# [PERSON] SOM Architecture for Intrusion Detection on In-Vehicle Communication Networks
## 6 Experimental Results and Discussion
Predictions for the test set are less accurate (Table 5) since the input data message vectors are also assigned to the neurons that were empty in the training process (Figure 3b). The network was not able to label these observations with a loss in accuracy. \begin{table}
\begin{tabular}{c c c c c c c c} \hline \hline \multirow{2}{*}{**Dataset**} & \multicolumn{4}{c}{**Training Set Accuracy (\%)**} & \multicolumn{4}{c}{**Test Set Accuracy (\%)**} \\ \cline{2-9}  & \multicolumn{3}{c}{\(\mathbf{2\times 2}\)} & \(\mathbf{4\times 4}\) & \(\mathbf{8\times 8}\) & & \(\mathbf{2\times 2}\) & \(\mathbf{4\times 4}\) & \(\mathbf{8\times 8}\) \\ \hline \multirow{2}{*}{_DoS_} & **XYF** & 100 & 100 & 100 & **XYF** & 97.85 & 100 & 100 \\  & **XYF–K** & 100 & 100 & 100 & **XYF–K** & 100 & 100 & 100 \\ \hline \multirow{2}{*}{_Spoofing Gear_} & **XYF** & 100 & 100 & 100 & **XYF** & 95.25 & 100 & 100 \\  & **XYF–K** & 100 & 100 & 100 & **XYF–K** & 100 & 100 & 100 \\ \hline \multirow{2}{*}{_Spoofing RPM_} & **XYF** & 100 & 100 & 100 & **XYF** & 95.2 & 100 & 99.1 \\  & **XYF–K** & 100 & 100 & 100 & **XYF–K** & 100 & 100 & 100 \\ \hline \multirow{2}{*}{_Fuzzy_} & **XYF** & 100 & 99.99 & 99.79 & **XYF** & 67.8 & 98.95 & 99.7 \\  & **XYF–K** & 100 & 99.99 & 99.79 & **XYF–K** & 98.5 & 99 & 99.75 \\ \hline \multirow{2}{*}{_Mixed_} & **XYF** & 100 & 100 & 100 & **XYF** & 85.48 & 99.55 & 99.1 \\  & **XYF–K** & 100 & 100 & 100 & **XYF–K** & 91.79 & 99.55 & 99.1 \\ \hline \hline \end{tabular}
\end{table} 
Table 5: XYF Kohonen network and XYF–K algorithm accuracy. Figure 7: XYF network and XYF-K algorithm on the different neurons map sizes for the _mixed_ dataset. (**a**) XYF network \(2\times 2\) map on training data; (**b**) XYF network \(2\times 2\) map on test data; (**c**) XYF-K algorithm \(2\times 2\) map on test data; (**d**) XYF network \(4\times 4\) map on training data; (**e**) XYF network \(4\times 4\) map on test data; (**f**) XYF-K algorithm \(4\times 4\) map on test data; (**g**) XYF network \(8\times 8\) map on training data; (**h**) XYF network \(8\times 8\) map on test data; (**i**) XYF-K algorithm \(8\times 8\) map on test data. Since some input message data vectors \(X_{i}\) were not classified by the XYF network, the only evaluation metric we computed was the accuracy calculated as the sum of the TP and TN over the total number of new observations presented to the network. Other metrics could return a biased representation of the network predictions. Although the XYF network shows a high performance in predicting attack and normal messages, this lack in classifying some observations can be overcome implementing the XYF-K algorithm. After training the XYF Kohonen network, the output was subsequently processed with the K-means clustering algorithm. The neurons codebook vectors of the \(R_{X}\) map were used as input for the K-means algorithm, which clustered neurons in two distinct groups, defining neurons labels as normal and attack. When an unknown data message \(X_{i}\) is assigned by the XYF network to the winning neuron in the \(R_{X}\) map, it is classified as normal or attack according to the clusters defined by the K-means algorithm. Figure 3b,c highlights that the K-means algorithm also clusters empty neurons, classifying all new input data messages presented to the network. The XYF-K algorithm improves the accuracy of the XYF Kohonen network trained on a \(2\times 2\) neurons map in all the datasets (Table 5). In the _DoS spoofing gear_ and _RPM_ datasets, the XYF-K algorithm succeeded in predicting all the new data messages with an accuracy of 100%. In order to stabilize convergence of the XYF Kohonen network, as better explained in Section 5, we expanded the \(2\times 2\) neurons hexagonal map introducing new interstitial nodes and obtaining first a \(4\times 4\) and then an \(8\times 8\) neurons hexagonal map.