# Intrusion Detection for in-Vehicle Communication Networks: An Unsupervised Kohonen SOM Approach
## 6 Results and Discussion  
As described in Section 5, we made a distance-based intrusion detection system aimed at identifying attack messages injected into the CAN bus. The system was based on an unsupervised Kohonen SOM network combined with a k-means algorithm using two different approaches. The models were tested first by individually training _DoS_, _spoofing gear_, _spoofing RPM_, and _fuzzy_ datasets, and then by merging the four different kinds of attack into a unique _mixed_ dataset. The test was conducted on samples of 10,000 CAN messages vectors for each dataset. Samples were randomly selected, balancing the ratio of CAN ID identifiers, and were split into 80.00% training and 20.00% test sets, again stratifying the CAN ID identifiers for all the datasets with the exception of the _fuzzy_ dataset. There was a high number of different messages identifiers in the _fuzzy_ dataset--2017 unique CAN IDs, 97.1% of whom showed a relative frequency less than 0.1%. Since the nature of attack and normal messages sent in the CAN bus differs in terms of structure and frequency, we weighted input message data vectors depending on their frequency in the whole traffic dataset. The training sets were used to train the algorithms and the test sets to evaluate the models' performances. We trained the unsupervised Kohonen SOM network on a \(2\times 2\) (four neuron) map as described in Section 5.2. The network computed the codebook vector for each neuron in the Kohonen map and the input CAN message vectors were assigned to the closest neurons. Figure 5 illustrates results of the unsupervised Kohonen SOM network, respectively, for _DoS_, _spoofing gear_, spoofing _RPM_, _fuzzy_, and _mixed_ datasets. In particular, Figure 5 shows input CAN message vectors assigned to neurons in the map by the Kohonen SOM network for test sets. It is evident that attack and normal messages are well separated in _DoS_, _spoofing gear_, and spoofing _RPM_ datasets. The distinction is less clear in the _fuzzy_ dataset, due to its more complex structure, and, consequently, in the _mixed_ dataset. Following the traditional procedure, the codebook vectors computed by the Kohonen SOM network were given as input to the k-means algorithm, in order to cluster the neurons in two groups, attack and normal (SOMK-C). In each dataset, the k-means algorithm clustered three neurons as normal, represented in yellow, and one neuron as attack, the red one. Results for test sets are shown in Figure 6.  
Figure 5: Unsupervised Kohonen SOM network trained on the test set. Figure 7 represents, for each dataset, the distance between each input CAN message vector and its winning neuron BMU computed by the Kohonen SOM network for the training set. Blue and green points in the plots represent, respectively, attack and normal messages. Table 5 shows distance metrics distinguished for attack and normal messages as classified by the SOMK-C for training set. Plots and related metrics highlight regular patterns and clear separation in distances in _DoS_, _spoofing gear_, and spoofing _RPM_ datasets, which were slightly less evident in _fuzzy_ and _mixed_ datasets. In light of this, we tried to improve the efficiency of the Kohonen SOM network in identifying attack messages using a second procedure that takes into account the evident separation in distances. We tried to enhance the separation between attack and normal messages by clustering distances from input CAN message vectors and corresponding winning BMU neurons. With that aim, after computing Euclidean distances between each input CAN message vector and its winning BMU neuron, we clustered them into two groups using the k-means algorithm (SOMK-D). Results for the test sets are shown in Figure 8 where it is evident how this procedure greatly improves the efficacy of the model in terms of detecting attack messages--completely succeeding in _DoS_, _spoofing gear_, and spoofing _RPM_ datasets.