# [PERSON] SOM Architecture for Intrusion Detection on In-Vehicle Communication Networks
## 4 Theoretical Framework
### Supervised Kohonen Network  
The Kohonen neural network is broadly known as an unsupervised learning model, although it can be used as a supervised classifier. Further information, such as class information, can be entered in the network with the aim of modeling the relationship between the input data and a dependent variable for predictive purposes [45].  
In the supervised SOM networks, two layers are presented to the network, one for the input data and one for the dependent variable. We define \(X_{i}\) and \(Y_{i}\), with \(i=1,\,\ldots\,n\), respectively, the input data and the dependent variable vectors, and \(R_{X,j}\) and \(R_{Y,j}\), with \(j=1,\,\ldots\,m\), the Kohonen neurons, respectively, in the \(R_{X}\) and in the \(R_{Y}\) map. The dependent variable \(Y\) layer has the same topology and the same numbers of neurons in the grid as the input data layer \(X\), but a different number of weights in the codebook vectors. The neurons codebook vectors \(R_{X,j}\) and \(R_{Y,j}\) have the same number of weights, respectively, of the input \(X_{i}\) and the output \(Y_{i}\) data vectors.  
The supervised Kohonen network can be implemented following different approaches [49]. The training process is the same as the unsupervised network.  
The first approach is based on the counter propagation network (CPN), similar to the unsupervised network. The input data \(X_{i}\) and the dependent variable \(Y_{i}\) vectors are trained simultaneously but separately. The dependent variable layer \(Y\) does not influence the training process.  
In the X-Y fused (XYF) Kohonen approach, the network is trained on a concatenated layer of input data \(X_{i}\) and dependent variable \(Y_{i}\) vectors. A fused similarity measure is computed as a weighted combination of separate distances between the input data vectors \(X_{i}\) to the neuron codebook vectors \(R_{X,j}\) and the corresponding dependent variable \(Y_{i}\) vectors to the neuron codebook vectors \(R_{Y,j}\). \(R_{X,j}\) and \(R_{Y,j}\) are updated simultaneously. At the iteration t, the fused similarity measure \(D(i,j)\) for the observation (\(X_{i}\), \(Y_{i}\)) can be expressed as follows:  
\[D(i,j)=\varnothing(t)D\big{(}X_{i},R_{X,j}\big{)}-(1-\varnothing(t))D\big{(}X_ {i},R_{Y,j}\big{)} \tag{5}\]  
where \(\varphi(t)\) is a weight which linearly decreases with iterations. The winning neuron is the one with the minimum \(D(i,j)\).  
The bidirectional Kohonen (BDK) approach uses the same training procedure of the XYF network with the difference that, first, only the codebook vectors \(R_{X,j}\) in the \(R_{X}\) grid are updated. Then, the codebook vectors \(R_{Y,j}\) in the \(R_{Y}\) grid are adjusted in a bidirectional way instead of a simultaneous way.  
At the end of the training process, the output of the supervised Kohonen network consists of two separate neuron maps: \(R_{X}\) for the input data \(X\) and \(R_{Y}\) for the one dependent variable \(Y\). The prediction for a new object is determined by first computing the winning neuron \(R_{X,BMU}\) in the \(R_{X}\) grid and then assigning to the object the class of the corresponding neuron \(R_{Y,BMU}\) in the \(R_{Y}\) grid.