# Anomaly Detection of CAN Bus Messages Using a Deep Neural Network for Autonomous Vehicles
## 3 Proposed Method
### The Shared-Weight DNN Module  
In recent years, DNN algorithms have been a hot topic in the field of machine learning [25; 26; 27]. Among various detection tasks, it improves the recognition rate by a significant level. A standard CAN communication system consists of four types of data frames: data frames, remote frames, error frames and overload frames. These frames have different lengths and play different roles in the CAN communication system. However, among these frames, only data frames make meaningful operations in the process of CAN communication. The syntax of a standard CAN packet is shown in Figure 3. The whole data frame consists of different seven-bit fields: the start of the frame, arbitration field, control field, data field, cyclic redundancy check (CRC) field, (Acknowledgement Character) ACK field and the end of the frame. The start of the frame indicates the beginning of the data frame and the remote frame and consists of only one \"dominant\" bit. The arbitration field consists of an identifier and RTR (Radio Teletype Receiver) bits. The standard frame format is different from the extended frame format in the arbitration field format. The control field consists of six bits, including two reserved bits (r0 and r1 are the same as the CAN bus protocol extension) and four bits of data length code, and the allowable data length value is zero to eight bytes. The data field sends buffer according to the length code, indicating the length. The same is true for the received data. It can be zero to eight bytes; each byte contains eight bits, the first of which is (the Most Significant Bit) MSB. The CRC code field consists of a CRC field (15 bits) and a CRC boundary character (an implicit bit). In CRC computation, the divided polynomials include the initial domain, arbitration domain, control domain, data domain and the de-filling bit stream with 15 bits of zero. The ACK field is composed of two recessive bits sent by the sender (reply gap and reply definition), and all nodes that receive the correct CRC sequence will change the recessive bit sent into dominant bits in the reply gap of the sending node. A standard CAN bus packet consists of several parts, each of which has different functions. Therefore, each part has its own unique characteristics. Figure 3: The syntax structure of a standard CAN packet. CRC = cyclic redundancy check, ACK = Acknowledgement Character. Figure 2: The full pipeline of the in-vehicle CAN anomaly detection system. The anchor, negative and positive represents annotated data, abnormal data and normal data, respectively. The aim of the proposed system is to find out the positive data. In our work, we extract CAN data features by training a DNN architecture. When a CAN bus is invaded, its internal data structure will change, and the related features extracted through the deep network will be inconsistent with standard CAN features. A complete CAN data packet can be seen as a bit-stream, in which the frequency of occurrence of each bit-symbol is fixed. In our work, we define \(X^{a},X^{n},X^{p}\) as the annotated data packet, anomaly data packet and positive packet, respectively. Then:  
\[\left\{ \begin{array}{l}X^{a}=(P_{1}{}^{a},P_{2}{}^{a},\ldots,P_{N}{}^{a})\\ X^{n}=(P_{1}{}^{n},P_{2}{}^{n},\ldots,P_{N}{}^{n})\\ X^{p}=(P_{1}{}^{p},P_{2}{}^{p},\ldots,P_{N}{}^{p})\end{array} \right.,\;N\in R \tag{1}\]  
where \(p_{N}^{a},p_{N}^{n},p_{N}^{p}\) are the frequencies of bit-symbol \"\(N\)\" occurring in the anchor, negative and positive data sequences. Furthermore, we take them as the input of the deep network. Therefore, each layer output in the deep network can be calculated as a formula:  
\[Y(X_{i};w_{i},b_{i})=w_{i}X_{i}+b_{i},\;w,b\in R \tag{2}\]  
where \(w_{i}\) is the weight of the \(i^{th}\) layer and \(b_{i}\) is the bias vector of the \(i^{th}\) layer. The final output of the whole network is shown as Equation (3):  
\[\left\{ \begin{array}{l}Y=WX+B\\ W=[w_{1},w_{2},\ldots,w_{n}]^{T}\\ B=[b_{1},b_{2},\ldots,b_{n}]^{T}\end{array} \right.