# [PERSON] SOM Architecture for Intrusion Detection on In-Vehicle Communication Networks
## 5 Experimentation
### Experimental Process  
After preprocessing the data, we performed a supervised XYF Kohonen network with the aim of configuring a network able to correctly identify attack messages injected on the CAN bus. The goal was to assign attack messages and normal messages to different neurons on the map since the Kohonen \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Attack Type** & \begin{tabular}{c} **N. of Total** \\ **CAN ID** \\ \end{tabular} & \begin{tabular}{c} **N. of Normal** \\ **CAN ID** \\ \end{tabular} & \
\begin{tabular}{c} **N. of Attack** \\ **CAN ID** \\ \end{tabular} &
\begin{tabular}{c} **N. of Both Normal** \\ **and Attack CAN ID** \\ \end{tabular} \\ \hline _DoS Attack_ & 27 & 26 & 1 & - \\ _Fuzzy Attack_ & 2017 & 37 & 1980 & 2017 \\ _Spoofing the Drive Gear_ & 26 & 26 & 1 & 1 \\ _Spoofing the RPM Gauge_ & 26 & 26 & 1 & 1 \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Number of CAN ID identifiers (total, normal and attack) in each dataset. \begin{table}
\begin{tabular}{c c c c c c c c c c c c} \hline \hline  & \multicolumn{8}{c}{Input X Layer} & \multicolumn{8}{c}{Dependent Variable Y Layer} \\ \hline \hline
**Input X** & & & & & & & & & & & & \\
**Data** & **DLC** & 04f0 & 05f0 & 043f &... & 00080067d113 & 14560 ff6b000 &... & **Time** & **Dependent** & **Variable Y** & **Normal** & **Attack** \\
**Vector** & & & & & & & & & & & & \\ \hline \(\chi_{1}\) & 1 & 1 & 0 & 0 &... & 0 & 0 &... & 0.27 & Y\({}_{1}\) & 1 & 0 \\ \(\chi_{2}\) & 0.1 & 0 & 0 & 1 &... & 0 & 1 &... & 0.84 & Y\({}_{2}\) & 1 & 0 \\ \(\chi_{3}\) & 1 & 0 & 1 & 0  
network provides a distance-based output assigning input data vectors based on their global and local similarity [39]. We used a process of trial and error to define the parameters of the supervised XYF Kohonen network. In large maps, searching for winner neurons and updating the information are time-consuming operations. If the neurons in the network are initialized with weight vectors close to the final codebook vectors, the convergence of the model requires to be at least an order of magnitude faster [48]. Starting the training process with a small map allows to calibrate the network in a low number of epochs, even with an unstable convergence. The codebook vectors assigned to the neurons in this first training of the network can be used to properly initialize a larger map that will converge in a longer training process but reducing time consumption. Accordingly, we started to train the XYF network on a \(2\times 2\) hexagonal map. We performed the XYF network using the online SOM algorithm which returned higher levels of accuracy than the batch algorithm trained on a \(2\times 2\) neurons map for a low number of epochs equal to 100. The initial value of the learning rate \(\alpha\) was set to 0.5, linearly decreasing to 0.001 at the end of the training. The weights \(\varphi\) parameter of the fused similarity measure \(D(i,j)\) was set equal to 0.1 for the \(R_{X}\) map and equal to 0.9 for the \(R_{Y}\) map in order to put more emphasis on the labels variable Y and enforce the spatial clustering of the attack and normal messages. The Gaussian neighborhood function was used to select the neighboring neurons around the winning neuron. The similarity between the input message data vectors and the SOM grid neurons was computed using the Euclidean distance since it retuned the best results. The network perfectly separated the attack and normal input message data vectors in two distinct neurons in a low number of epochs. Results are shown in Section 6. After training the XYF network, we expanded the grid introducing in the \(2\times 2\) neurons hexagonal map new interstitial nodes to form a larger map. In particular, we doubled in two times the size of the original array obtaining, first, a \(4\times 4\) neurons and then, an \(8\times 8\) neurons hexagonal map.