1. An anomaly detector for a Controller Area Network (CAN) bus, the anomaly detector comprising an electronic data processing device programmed to perform an anomaly alerting method including the operations of: performing state space classification on a per-message basis of messages on the CAN bus to label each message as either normal or anomalous; performing temporal pattern analysis of messages on the CAN bus as a function of time to label unexpected temporal patterns as anomalous; and issuing an alert if an alert criterion is met that is based on the outputs of the state space classification and the temporal pattern analysis.