# Adaptive Semi-Supervised Algorithm for Intrusion Detection and Unknown Attack Identification
## 2 Related Work  
Today, a significant body of research has applied machine learning and deep learning techniques to address problems in network security. In [6], an intrusion detection algorithm based on convolutional neural networks (CNN) was proposed using a deep Maxout network for detection. The weights and training parameters were optimized using the Remora algorithm, ultimately achieving high accuracy. In [7], a method combining various types of recurrent neural networks (RNN) for intrusion detection was introduced. The model's performance was evaluated on the NSL-KDD [8] and UNSW-NB15 [9] datasets, demonstrating its superior performance. However, these methods heavily depend on large amounts of data, which are often difficult to obtain in real-world applications due to challenges in collecting anomalous traffic data, leading to extreme data imbalance. As a result, such methods remain largely confined to academic research.  
Generative adversarial networks (GANs) represent a crucial branch of deep learning, widely used for anomaly detection in computer vision. Some studies have utilized GANs as data processing tools to generate synthetic data that alleviate data imbalance. For example, Ref. [10] used a GAN to generate virtual data resembling existing data to balance the data distribution. However, the virtual data generated by GAN may not fully capture the complexity of real-world data, particularly when dealing with complex minority classes, which can negatively impact model performance. Additionally, GANs are prone to \"mode collapse\" during training, where the generator produces similar samples, failing to capture the diversity of the data [11]. Over-reliance on synthetic data can lead to overfitting, reducing the model's generalization ability when applied to real-world data.  
Some studies have also leveraged GAN for image defect detection. In [12], an unsupervised image anomaly detection method based on GAN was proposed, combining selective skip connections and hybrid attention mechanisms, with the Earth mover's (EM) distance optimizing the loss function [13]. This approach effectively improved image reconstruction quality, training stability, and enhanced detection capabilities in high-speed railway contact networks.  
Given the constant evolution of hacking techniques, current intrusion detection methods, which rely on known attack data, are insufficient for detecting unknown and novel cyberattacks. As a result, numerous studies have emerged employing unsupervised or semi-supervised approaches to tackle network security challenges [14; 15; 16]. For instance, ref. [17] introduced the GANomaly model, which is based on deep neural networks for semi-supervised learning. The model designs an adaptive algorithm to dynamically train subsets of datasets, and was validated on four adaptive datasets, achieving promising results on the NSL-KDD and UNSW-NB15 cybersecurity datasets. Similarly, ref. [18] proposed an unsupervised intrusion detection method for vehicular communication networks, combining the feature extraction capabilities of autoencoders with precise clustering via fuzzy C-means (FCM) [19; 20]. This approach does not require labeled datasets for training and demonstrates broad generalization ability and robustness.  
While these studies show promising results in detecting unknown and novel attacks, they still have some limitations. They struggle to capture long-range dependencies in network traffic, which makes it difficult to fully detect detailed characteristics in complex network attacks. Furthermore, when handling high-dimensional and complex IoT network traffic, these methods may fall short in achieving optimal feature representation. Although progress has been made in improving generalization and robustness, these methods continue to face challenges when confronted with highly complex and diverse attack scenarios.