# Intrusion Detection for in-Vehicle Communication Networks: An Unsupervised Kohonen SOM Approach
## 1 Introduction
The algorithm showed high performance as an anomaly detector in real-time systems, and compared to other intrusion detection techniques, revealed better performance by showing a shorter training time and higher detection efficiency [18; 19; 20]. The SOM network is finding applications in new areas of security, never approached in a similar way before, such as anomaly-based detection [21]. In the light of these, we propose to test the effectiveness and the efficiency of an unsupervised Kohonen SOM network in the automotive domain, since, to the best of our knowledge, it was never tested in said area before. Many hybrid methods based on the integration of the Kohonen SOM network with other clustering methods were proposed in order to improve detection accuracy and reduce false alarm rates. One of the most common methods is based on the combination of the Kohonen SOM network with the k-means algorithm [22; 23]. Intrusion detection networks were usually tested on the well-known KDD99 dataset and on its refined version, the NSL-KDD dataset [24]. These datasets have large numbers of features and experiments. References [25; 26; 27; 28] showed that detection accuracy achieved its high performance when including all the features in the analysis. The richer the feature space is, the higher the detection rate achieved [17]. The goal of the present research is to evaluate the performance of an anomaly-based intrusion detection system using an unsupervised Kohonen SOM neural network for the identification of attack messages sent on the CAN bus. We propose a novel distance-based procedure to integrate KohonenSOM network and k-means algorithm, which greatly improved accuracy in detecting attack messages compared to the traditional procedure. The proposed method and the traditional procedure based on the combination of the Kohonen SOM network and k-means algorithm, were tested on open source data concerning traffic messages sent on a CAN bus 2.0B with a very complex structure, characterized by large volume of traffic with low number of features and a highly imbalanced data distribution. The dataset contains more than 2000 different kinds of messages sent totally at random on the CAN bus and all included in the analysis. Despite the complex structure of the dataset, the proposed method showed high detection accuracy with a low false negative rate. The main contributions of the paper are:  
* An anomaly-based IDS implemented using unsupervised learning to identify intrusions on an in-vehicle communication network, in particular, a CAN bus. At the state of the art level, this is the first work which tests an unsupervised Kohonen SOM network as an anomaly detector in the automotive domain. * A novel distance-based procedure to integrate Kohonen SOM network and k-means algorithm, which greatly improves accuracy in detecting attack messages compared to the traditional procedure. Moreover, the proposed method significantly reduces false negative rate, which assumes a great importance in attack detection for in-vehicle CAN buses. Its value should be very low to ensure the safety of the vehicle. * The proposed method was tested on real car-hacking data, including _DoS_, _spoofing the drive gear_, _spoofing the RPM gauge_, and _fuzzy_ attacks. Data were obtained by logging CAN traffic via the OBD-II port from a real vehicle while message injection attacks were being performed. The performance of the proposed method was shown via computing evaluation metrics. * The proposed method was performed with remarkable results both using single datasets only containing one type of attack and also merging all types of attack into a unique dataset. * Most of the studies in the literature propose IDSs only able to detect periodic attacks but not aperiodic violations. The proposed method reveals remarkable performance in detecting both periodic and aperiodic intrusions.