# Intrusion Detection for in-Vehicle Communication Networks: An Unsupervised Kohonen SOM Approach
## 1 Introduction  
The automotive sector has been undergoing a radical transformation in recent years. Vehicles' cyber-physical systems are partially or totally controlled by software run by electronic devices increasingly interconnected with the outside world through networks of various types [1]. A number of initiatives concerning smart mobility [2] and autonomous driving are, indeed, experiencing increasing development in urban areas and smart city contexts [3, 4]. Automatic systems to maintain the lane, cruising speed, and movement in the queue; to park automatically; and to check the state of attention and sobriety of the driver [5], are just some of the advantages. At the same time, these advantages have significantly increased the attack surface area. There are several access points [6] that an attacker can use to try to compromise the security of the vehicle: connections to smartphones; USB inputs; the mobile network to receive information, transmit data, and make calls to external services [7, 8]; Wi-Fi connections that can be used to connect other mobile devices on board the vehicle. Those are just some of the known channels [9] and in this scenario,continuous software improvements [10; 11] become necessary in order to detect and respond in time to possible attacks. Proper methods and tools capable of managing the complexity [12] can guarantee not only the protection of the vehicle, but also and above all, that of the people. In this research, we take into consideration the vehicle's internal network, the Controller Area Network (CAN), as it allows safety-critical electronic control units (ECUs) that are attached to sufficiently broadcast information in the form of CAN packets between them and other connected busses through several gateways [13]. The CAN bus system presents several critical vulnerabilities [14]. For example, receiving nodes are unable to verify whether the received packet is legitimate or not since the origin of the packets is not provided. Consequently, ECUs can be used by attackers to falsify and send fake CAN packets. This makes a CAN bus system insecure and poorly equipped in order to identify which nodes launched the attacks. In view of these considerations, security systems to protect the CAN bus became an urgent need [15]. Intrusion detection techniques traditionally used in network security cannot be implemented in the automotive domain. Since network-based attacks are relatively new in the automotive field, new challenges arise in the development of efficient and adaptable systems for securing automotive networks [16]. Since the CAN protocol can be frequently modified, a Machine Learning approach could be the proper way to implement a detection method which, learning by examples, is able to adapt to any change in the protocol. Most of the intrusion detection systems (IDSs) based on Machine Learning proposed in the literature are deployed in a supervised manner. This requires data to be completely labelled, even if this can be unfeasible considering the high volume of data generated by a real time CAN in milliseconds [13]. Thus, an anomaly-based detection system implemented using an unsupervised Machine Learning approach is more desirable and convenient. In the present work, we introduce a distance-based intrusion detection system aimed at identifying attacks sent on the CAN bus. The proposed system was based on an unsupervised Kohonen Self-Organizing Map (SOM) network, an Artificial Neural Network that can be trained both through supervised and unsupervised learning. The algorithm maps a high-dimensional data space to a low-dimensional one, preserving the topological properties of input data. It is a power classifier able to separate normal from anomalous data while preserving the topological relationship between the features with no need for labels. Due to the powerful capabilities in clustering and visualization of complex, highly dimensional data, the SOM network extensively evolved, thereby finding many applications in intrusion detection [17].