# [PERSON] SOM Architecture for Intrusion Detection on In-Vehicle Communication Networks
## 7 Conclusions  
The increasing diffusion of the connected devices in modern vehicles implies a lack in security of the in-vehicle systems such as the CAN bus. Since the CAN bus protocol does not provide security systems against cyber and physical attacks, it is desirable to have a system to detect any kind of attack.  
In the present work, we implemented a supervised distance-based intrusion-detection system with the aim of identifying the attack messages injected on a CAN bus. We performed two different methods, the XYF Kohonen network and the XYF-K algorithm. We tested both the models on four open source car hacking datasets containing different types of attack, namely, _DoS_, _spoofing gear_, _spoofing RPM_, and _fuzzy_. First, single datasets were trained one by one, then the four datasets were combined together. The XYF Kohonen network showed a great performance in identifying attack messages injected on the CAN bus in all the datasets. The XYF-K algorithm, which processed the output of the XYF network using a K-means algorithm, slightly improved the performance of the network. Despite the high number of messages with different CAN ID identifiers sent at different times and with different frequencies, the experimental results showed that both the models completely succeeded in the prevision of all types of attack messages in _DoS_, _spoofing gear_ and _spoofing RPM_. Moreover, both models achieved high levels of accuracy even in the _fuzzy_ dataset, despite the presence of 2017 different CAN ID identifiers sent completely at random, and in the _mixed_ dataset.  
Figure 12: XYF Kohonen network training process for the \(4\times 4\) maps.  
Figure 13: XYF Kohonen network training process for the \(8\times 8\) maps.  
The limit of the model lies in the fact that the SOM network can be time-consuming since it performs a computation at every step of the algorithm. Nevertheless, the architecture of the network enables to run the algorithm in parallel computations. Thus, the diffusion of multi core computational architectures overcomes limitations due to the complexity of the network architecture enhancing the interest of researchers in the application of the Kohonen SOM networks in security issues [15].  
In this paper, we tested the proposed method on a limited number of attacks, due to the availability of the open source dataset we analyzed. In future works, we will extend the analysis to other types of attacks. Moreover, we will investigate the development of the Kohonen SOM network as anomaly detector on a CAN bus, also comparing the supervised and unsupervised learning.  
Conceptualization, D.C.; data curation, V.S.B., A.N. and M.S.; formal analysis, A.N.; investigation, V.S.B. and D.C.; methodology, D.C. and A.N.; project administration, D.C.; software, V.S.B., A.N. and M.S.; supervision, M.S.; validation, V.S.B. and D.C.; visualization, V.S.B. and A.N.; writing--original draft, V.S.B. and A.N.; writing--review and editing, D.C. and M.S. All authors have read and agreed to the published version of the manuscript. This study was partially funded under the following projects: \"HEVOLUS+\" in the context of \"Aiuti ai Programmi di Investmento promossi da Piccolle Imprese da concedere ai sensi dell'art. 27 del Regionalento Regionale per gli aiuti in esenzione n.17 del 30/09/2014, TITOLO II capo 2 del Regolamento Generale\"; \"AURIGA-PBM\" in the context of \"Aiuti ai Programmi di Investmento promossi da Medicie Imprese da concedere ai sensi dell'art. 26 del Regolamento Regionale per gli aiuti in esenzione n.17 del 30/09/2014, TITOLO II capo 2 del Regolamento Generale\"; \"Auriga2020\" in the context of \"Aiuti ai Programmi di Investmento promossi da Medicie Imprese da concedere ai sensi dell'art. 26 del Regolamento Regionale per gli aiuti in esenzione n.17 del 30/09/2014, TITOLO II capo 2 del Regolamento Generale\". The authors declare no conflict of interest.