# Intrusion Detection for in-Vehicle Communication Networks: An Unsupervised Kohonen SOM Approach
## 5 Materials and Methods
### Dataset Pre-Processing  
The _DoS_ attack, _spoofing the drive gear_, and _spoofing the RPM gauge_ datasets present quite regular structures, since messages sent on the CAN bus are characterized by a limited number of different kinds of CAN ID. Figure 3 shows the frequency distribution of the CAN ID identifiers for each dataset and for the _mixed_ dataset. The _DoS_ dataset presents a very simple structure since it contains normal messages sent with 26 unique CAN IDs and a high frequency of attack messages sent with one different unique CAN ID. _Spoofing the drive gear_ and _spoofing the RPM gauge_ datasets also show regular structures including a total of 26 unique CAN IDs sending normal messages, one of whom sends attack messages as well. These three datasets are quite simple to analyze and the proposed model completely succeeded in detecting attack messages when tested on them. The _fuzzy_ dataset presents a very complex structure which is really difficult to analyze, since messages are sent on the CAN bus using 2017 different unique CAN IDs. Attack messages are sent using all CAN IDs, just 37 of whom are used to also send normal messages. Moreover, messages sent using 97.1% of unique CAN IDs show a relative frequency of less than 0.1% and are transmitted totally randomly. Hence, the _mixed_ dataset, the result of merging all datasets, highlights an even greater complexity in the analysis. All datasets included the following information: recorded time in seconds, _timestamp_, identifier of CAN message in HEX, _CAN ID_, number of data bytes from 0 to 8, _DLC_, data values, _DATA[0-7]_, and a label R or T which represent, respectively, normal or attack messages (Table 3). In order to run the network, data were properly pre-processed. CAN ID identifiers and data values were dealt with a semantic approach considering each CAN ID identifier as a category of messages sent by an ECU and data values as the related value information [54]. Since SOM networks can process only numerical data, these categorical data were transformed into a matrix representation using the one-hot encoding technique. Each CAN ID identifier was represented by a column with value 1 if the message was sent with that CAN ID and 0 otherwise. Data values were merged in a unique string representing the value information of the CAN message. The new variable obtained was also transformed into a matrix representation using the one-hot encoding technique. With regard to time, data were not processed in chronological order, but in relation to CAN messages period. CAN messages can be periodic, sporadic, or aperiodic. Periodic messages occur at regular time intervals, sporadic messages are sent with a minimum time interval, and aperiodic messages are sent at totally random times [41]. Starting from timestamp, we derived a new variable \(S\) whose elements \(Si\), with \(i\) = 1,..., \(n\), where n is the total number of messages, express the time in milliseconds between two successive instances sent on the bus with the same CAN ID identifier. The datasets contained high numbers of periodic, sporadic, and even aperiodic messages with different CAN IDs sent at different times and with different frequencies. In the analysis we included all kinds of  
Figure 2: Experimentation process. messages. The analysis of the _fuzzy_ dataset was the most complex since the structure of the dataset was totally random. Finally, numerical variables, namely, S and DLC, were normalized in order to avoid bias in the training process that can be generated when dealing with very large input vectors [47]. Normalization was obtained using a linear transformation to scale numerical variables to have values between 0 and 1 as follows:  
\[Z_{n}\ =\ \frac{Z_{0}-Z_{min}}{Z_{max}-Z_{min}}. \tag{6}\]  
where \(Z_{0}\) is the value of the generic numerical variable \(Z\) before normalization and \(Z_{n}\) is the new value of \(Z\) after normalization. \(Z_{min}\) and \(Z_{max}\), respectively, are the minimum and the maximum value of \(Z\) in sample data.