# [PERSON] SOM Architecture for Intrusion Detection on In-Vehicle Communication Networks
## 4 Theoretical Framework
### Unsupervised Kohonen Network
The number of iterations in the training process is expressed in _epochs_, where one epoch indicates the steps of the training algorithm which allows one complete presentation of all the input data vectors to be learned by the network. The online training algorithm of the SOM can be implemented using a stepwise recursive procedure detailed in Algorithm 1. Many different measures of similarity can be used to measure the distance between the input data vectors \(X_{i}\) and the neurons \(R_{j}\) codebook vectors [43] such as Manhattan, Tanimoto, Bray Curtis, Canberra, Chebyshev distances. However, Euclidean distance normally gives slightly better classification results [47]. We define \(R_{c}(t)\) as the winning neurons \(R_{BMU}\) with the minimum Euclidean distance from the input data vector \(X_{i}(t)\) at the iteration \(t\) where:  
\[c=\min_{j}\left\{\|X_{i}(t)-R_{j}(t)\|\right\} \tag{1}\]\(R_{c}(t)\) is the neuron which best matches the input vector \(X_{i}(t)\) in the grid at iteration \(t\)[48]. Once the winning neuron is found, the neuron and its spatial neighbors are updated by the following:  
\[R_{j}(t+1)=R_{j}(t)+h_{jc}(t)\Big{[}X_{i}(t)-R_{j}(t)\Big{]} \tag{2}\]  
where \(h_{jc}(t)\) is the _neighborhood function_. The rate of change at different neurons around the winning neuron depends on the mathematical form of the neighborhood function. This function has a very central role in the SOM networks since it preserves the topological properties of the inputs. A variety of neighborhood functions can be used, but the most applied in SOM neural networks is the _Gaussian neighborhood function_:  
\[h_{jc}(t)=\alpha(t)\cdot\exp\left(\frac{\|r_{j}-r_{c}\|^{2}}{2\sigma(t)^{2}}\right) \tag{3}\]  
where \(\alpha(t)\) is the _learning rate function_ which is a function monotonically decreasing at each iteration \(t\) and \(\sigma(t)\) expresses the width of the neighborhood function also decreasing with the training process. \(r_{j}\) is the position of neuron \(j\). A variant of the traditional online SOM algorithm is the _batch_ algorithm where neurons' codebook vectors are adjusted only after all the input data vectors \(X_{i}\) in the input layer are assigned to their winning neurons \(R_{BMU}\) in the network. At iteration \(t\), the codebook vectors of winning neuron and neighbors' neurons are updated as follows:  
\[R_{j}(t+1)=\frac{\sum_{i=1}^{n}h_{jc(i)}(t)X_{i}}{\sum_{i=1}^{n}h_{jc(i)}(t)} \tag{4}\]  
where \(c_{(i)}\) is the index of the winning neuron \(R_{BMU}\) for the input data vector \(X_{i}\) and \(n\) is the number of the input data vectors. ```
Input: Input layer consisting of CAN message data vectors \(X_{i}\) with \(i=1,\ldots,n\), Output: Output Kohonen layer \(R_{X}\) containing final codebook vectors associated to neurons \(R_{j}\) with \(j=1,\ldots,m\), Results: Assign CAN message data vectors \(X_{i}\) to the winning neuron \(R_{BMU}\) on the Kohonen map set(\(n,\,m,\,2\))//set number of messages, number of neurons, number of epochs \(R_{j}\leftarrow\varnothing\) for\(j=1,\ldots,m\)do \(R_{j}\leftarrow\text{random}(X_{i})//\text{random codebook vectors initialization}\) endfor set(\(\alpha\))//set initial learning rate while\(t<z\)do for\(i=1\):\(n\)do \(X_{i}\leftarrow\text{random}(X_{i})//\text{random selection of a CAN message data vector}\) for\(j=1\):\(m\)do \(d_{j}=\|X_{i}-R_{j}\|\)//compute Euclidean distance endfor \(d_{c}=\underset{j}{\text{min}}\underset{j}{\text{min}}\underset{j}{\text{min}}\)//compute the winning neuron \(R_{BMU}\) for\(j=1\):\(m\)do \(R_{j}=R_{j}+h_{jc}(\alpha)\Big{[}X_{i}-R_{j}\Big{]}//\text{update neurons}\) endfor endfor  update \(\alpha\)  end for
```  
**Algorithm 1** Kohonen SOM algorithm