US Patent 11689434 Network anomaly detection

An anomaly detector of a Controller Area Network (CAN) bus performs analysis on messages received from the CAN bus to determine if the messages are anomalous. The anomaly detector may be implemented on a vehicle by an Electronic Control Unit (ECU). The anomaly detector may extract a batch of feature vectors for binary messages received from the CAN bus. The anomaly detector then performs a model adaption to adapt a previous probability model with the batch of feature vectors. The adapted probability model is then compared with a universal background model to determine a network anomaly level.