# Intrusion Detection for in-Vehicle Communication Networks: An Unsupervised Kohonen SOM Approach
## 4 Theoretical Background  
### Unsupervised SOM Neural Network  
The Kohonen Self-Organizing Map (SOM) is a type of Artificial Neural Network (ANN) which allows the visualization of high-dimensional data on a two-dimensional map. The Kohonen SOM \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Field** & **CAN Message** & **Bits (Length)** & **Description** \\ \hline \multirow{3}{*}{SOF} & CAN 2.0A & 1 & The Start of Frame (SOF) indicates the start of a new message and the single bit must be \\  & CAN 2.0B & 1 & dominant as it is used for synchronizing all nodes \\ \hline \multirow{3}{*}{Identifier} & CAN 2.0A & 11 & The identifier establishes the priority of the message: the lower the value, the higher \\  & CAN 2.0B & 11 & This identifier is the first part, which is used in both the standard and extended frames \\ \hline \multirow{3}{*}{Identifier} & CAN 2.0A & - & - \\  & CAN 2.0B & 18 & In CAN 2.0B Extended, the identifier is comprised of 11 bits Base ID and 18 bits Extended ID \\ \hline \multirow{3}{*}{RTR} & CAN 2.0A & 1 & The single remote transmission request (RTR) bit is dominant when information is required \\  & CAN 2.0B & 1 & from another node. All nodes receive the request, but the identifier determines the specified \\  & CAN 2.0B & 1 & node. The responding data is also received by all nodes and used by any node interested. In \\  & & this wrap all data being used in a system is uniform [43] \\ \hline \multirow{3}{*}{SRR} & CAN 2.0A & - & - \\  & CAN 2.0B & 1 & The Substitute Remote Request (SRR) must be recessive and used in the extended frame \\ \hline \multirow{3}{*}{IDE} & CAN 2.0A & - & - \\  & CAN 2.0B & 1 & The Identifier Extension (IDE) must be recessive for extended format and dominant for \\  & CAN 2.0A & - & - \\ \hline \multirow{3}{*}{Reserved \(t0\)} & CAN 2.0B & 1 & Reverved bit must be dominant for standard format \\ \cline{2-5}  & CAN 2.0A & 2 & Bits must be dominant \\ \cline{2-5}  & CAN 2.0B & 2 & Bits must be recessive for extended format \\ \hline \multirow{3}{*}{DIC} & CAN 2.0A & 4 & The data length code (DLC) contains the number of data bytes \\ \cline{2-5}  & CAN 2.0B & 4 & \\ \cline{2-5}  & CAN 2.0A & 64 & The actual payload data which can be up to 64 bits \\ \hline \multirow{3}{*}{CRC} & CAN 2.0B & 15 & Cyclic Redundancy Check (CRC) contains the checksum of the previous data for \\  & CAN 2.0B & 15 & error detection \\ \hline \multirow{3}{*}{CRC Delimiter} & CAN 2.0A & 1 & The single bit must be recessive \\ \cline{2-5}  & CAN 2.0B & 1 & Acknowledge ensures (ACK) that all nodes involved in the message receive everything \\ \cline{2-5}  & CAN 2.0B & 1 & correctly and in case of error, the transmitter is immediately alerted to send the data packets \\ \hline \multirow{3}{*}{ACK Delimiter} & CAN 2.0A & 1 & \\ \cline{2-5}  & CAN 2.0B & 1 & again. The transmitter sends receiving the receiver asserts dominant \\ \cline{1-1} \cline{2-5}  & CAN 2.0A & 1 & The single bit must be recessive \\ \hline \multirow{3}{*}{EOF} & CAN 2.0A & 7 & End of Frame (EOF) denotes the end of a current CAN message. Bits must be recessive \\ \cline{1-1}  & CAN 2.0B & 7 & \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Controller Area Network (CAN) bus 2.0A and CAN bus 2.0B structure. is a nonlinear mapping network aimed at computing similarities among data in the input layer and representing them in an output layer of interconnected neurons according to spatial constrains [44]. Most of techniques in a neural network use supervised learning based on back propagation methods for updating weights and error correction learning. Training of supervised networks requires a target variable. The Kohonen SOM network differs from other Artificial Neural Networks since it can be trained by unsupervised learning. The SOM network uses competitive learning in order to find similarities among data, clustering them into different classes of data [45], and it is characterized by a feed-forward structure with a single computational layer [46].