The present invention relates to an apparatus and method for monitoring abnormal state of a vehicle. In the method, CAN data collected from an ECU mounted on the vehicle is transformed into coordinates. The coordinates are applied to a distribution map in a specific space, a number of clusters is calculated based on results of the application, and an initial center point corresponding to the number of clusters is selected. Clustering is performed based on the initial center point, and then clusters are generated. At least one piece of data is extracted from each of the clusters, and a state feature of a corresponding cluster is decided on using a difference between maximum and minimum values of attributes constituting the at least one piece of data. A current state of the vehicle is monitored based on current CAN data of the vehicle and state features of the clusters.