Abstract: The development of intelligent driving technology increased vehicles interactions with external networks. The controller area network is the primary in-vehicle network and its security vulnerabilities can be exploited by attackers to gain control of vehicles, posing significant safety threats to occupants. To address this issue, an anomaly detection method based on long short-term memory and an attention mechanism is proposed. A dual-layer attention encoder is employed to deeply extract information from both local and global features within the data flow of the controller area network. By efficiently identifying and learning sequential patterns among features, the proposed method requires significantly less feature information, achieves better detection efficiency and accuracy, and enables unbalanced classification tasks. Finally, multiple independent repeated tests are performed on the CarHacking dataset. The results demonstrate that detection accuracy exceeding 99.20% has been achieved for all attack categories in the dataset, significantly outperforming existing detection methods. Additionally, a multi-classification task that could not be achieved by other approaches is accomplished by the proposed model, with an average detection accuracy of 99.26% .

Key words: vehicle network, anomaly detection, long short-term memory network, attention mechanism