Abstract: With the rapid development of in-vehicle equipment intelligence on the Internet of Vehicles,due to its increasingly deepened connection with the Internet,the number of network attacks on the vehicle CAN bus has been increased,the attack methods have become more complex and the attack characteristics have become more concealed.At present,the intrusion detection of the Internet of Vehicles has just started.Traditional detection models based on firewall or rule bases are unable to obtain the hidden deep features of network attacks,but the intelligent detection models based on deep learning present problems such as “over-fitting” or “under-fitting” due to too many training parameters and unbalanced training datasets.To solve the above problems,an SMOTE-SDSAE-SVM based intrusion detection algorithm for CAN bus of vehicles is proposed in this paper,which is simply called 3S.This algorithm tries to combine deep learning and machine learning techniques to extract deep features of network attacks and ensure the efficiency of model training.The main contributions are as follows.Firstly,to balance the training samples of different categories,SMOTE method is used to generate more similar samples through the nearest neighbor sampling strategy.Secondly,sparse autoencoder and denoising autoencoder are combined to increase the speed of feature extraction and eliminate noise effects.And the deep feature of the CAN message is eventually extracted by stacking multi-layer sparse denoising autoencoder.Finally,SVM is used to accurately classify the extracted deep features of CAN messages,thereby discovering network attacks.According to the extensive experiments on the Volvo CAN dataset and the CAR-HACKING dataset,the proposed 3S algorithm is proved to have better accuracy and lower false alarm rate than other algorithms.

Key words: CAN bus, Deep learning, Intrusion detection, SDSAE, SMOTE, SVM