Abstract: Disclosed is a method of obfuscating a Controller Area Network (CAN) message performed by a first computing device including a processor, the method including: obtaining a first index from a first input value corresponding to a first time point by using an index output algorithm; determining a first CAN ID of the first computing device corresponding to the first index based on a predetermined CAN ID table; and generating a first normal CAN message including the first CAN ID and first normal data.

Abstract: A method for detecting an anomaly, which is performed by a computing device including one or more processors according to some embodiments of the present disclosure may include: collecting a CAN message generated in a controller area network (CAN); generating first traffic time interval data and first payload data based on the CAN message; obtaining a first latent vector generated by inputting the first traffic time interval data into a first neural network model; obtaining a second latent vector generated by inputting the first payload data into a second neural network model; generating merged data in which the first latent vector and the second latent vector are merged; and determining whether the CAN message is anomalous by inputting the merged data into a third neural network model.

Abstract: Disclosed is a method of obfuscating a Controller Area Network (CAN) message performed by a first computing device including a processor, the method including: obtaining a first index from a first input value corresponding to a first time point by using an index output algorithm; determining a first CAN ID of the first computing device corresponding to the first index based on a predetermined CAN ID table; and generating a first normal CAN message including the first CAN ID and first normal data.

Abstract: [SUMMARY] A method of detecting a sequence-based intrusion by using a Database CAN (DBC) file, the method being performed by a computing device including a processor according to some exemplary embodiments of the present disclosure, includes: obtaining a first Controller Area Network (CAN) message generated from a CAN; determining the first CAN message as a first category among a plurality of categories based on a pre-stored DBC file; obtaining first predictive data from the first CAN message by using a pre-trained first neural network model, the pre-trained first neural network model corresponding to the first category and including a first hidden layer; and comparing the first predictive data and first actual data obtained based on the first CAN message to determine whether the first CAN message has an anomaly.