# [PERSON] SOM Architecture for Intrusion Detection on In-Vehicle Communication Networks
## 5 Experimentation
### Data Preprocessing  
Before running the model, we first preprocessed the data. A CAN message is characterized by its period and by its ID, which represents a unique identifier and expresses the message's priority. Data processed in the network were the CAN ID identifier, data values DATA [0-7], DLC, period, and label. We define some notations: at each timestamp \(S_{i}\) with \(i=1,\,\ldots\,n\), where \(n\) is the total number of messages, an ECU sends a message to the CAN bus. Let \(I_{k}=\{I_{1},\,\ldots\,I_{r}\}\) be the set of all CAN ID identifiers in the dataset. For each \(I_{k}\), with \(k=1,\,\ldots\,r\), we have a set of \(D_{I_{k}}=\{D_{I_{k1}},\,\ldots\,\,,\,D_{I_{k_{s}}}\}\) data values, and \(s\) can take different values in each set \(D_{I_{k}}\). CAN ID identifiers and data values were regarded with a semantic approach considering each CAN ID identifier \(I_{k}\) as a class of messages sent by an ECU and the data values \(D_{I_{k}}\) as the related value information [32]. Since the Kohonen network works by using numerical data, we used the one-hot encoding technique to turn categorical data into a matrix representation. In particular, each CAN ID unique identifier was represented by one column with value 1 if the CAN message instance belongs to that CAN ID, or otherwise 0 (Table 3). The data values DATA [0-7] were merged in a single string representing the value information related to a particular CAN ID message. This new categorical variable was also turned into a matrix representation using the one-hot encoding technique. \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Attack Type** & **N. of Messages** & **\% of Normal Messages** & **\% of Attack Messages** \\ \hline _Denial of Service (DoS) Attack_ & 3,665,771 & 0.84 & 0.16 \\ _Fuzzy Attack_ & 3,838,860 & 0.87 & 0.13 \\ _Spoofing the Drive Gear_ & 4,443,142 & 0.87 & 0.13 \\ _Spoofing the Revolutions per_ & 4,621,702 & 0.86 & 0.14 \\ _Minute (RPM) Gauge_ & & \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Car hacking data type and size. \begin{table}
\begin{tabular}{c c c c c c c c c c c} \hline \hline
**TimeStamp** & **CanID** & **DLC** & **D0** & **D1** & **D2** & **D3** & **D4** & **D5** & **D6** & **D7** & **Label** \\ \hline
1478193191230940 & 04f0 & 8 & 0 & 0 & 0 & 0 & 80 & 0 & 67 & d1 & 13 & R \\
1478193191234870 & 05f0 & 2 & 1 & 0 & & & & & & R \\..  
We did not process the CAN message data in a sequential way but with respect to their period. CAN messages can be periodic, sporadic, or aperiodic. Periodic messages are sent at regular time intervals, sporadic messages occur with a minimum time interval and aperiodic messages at arbitrary times [19]. Hence, starting from timestamp defined as \(S_{i}\), with \(i\) = 1,... \(n\), we calculated a new variable \(T\) whose elements \(T_{i}\), with \(i\) = 1,... \(n\), express the time in milliseconds between two successive occurrences with the same CAN ID identifier. The dataset contained a high number of periodic, sporadic and even aperiodic messages with different CAN IDs sent at different times and with different frequencies. They all were included in the analysis. Finally, we normalized all the numerical variables in order to avoid bias in the training process that can be generated when dealing with very large input vectors [42]. Normalization was obtained using a linear transformation to scale the numerical variables to have values between 0 and 1. \(X\) represents the input layer processed in the Kohonen network where \(X_{i}\) is the \(i\)-th input CAN message data vector (Table 3). A second layer Y, given by the dependent variable label, was presented to the network. The variable label, since it is a categorical variable with the classes \"Attack\" and \"Normal\", was also transformed into a matrix with two columns, one for each class, and \(n\) rows of 0 or 1, one for each input data vector (Table 3). The _DoS_ and _spoofing the gear/RPM_ datasets present a quite regular structure. Normal messages are sent on the CAN bus using 26 different CAN ID identifiers.