Special Section: Security, Trust and Privacy Solutions for Intelligent Internet of Vehicular Things Unsupervised Deep Learning Approach for In-Vehicle Intrusion Detection System Harini Narasimhan Indian Institute of Technology Kanpur Vinayakumar Ravi and Nazeeruddin Mohammad Prince Mohammad Bin Fahd University Abstract-The controller area network (CAN) is a standard communication protocol used for sending messages between electronic control unit of a modern automotive system. CAN protocol does not have any in-built security mechanisms and, hence, various attacks can affect the vehicle and cause life threats to the passengers. This article presents an unsupervised deep learning architecture for detecting intrusions on a CAN bus. The CAN intrusion detection system (IDS) architecture has an autoencoder that helps to learn the optimal features from CAN packets to differentiate between the normal and attacks. The optimal features are passed as input to the Gaussian mixture model, which helps us to cluster the CAN network packet data samples into normal and attacks. A detailed analysis of the proposed architecture is done on the CAN IDS dataset. To develop a robust CAN IDS system and achieve generalization, the proposed method is evaluated on the other two computer network intrusion datasets and a wireless sensor network dataset. In all the experiments, the proposed method has performed better than the existing unsupervised method and mainly showed a performance gain of 6.4% on the CAN IDS dataset. This Digital Object Identifier 10.1109/MCE.2021.3116923 Date ofpublication 30 September 2021; date ofcurrent version 6 December 2022. January/February 2023 Published by the IEEE Consumer Technology Society 2162-2248 ß 2021 IEEE 103