# Intrusion Detection for in-Vehicle Communication Networks: An Unsupervised Kohonen SOM Approach
## 5 Materials and Methods
### System Architecture  
After data pre-processing, we tested a distance-based intrusion detection system aimed at identifying attack or anomalous messages injected on the CAN bus. We implemented a hybrid unsupervised Kohonen network in order to classify attack and normal messages based on global and local similarity among input data vectors [44] using two approaches. The models were tested on samples of 10,000 CAN messages vectors for each dataset. Network initial learning parameters were defined using a trial and error process. Since our goal was to separate input data vectors into two clusters, attack and normal messages, we trained the network on small maps. Map size does not need to be very large, even with a large number of input data vectors. Training large maps is a time-consuming process since all input data vectors are compared with all the neurons in the map [55]. After many trials, on maps of different sizes, we obtained the best performance in terms of prediction accuracy training for the network on a \(2\times 2\) (four neuron) map using the Gaussian neighborhood function. The learning rate \(\alpha\) was initially set to 0.5 linearly decreasing in a training process of 100 epochs. The Euclidean distance was used to compute the similarity between input message data vectors and neurons in the SOM map since it retuned the best results. Data were split between 80.00% for training the model and 20.00% for testing prediction accuracy. The unsupervised Kohonen network assigned all input data vectors to the four neurons in the \(R_{X}\) map. In order to classify input messages vectors in two clusters, attack and normal, we combined the output of the SOM network with the k-means algorithm using two distinct procedures. Using the traditional procedure, generally used to cluster local data classified by the Kohonen SOM network [17; 22; 23], the output of the trained network was given as input to a k-means algorithm (SOMK-C). The algorithm processed the neurons' codebook vectors in order to classify the four neurons into two groups. Input CAN message vectors were then assigned to the same group of the corresponding neuron. Compared to the traditional approach, we propose a novel procedure to integrate the Kohonen SOM network with the k-means algorithm (SOMK-D) (see Figure 4). The proposed approach relies on the assumption that the Kohonen network classifies input vectors in clusters based on distance between input vectors and neurons. Thus, in the traditional procedure the k-means algorithm processed neurons' codebook vectors, whereas in the proposed approach distance between input vectors and neurons were processed. The SOMK-D procedure can be illustrated as follows:  
* Input CAN message data vectors were weighted depending on their frequency in the whole traffic dataset, since the nature of attack and normal messages sent in the CAN bus differs in terms of structure and frequency. * Distances between weighted input CAN vectors and neurons in the \(Rx\) map were computed training the Kohonen SOM network. * Distances were used as input of the k-means algorithm. * The k-means algorithm was implemented to classify input vectors in two clusters based on their distance to the corresponding winning neurons' BMU. \begin{table}
\begin{tabular}{c c c c c c c c c} \hline \hline  & & & & & Input X Layer & & & \\ \hline
**Input X** & **DLC** & **04f0** & **05f0** & **043f** &... & **00080067**/**0113** & **14560 ff6b000** &... & **Time** \\ \hline X\({}_{1}\) & 1 & 1 & 0 & 0 &... & 0 & 0 &... & 0.27 \\ X\({}_{2}\) & 0.1 & 0 & 0 & 1 &... & 0 & 1 &... & 0.84 \\ X\({}_{3}\) & 1 & 0 & 1 & 0 &... & 1 & 0 &... & 0.97 \\ X\({}_{m}\) &... &... &... &... &... &... &... &... &... \\ X\({}_{n}\) & 0.5 & 0 & 0 & 0 &... & 0 & 0 & 0.01 \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Processed data. The algorithm is detailed in Algorithms 3 and 4. Results highlight a great improvement in terms of detection accuracy and a significant reduction of the false negative rate compared to the traditional procedure, as shown in Section 6.