# [PERSON] SOM Architecture for Intrusion Detection on In-Vehicle Communication Networks
## 2 Related Works
However, it has a fundamental limitation in detecting the unlearned types of attacks because it is based on supervised learning. Instead, in [31], the authors used an unsupervised deep neural network (DNN) to enhance the security. They trained the parameters of the DNN with probability-based feature vectors extracted from the in-vehicular network packets by using an unsupervised pre-training method of deep belief networks, followed by the conventional stochastic gradient descent method. The DNN provides the probability of each class to discriminate normal and hacking packets, and thus, the system can identify any malicious attack to the vehicle as a result. DNN is also implemented in [32] treating anomaly detection as a cross-domain modelling problem. The proposed technology provides real-time responses to anomalies and attacks to the CAN bus, and improves the detection ratio. Instead, in [33] a novel neural network architecture, CANet, is presented. It is trained in an unsupervised manner to detect intrusions and anomalies on the CAN bus. The risks highlighted by the authors are that neural networks require a large amount of training data and are typically more computationally expensive than many other approaches, and in a security setting, they can be sensitive to adversarial attacks. Additionally, in [26], an anomaly detection method using an unsupervised deep learning-based approach, deep contractive autoencoders (DCAEs), was developed. They imposed a different penalty term to the CAN data representation in order to encourage robustness towards small changes. After analyzing the attacks and the different in-vehicle CAN bus solutions developed to identify them, our research focused on the implementation of an IDS based on a supervised Kohonen SOM network for the identification of attack messages, considering the following types: DoS, spoofing gear, spoofing RPM, and fuzzy. The Kohonen SOM is a network that can be trained both as a supervised and an unsupervised learning network. There are different works that show the validity of this approach in IDSs. In [34], a SOM network was performed for real-time textual classification in order to filter web contents. A SOM network was also used for real-time intrusion detection in home appliances interconnected by a gateway [35]. Moreover, a SOM network was performed for real-time credit card fraud detection in order to analyze customer behavior [36]. The network showed high capabilities in identifying hidden patterns otherwise difficult to understand. In [37], a self-organizing feature map neural network combined with a K-means clustering algorithm (KSOM) was proposed to improve the efficiency of the intrusion detection network by leveraging the characteristic of the K-means clustering algorithm, such as a faster clustering speed. The model was tested on the NSL-KDD dataset, a classic well known IDS dataset, containing four attack categories and approximately 40 different attack types, and a high number of features, equal to 41, for each connection record. Experimental results showed that the iterations of the KSOM algorithm were significantly reduced compared with the SOM network model and the accuracy was significantly improved with respect to other methods of intrusion detection network. Taking into account the strong capabilities of the SOM network as an anomaly detector in real-time systems, Kohonen SOM networks have been applied to many different areas of security [18] but have never been performed on an in-vehicle communication network. The contribution of our research is to introduce a distance-based IDS using a Kohonen self-organizing map network integrated with a K-means clustering algorithm on a CAN bus for identifying attack messages on the bus. Results and discussions for the supervised SOM are presented in this paper. We compared two different approaches.