Method and system for handling network intrusion

A method, comprising:

• receiving, at a gateway of a Controller Area Network (CAN) bus on a vehicle and via at least one of a wireless interface or a wired interface of the vehicle, a plurality of messages targeted at one or more electronic control units (ECU) coupled with the CAN bus;
• generating one or more input vectors based on the plurality of messages, each of the one or more input vectors having a first number of elements;
• generating, using one or more machine learning models, a corresponding output vector based on each of the one or more input vectors, each output vector having the first number of elements;
• generating one or more comparison results between each of the one or more input vectors and the corresponding output vector;
• and
• based on the one or more comparison results, performing one of:
• allowing the plurality of messages to enter the CAN bus or preventing the plurality of messages from entering the CAN bus,
• wherein each of the plurality of messages includes an arbitration identifier and a payload,
• wherein the one or more input vectors are generated based on at least one of the arbitration identifier or the payload of each of the plurality of messages,
• wherein the one or more machine learning models comprise one or more encoders and one or more corresponding decoders,
• wherein generating, using one or more machine learning models, a corresponding output vector based on each of the one or more input vectors comprises:
• transforming, using the one or more encoders, each of the one or more input vectors to a corresponding intermediate vector, the intermediate vector having a second number of elements, the second number being smaller than the first number;
• and
• reconstructing, using the one or more corresponding decoders, the one or more output vectors from the corresponding one or more intermediate vectors,
• wherein the one or more comparison results comprise a combined reconstruction loss between the one or more input vectors and the corresponding one or more output vectors;
• and
• wherein the plurality of messages is prevented from entering the CAN bus based on the combined reconstruction loss exceeding a threshold.