Application of Controller Area Network (CAN) bus anomaly detection based on time series prediction

•The abnormal data set is constructed with the analysis of the bit value change based on intrusion attack data in the vehicle.•The LSTM model is formed by using two data formats to satisfy the need of the low overhead and high detection performance.•The proposed LSTM-based anomaly-detection algorithm reaches at least 90% accuracy in the attack scenarios hard to identify. Electronization and intelligentization are gradually becoming the basic characteristics of modern automobiles. With the continuous deepening of intelligent network integration, automotive information security has become increasingly prominent. The in-vehicle network system is responsible for controlling the state of intelligent connected vehicles and significantly affecting driving safety. This research focuses on one deep learning technique based on time series prediction, namely long short-term memory (LSTM). An anomaly detection algorithm based on two data formats is proposed to detect the abnormal behavior of the controller area network (CAN) bus under tampering attacks. Five forms of loss functions are proposed and used to compare the test results to determine the final one. The evaluation indicates that the anomaly detection algorithm based on LSTM algorithm has a lower false positive rate and a higher detection rate using the chosen loss function.