The Controller Area Network (CAN) bus remains the primary communication backbone of modern vehicles, yet its lack of authentication exposes a broad attack surface. We review forty publications across two complementary research directions (reverse engineering, which recovers signal structure from raw bytes, and synthetic data generation, which produces new traces for testing and training), together with the public datasets and evaluation metrics they share, analyzed through a unified lens: the level of CAN data representation at which each method operates (raw bytes, signals, or vehicle-level entities). Across both directions we found no work that builds an explicit, reusable, observation-derived multi-entity state-space model: reverse engineering recovers field boundaries and types without binding them to vehicle entities, while generators produce statistically faithful traces without enforcing entity-level state constraints. Current fidelity metrics mirror this gap, and security operations on CAN inherit it: alerts arrive as byte-level deviations rather than behavior-level findings. We identify five open challenges that share a common root: none of the surveyed work models the entity-level state space explicitly. Petri nets, finite-state automata, and Markov chains (formal tools mature in adjacent domains but applied to CAN so far only at the protocol level) emerge as natural candidates to close these gaps and move CAN analysis from bytes to behavior.