Abstract: Modern vehicles widely use controller area network (CAN) bus structure to control various electronic components in vehicles, but the standard CAN protocol lacks defense mechanism and is vulnerable to be attacked such as denial of service, fuzzy attack and replay. Traditional intrusion detection technology based on IP protocol can't be directly applied in modern vehicles. The CAN structure was analyzed to find its defects. Aimed at CAN attack technology, after analyzing the CAN bus features, three anomaly detection methods based on frequency detection, machine learning and statistical detection were fused to detect vehicle intrusion detection. Through experimental verification, the performance of modern vehicle intrusion detection system is improved in general by the proposed method.