# [PERSON] SOM Architecture for Intrusion Detection on In-Vehicle Communication Networks
## 1 Introduction  
In recent times, cyber security is a key word in the automotive sector. It is necessary on the one hand to preserve the confidentiality, integrity and availability of such systems, and on the other hand, to ensure the safety of people. An example of such a need is visible in smart cities where the development of smart mobility [1; 2] and autonomous driving involve different projects [3; 4]. Driving and parking assistants, internet connectivity, and in general all the cyber-physical features installed in cars, involve risks in terms of security and privacy. One of many is the possibility to obtain personal information and vehicle data such as fuel consumption, oil level, and handbrake operation. In the automotive sector, given the critical nature of the software installed on board, in addition to the approaches to continuous software improvement [5; 6; 7] and software security [8; 9], it is necessary to have ad hoc methods and tools capable of managing the complexity [10] and criticality of cyber physical systems that include physical objects equipped with a microprocessor or microcontroller and a memory bank. In this context, the so-called embedded system is the electronic control unit (ECU) [11] that governs various functions inside the vehicle. The structure of automotive machines is divided into subsystems, each one in charge and separated from the others for each function, some of which have a clear impact on the safety of people onboard: power train system; chassis control system; body control system; and infotainment system. By accessing the car's internal communication network, the controller area network (CAN) [12], it is possible to read the data exchanged between the ECUs, modify, replicate and/or block them, thus causing problems of various nature; from minor ones, such as providing the driver with incorrect information regarding some vehicle consumption data, to major ones such as damaging the car brakes by blocking messages before they reach the ECUs [13]. Since the CAN bus protocol does not provide security systems against cyber and physical attacks, and given the increasing number of novel types of attack, it is desirable to have a system to detect any kind of attacks. Traditional intrusion detection systems (IDS), normally used in network security, cannot be directly used for vehicular networks. Due to the high interest in the automotive sector in recent years, an effective and efficient IDS that can work for in-vehicle networks is an important need [14]. The purpose of the paper is to test an anomaly-based IDS implemented using an artificial neural network that, compared to other machine learning approaches, can show remarkable performance in detecting attacks on in-vehicle networks. Given these premises, we propose a distance-based IDS for the identification of attack messages on an in-vehicle CAN bus. The system has been implemented using the Kohonen self-organizing map (SOM) network, an efficient and fast intrusion detection method that can be trained both as supervised and unsupervised learning. Due to its self-organizational and topological properties, the algorithm has powerful capabilities in the clustering and visualization of complex, highly dimensional data, and has found broad applications in security issues. In particular, the Kohonen SOM network has revealed remarkable performance as an anomaly detector in real-time systems. Compared to other intrusion detection methods, the Kohonen SOM network has shown better performance with a shorter training time and higher detection efficiency [15; 16; 17]. A recent review of the literature shows that the use of the SOM algorithm opened up new areas of security, which have not been tackled in a similar way before, such as anomaly-based detection [18]. In view of these considerations, we propose to test the Kohonen SOM network on an in-vehicle communication network, since, to the best of our knowledge, it was never tested in such domain.