evaluate three classifiers, Decision Tree, Random Forest (with TreeSHAP), and Feedforward Neural Network (with KernelSHAP). The framework extracts multi-level features from CAN traffic, revealing through explainability that tree models detect protocol anomalies while neural networks capture signal-level distortions, underscoring the role of model choice in explainable IDS design.