CAN Bus Messages Abnormal Detection Using Improved SVDD in Internet of Vehicles

Controller area network (CAN) bus anomaly detection on the Internet of Vehicles (IoV) is a topic of ongoing interest and increasing importance, particularly as IoV becomes commonplace. However, existing abnormal detection schemes are not ideal due to the lack of abnormal data in IoV and the difficulty of parsing the diverse message rules in existing vehicles. While single-classification of the support vector domain description (SVDD) algorithm can detect abnormalities only with normal message information, the approach has a high rate of false negatives when deployed directly in the in-vehicle network environment. In addition, the real-time data generation (e.g., IoV messages) compounds the challenge of designing effective detection approaches. Therefore, this article proposes a mechanism for car networking message classification for a broad range of data, and establishes a weak model for many simple redundant data in the vehicle Intranet. The detection can reduce the time and computation costs of detection while ensuring accuracy. Then, this article proposes two improved SVDD schemes: 1) M-SVDD scheme, which adds the Markov chain to detect time-related messages and 2) G-SVDD scheme, which maps the kernel function to the Gaussian kernel function to reduce the redundant area of the model and the false-negative rate. The experimental results show that our proposed schemes have higher accuracy, recall rate, and fewer computation overhead.