Intrusion Detection in CAN Bus using the Entropy of Data and One-class Classification

This paper presents an intrusion detection method in a controller area network (CAN) bus using an anomaly detection approach to detect anomaly messages communicated in the CAN bus. The proposed method commences with the calculation of the entropy of CAN ID messages transmitted within a specified time frame. It then employs a One-Class Support Vector Machine (OCSVM), which has been trained on a dataset representing normal behavior, to classify the messages as either normal or anomaly. The testing results indicate that this method achieves an accuracy of 98.5% in classification.