# Intrusion Detection for in-Vehicle Communication Networks: An Unsupervised Kohonen SOM Approach
## 2 Related Works  
Recent works showed that data generated by connected vehicles can be a great resource for the development of next generation cybersecurity solutions [29]. In [30; 31] the authors highlight the trend of increasing research interest in applications of Machine Learning (ML) and Deep Learning (DL) in cybersecurity for the automotive industry. The learning types and their applicability in the automotive industry are: _supervised ML models_ which deal with labelled data concerning automotive used to train the ML classification model; _unsupervised/self-supervised ML models_ that create clusters from various vehicle data streams with no need for labelled data can be further analyzed to detect abnormal behavior; _reinforcement learning models_, although less mature than the first two, provide a means to develop autonomous cybersecurity solutions that can take human-defined meta-goals as input and make decisions to achieve that goal [29]. A cybersecurity solution need not to be limited using a single architecture [32] or a single model [33], and in accordance with that, our research investigates the cybersecurity solutions which propose a distance-based intrusion detection system based on an unsupervised Kohonen SOM network. Therefore, our goal is to test the SOM network in order to identify attacks within the CAN bus. In the literature there are different ML models applied to automotive cybersecurity solutions (Table 1), such as the Bayesian network, to determine whether the vehicle is under attack, but also whether the attack has originated from the cyber or the physical domain [34]; the Deep Neural Network (DNN) to train in-vehicle network packets exchanged between ECUs to extract low-dimensional features, and it is used for discriminating normal and hacking packets [35]; the long short-term memory neural network to detect CAN bus attacks [36]; Convolutional Neural Networks (CNNs) to classify malware samples [37]; and Generative Adversarial Networks to generate the adversarial attacks, which can deceive and evade the intrusion detection system [38]. Each of them allows providing a solution for a specific class within the vehicle (network security, VANET situational awareness, vehicle intelligence, and others [29]), but there is no trace in the literature of a SOM network application in automotive context. The Kohonen SOM network is a popular non-linear model of unsupervised neural network for the solution of dimensionality reduction problems [39] and it found mostly in applications concerning security issues [17] because of its features of high detection rate, short training time, and high versatility [22]. Starting from the results obtained in the application of the Kohonen SOM network, we extended this model in the automotive domain. We propose an intrusion detection system to identify attack messages sent on the CAN bus based on an unsupervised Kohonen SOM network. In many studies, the SOM network was integrated with other clustering methods in order to improve the efficiency of the model [17]. [PERSON] et all. in [23] combined the unsupervised SOM network with the k-means algorithm using two different approaches and tested both methods on the KDD CUP-99 dataset, commonly used to test intrusion detection system. Their methods showed good stability of efficiency and clustering accuracy. [PERSON] et all. in [22] also proposed an intrusion detection method based on the integration of the unsupervised SOM network with the k-means algorithm and tested their model on the NSL-KDD dataset, a refined version of the KDD CUP-99. Both the datasets are characterized by a high number of features, equal to 41, for each connection record. The proposed method relatively improved the accuracy of network intrusion and significantly reduced the number of clustering iterations than the SOM network. We applied and evaluated the performance of the unsupervised Kohonen SOM network as an intrusion detection system on an in-vehicle communication network, in particular, on a CAN bus.