# [PERSON] SOM Architecture for Intrusion Detection on In-Vehicle Communication Networks
## 2 Related Works  
The attackers can maliciously interfere with vehicular communication that occurs both internally and externally to a vehicle [21]. Internal vehicular communications can take place within the in-vehicle network that is based upon the intercommunication of the many ECUs; instead, the external vehicular communications occur when the vehicle connect directly to USBs and maintenance tools. In this research work, we take into consideration the in-vehicle network with the objective of defining a model for the identification of attack messages on an in-vehicle CAN bus. CAN transmissions are broadcast to all nodes and according to [22], the attacks could replace an authorized ECU program with an illegitimate, malicious program, and connecting to the CAN bus using an unauthorized device. Therefore, the attackers can perform a _Masquerading Attack_ i.e., masquerades as a legitimate node because the CAN frame are not encrypted and it does not support message authentication [21], _Eavesdropping Attack_, the attackers can intercept the CAN transmissions and identify patterns in valid CAN frames [23]; _Injection Attack_ to inject false messages into an automotive bus system; _Replay Attack_, where valid frames are sent continuously in order to impede the vehicle's real-time functioning; _Denial of Service Attack_ (DoS), which occurs when an attacker continually sends high priority messages that block legitimate low priority messages [21]; _Distributed Denial of Service (DDoS) Attack_, the attackers launch an attack from different locations and is more severe in the vehicular environment because the mechanism of the attack is in a distributed manner, where the impact is dispersed in the network [24]; _Bus-off Attack_, a type of DoS attack that exploits CAN error handling (bit error, stuff error, CRC error, form error, ACK error) to intentionally shift the victim node to the bus off state. The attacker causes a bit error of the victim node and a message collision by transmitting the frame at the same timing as the victim node. This is repeated every time the victim node sends a message, and puts the victim node into the bus-off state [25]; _Fuzzy Attack_, that is aimed to make the system confused thanks to the manipulation of normal CAN ID and data fields [26]; _Impersonate attack_ is aimed to make legitimate engine speed signal (RPM) and gear components behave abnormally [26; 27]. In order to identify attacks on in-vehicle communications, different intrusion detection systems have been developed. The categories of IDS used in the automotive domain comprise anomaly, specification, signature and hybrid-based techniques. Anomaly and specification-based methods detect anything that deviates from a normal behavior, but, in the first approach, normal behavior is learned in a training phase; in the second approach, specifications and rules need to be defined manually by a human expert. The signature-based approach detects attacks by using a set of previously defined signatures, rules and malicious events. Meanwhile, the hybrid-based approach combines several IDS techniques. Due to the characteristics of the CAN protocol, which can frequently be modified, an anomaly-based approach using the machine learning technique can be a suitable detection method. Indeed, it allows the IDS to learn from examples and, thus, to adapt to any change in the protocol with no need of the rules previously defined. As a result, different machine learning techniques have been used, for example, neural network classifiers, Bayesian classifiers, Bayesian regularized neural networks, naive Bayes, support vector machines (SVM), and self-organization maps (SOM) [28; 29]. In [30], an intrusion detection system (IDS) based on a deep convolutional neural network (DCNN) is proposed to protect the CAN bus of the vehicle. The DCNN learns the network traffic patterns and detects malicious traffic without hand-designed features. The proposed model demonstrated a good detection performance against message injection attacks.