# [PERSON] SOM Architecture for Intrusion Detection on In-Vehicle Communication Networks
## 4 Theoretical Framework  
### Unsupervised Kohonen Network  
The Kohonen self-organizing map is a type of artificial neural network (ANN). This technique allows the visualization of high dimensional data reducing the dimensions of data to a map. Figure 1: Controller area network (CAN) message structure. The Kohonen SOM is a nonlinear mapping network aimed at detecting the similarities among the data in the input layer and at representing them in an output layer of interconnected neurons. Input data are assigned to neurons according to the defined measures of distance between them [39]. Unlike other techniques in neural networks, SOMs can classify data without supervision, that is to say the model does not require any target variable. It is an unsupervised learning model and differs from other artificial neural networks because it cannot adjust the weights using back propagation methods for error-correction learning. Instead, the SOM network has a feed-forward structure with a single computational layer [40] and uses competitive learning in order to find similarities among the data, clustering them into different classes of data [41]. The Kohonen neural network maps input data on a map of neurons according to spatial constraints. The Kohonen output network consists of a competitive layer where a \(n\)-dimensional _codebook_ vector is assigned to each neuron in the map and the elements of the vector represent the weights [42]. The spatial constraints also imply that neighboring neurons have similar codebook vectors. If two high dimensional input data vectors are similar, then they will be mapped in nearby neurons on the network grid. Hence, input data vectors mapped on the same neuron or in the neighboring ones are similar. SOM networks try to reproduce the topological order of input data through clusters of neurons and neighbors whose number is defined by the size of the map [43]. The SOM algorithm computes similarities between each input data vector and the neurons codebook vectors in order to find the most similar. This neuron is the winner, called the _best matching unit_ (BMU), and it updates its weights vector using a weighted average in order to better match with the input vector. The weight of the attraction of the BMU to the input data vector changes at each iteration and it is one of the training parameters of the model also called _learning rate_\(\alpha\). The learning rate \(\alpha\) decreases during the training process ensuring the convergence of the model [43]. Moreover, the neighboring neurons update their weight vectors moving closer to the input and ensuring the spatial constraints in order to preserve the topology of the map. A simple description of the algorithm can be explained as follows. After defining the number of neurons in the Kohonen SOM network, a codebook vector is initialized for each neuron. Then, the Euclidean distance is computed between a CAN message vector randomly selected and all the neurons in the Kohonen layer. The CAN message vector is assigned to the neuron with the minimum value of distance, called the winning neuron or best matching unit (BMU). The neurons with the most similar codebook vectors are identified as neighboring neurons. The BMU and the neighboring neurons are updated in order to better match to the CAN message vector. This procedure is repeated for all the CAN message vectors and for a given number of iterations. Two main algorithms are used to train the SOM network: the online and the batch algorithms [44]. The difference is that in the _online_ algorithm, the BMU and the neighboring neurons are updated immediately after an input data vector is presented to the network, whereas in the _batch_ algorithm, codebook vectors are updated after all the input data vectors are presented to the network [45]. Formally, we defined the input data vectors \(X_{i}\), with \(i=1,\ldots,n\), the number of Kohonen neurons \(R_{j}\), with \(j=1,\ldots,m\), and set the number of iterations \(t\) with \(t=1,\ldots,z\)[46].