# Adaptive Semi-Supervised Algorithm for Intrusion Detection and Unknown Attack Identification
## 4 Experiments
### Intrusion Detection System Design  
To simulate the effectiveness of the proposed algorithm, we utilized an in-vehicle infotainment system manufactured by an automaker to collect traffic data. A diagram of the car's central control system is shown in Figure 11. A Linux-based server was used for data processing and was wirelessly connected to the infotainment system for receiving and analyzing the data. Additionally, a host running KaliOS was set up to simulate a hacker launching a network attack on the infotainment system. The in-vehicle infotainment system deploys a packet capture service based on Libpcap, actively collecting data flow information from various components connected to the system. This includes data from the in-vehicle communication system, entertainment system, and in-car control units. The captured data are then processed to extract relevant features, generating input data for the algorithm, which are uploaded to the cloud for analysis and identification by the computing server. The overall simulation framework is shown in Figure 12.  
Figure 11: Car center console. Figure 10: Comparison of performance between our algorithm and other related algorithms on the CIC-IDS2017 dataset [26; 27; 28; 29; 30]. The generator, discriminator, and encoder models trained on the CIC-IDS2017 normal traffic data are integrated into the semi-supervised detection module of the framework. After processing the traffic data extracted by Libpcap from the in-vehicle infotainment system using the preprocessing methods described earlier, the data are fed into the semi-supervised detection module. The overall packet capture analysis is shown in Figure 13.  
In the initial test experiments, we observed anomalies in the relevant indicators of various types of attacks, which fell far short of the expected results. Further verification revealed differences between the real-world vehicular network environment and the  
Figure 12: The edge-end intrusion detection component is deployed on the in-vehicle infotainment system, where it integrates a supervised learning-based intrusion detection algorithm for preliminary real-time detection at the inference layer. On the cloud side, unknown intrusion detection is deployed on the Linux server, using our TransGAN-IDS to perform intrusion detection and predict unknown network attacks based on the traffic data periodically uploaded from the edge-side infotainment system. The results are visualized and analyzed via a web interface. Figure 13: The system first discovers and activates network devices, setting up filters to capture network packets and process them individually. During packet parsing, the system extracts key information such as protocol type, source/target ports, and TCP/UDP flags, and calculates payload size. The parsed data then undergo feature engineering before being uploaded to the database. Finally, the TranGAN-IDS model performs intrusion detection, allowing for individual and combined detection outputs. open-source datasets. These differences include aspects such as communication protocols, hardware devices, and data distribution biases. This suggests that open-source datasets may not always be effective for practical applications. To more accurately assess the effectiveness of our proposed algorithm in real-world scenarios, we replaced the CIC-IDS2017 dataset with traffic data collected from simulations based on typical user behaviors in an in-vehicle infotainment system. The training dataset was generated from traffic data corresponding to real-world activities such as map navigation, online videos, and music streaming. The distribution of the collected real traffic data for training is shown in Table 3.  
Online detection may not quantitatively analyze traffic data, which could lead to experimental errors. For instance, when an attack is launched in real-time while the infotainment system is using navigation software, the data would contain both normal and abnormal traffic, making it difficult to perform accurate statistics.