US Patent 11677582 Detecting anomalies on a controller area network bus

A process detects anomalies on a controller area network (CAN) bus. An arbitration field in a message on the CAN bus is analyzed, and a data field in the message on the CAN bus is inspected. The process further monitors a frequency of message identifiers that are transmitted across the CAN bus, and determines that an overall bus load crosses a threshold. The process then transmits an alert when the analyzing the arbitration field, the inspecting the data field, the monitoring the frequency, and the determining the overall bus load indicate that an anomaly has occurred on the CAN bus.