# [PERSON] SOM Architecture for Intrusion Detection on In-Vehicle Communication Networks
## 6 Experimental Results and Discussion  
As explained in Section 5, in the experimentation we performed two methods, the supervised XYF Kohonen network and the supervised XYF-K algorithm, on the _DoS_, _spoofing gear/RPM_, and _fuzzy_ datasets in order to identify attack messages on the CAN bus. We processed the samples of 10,000 records, first, for each single dataset separately, then, for the _mixed_ dataset including all kinds of attacks. The samples were randomly selected balancing the ratio of CAN ID messages and were randomly split into 80% training and 20% test set, again balancing the ratio of CAN ID messages both in training and in test set for all the datasets with the exception of the _fuzzy_ dataset. The _fuzzy_ dataset was split balancing the ratio of labels attack/normal because of the high number of different CAN ID messages (2017), the 97.1% of whom show a relative frequency less than 0.1% in the dataset and are transmitted totally at random. The training set was used to train the XYF Kohonen network and the XYF-K algorithm and the test set to evaluate the models' performance. We started training the XYF Kohonen network on a \(2\times 2\) neurons hexagonal map. The network assigned a codebook vector to each neuron in the \(R_{X}\) and \(R_{Y}\) grids. The element of the neuron's codebook vector with the maximum value in the \(R_{Y}\) map determines the label of that neuron. The neurons in the \(R_{X}\) map assume the labels of the neurons located in the same position in the \(R_{Y}\) map. Figure 2: The XYF–K algorithm. Figure 4: XYF network and XYF–K algorithm on the different neurons map sizes for the _spoofing gear_ dataset. (**a**) XYF network \(2\times 2\) map on training data; (**b**) XYF network \(2\times 2\) map on test data; (**c**) XYF-K algorithm \(2\times 2\) map on test data; (**d**) XYF network \(4\times 4\) map on training data; (**e**) XYF network \(4\times 4\) map on test data; (**f**) XYF-K algorithm \(4\times 4\) map on test data; (**g**) XYF network \(8\times 8\) map on training data; (**h**) XYF network \(8\times 8\) map on test data; (**i**) XYF-K algorithm \(8\times 8\) map on test data. Figure 5: XYF network and XYF–K algorithm on the different neurons map sizes for the _spoofing RPM_  
Figure 6: XYF network and XYF–K algorithm on the different neurons map sizes for the _fuzzy_ dataset. (**a**) XYF network \(2\times 2\) map on training data; (**b**) XYF network \(2\times 2\) map on test data; (**c**) XYF-K algorithm \(2\times 2\) map on test data; (**d**) XYF network \(4\times 4\) map on training data; (**e**) XYF network \(4\times 4\) map on test data; (**f**) XYF-K algorithm \(4\times 4\) map on test data; (**g**) XYF network \(8\times 8\) map on training data; (**h**) XYF network \(8\times 8\) map on test data; (**i**) XYF-K algorithm \(8\times 8\) map on test data. Figure 7: _Cont._  
Figure 3a shows the \(2\times 2\) hexagonal map where the neurons which assume the same label have the same color, in particular, yellow for normal and red for attack. Input message data vectors \(X_{i}\) assume the same label of the assigned winning neurons. Figure 3a highlights that input data messages that are clearly separated by the XYF network in the training phase in two distinct neurons. In the XYF Kohonen network, the prediction for the unknown data messages \(X_{i}\) is determined presenting the new object to the trained network. The network assigns the unknown message \(X_{i}\) to a neuron in the \(R_{X}\) map and classifies it as the normal or attack message according to the label of the neuron allocated in the same position as the \(R_{Y}\) map. In the training process, the input data vectors are assigned to two of the four neurons, whereas two of the four neurons in the map are empty (Figure 3a). Prediction for the training set correctly classifies all the input data message vectors with an accuracy of 100% in all the datasets, since the network assigns them to the same neurons as in training process.