A method for detecting and defending against abnormal traffic of an in-vehicle network based on information entropy, including the following steps: step 1: setting a sliding window; step 2: setting a threshold; step 3: collecting and processing traffic; step 4: calculating information entropy in the sliding window when the window is full; and step 5: detecting traffic of a controller area network (CAN) bus and an in-vehicle Ethernet. Based on impact of abnormal traffic on the information entropy, the information entropy in the sliding window is calculated in real time and compared with the preset thresholds, to detect whether an abnormality occurs.