# Intrusion Detection for in-Vehicle Communication Networks: An Unsupervised Kohonen SOM Approach
## 4 Theoretical Background
### Unsupervised SOM Neural Network
The Kohonen output network consists of a competitive layer where an \(n\)-dimensional _codebook_ vector is assigned to each neuron in the map and the vector elements represent weights [47]. SOM networks try to reproduce the topological order of input data through clusters of neurons and neighbors whose number is defined by the size of the map [48]. Spatial constraints entail that neighboring neurons have similar codebook vectors. Input data vectors are assigned to neurons according to defined measures of distance between them [44] If two different input data vectors are similar, then they will be mapped in neighboring neurons on the network grid. Hence, input data vectors mapped on the same neuron or in the neighboring ones are similar. The SOM algorithm computes similarities between each input data vector and the neurons' codebook vectors in order to find the most similar. The winning neuron, called _Best Matching Unit_ (BMU), adjusts its codebook vectors basing on a weighted average in order to move closer to the input vector. The weight of the attraction between the BMU and the input data vector is one of the training parameters of the model also called _learning rate_\(\alpha\). This parameter changes at each iteration, decreasing during the training process and ensuring the convergence of the model [48]. Additionally, the neighboring neurons adjust their codebook vectors in order to better match with the input vector, thereby ensuring the spatial constraints in order to preserve the topology of the map. Figure 1 shows a simple illustration of the Kohonen SOM algorithm. After determining the number of neurons in the Kohonen map, a codebook vector is randomly initialized for each neuron. Then, the algorithm computes the distance between a CAN message vector random selected and all the neurons' codebook vectors in the map. The neuron with the smallest distance is the winner, also called the Best Matching Unit. The algorithm also identifies neurons with similar codebook vectors as neighboring neurons. Both the BMU and neighboring neurons are updated in order to move closer to the CAN message vector. The same procedure is repeated for all CAN messages and for a given number of iterations. The Kohonen SOM network can be trained using the online and the batch algorithms [49]. In the _online_ algorithm, the BMU and the neighborhood neurons are adjusted immediately after an input vector is presented to the network. In the _batch_ algorithm, the BMU and the neighborhood neurons are updated after all the input data vectors are presented to the network [50]. Formally, we defined the input data vectors \(Xi\), with \(i=1,\,\ldots,\,n\), the Kohonen neurons \(Rj\), with \(j=1,\,\ldots,\,m\), and the codebook vectors \(Wj\) with \(j=1,\,\ldots,\,m\) associated to each neuron. The number of elements of the codebook vector equals the number of variables in the input data vector [51]. We also set the number of iterations \(t\) with \(t=1,\,\ldots,\,s\). The number of iterations to complete the leaning process is expressed in _epochs_. One epoch indicates the steps of the learning algorithm that allow a complete presentation of the input dataset to the network in order to be learned. Many different measures of similarity can be used to measure the distance between input data vectors \(X_{i}\) and neurons' codebook vectors \(W_{j}\)[48], such as Manhattan, Tanimoto, Bray Curtis, Canberra, and Chebyshev distances. However, Euclidean distance normally gives slightly better classification results and epoch \(t\) can be defined as follows:  
\[d_{j}(t)\ =\ \|X_{i}(t)-W_{j}(t)\|, \tag{1}\]  
where Euclidean distance is computed between the CAN message vector \(Xi\), randomly selected, and all the codebook vectors \(W_{j}\) with \(j=1,\,\ldots,\,m\) on the Kohonen map. Subsequently, the neuron associated to the codebook vector \(W_{j}\) with the minimum distance to \(X_{i}\) is the winning neuron BMU.