Automobile CAN bus network data exception detection method based on isolated forest

The invention provides an automobile CAN bus network data exception detection method, and belongs to the field of information security. The method comprises: firstly, establishing an isolated tree based on sub-samples of a training set, that is, preprocessing a collected CAN data set, sampling the CAN data set, constructing a random forest containing limited isolated trees by adopting a random hyperplane cutting method, and calculating an abnormal score of to-be-detected data by utilizing the obtained isolated forest to judge whether the CAN data is abnormal or not. The automobile CAN data exception detection model based on the isolated forest algorithm is an unsupervised data exception detection model, can quickly process a large amount of data, can adapt to various operation conditions of an automobile, and better meets the actual requirements of automobile driving stability and safety. 本申请提供一种汽车CAN总线网络数据异常检测方法，属于信息安全领域。首先基于训练集的子样本来建立孤立树，即对采集到的CAN数据集进行预处理，再对其进行抽样，采用随机超平面切割的方法构建包含有限个孤立树的随机森林，然后利用得到的孤立森林计算待检测