# Adaptive Semi-Supervised Algorithm for Intrusion Detection and Unknown Attack Identification
## 1 Introduction  
With the rapid development of Internet of Things (IoT) technology, the number of IoT devices has grown exponentially, becoming deeply integrated into our daily lives. However, the widespread adoption of these devices has also introduced significant security challenges. According to \"The 2024 IoT Security Landscape Report\" [1], there are approximately 3.8 million smart homes globally, containing around 50 million IoT devices, which collectively generate over 9.1 billion cybersecurity incidents. These incidents have exposed numerous vulnerabilities and attack scenarios. As the number of smart devices continues to rise, cybersecurity concerns are becoming increasingly complex and critical. Therefore, effectively detecting and defending against potential network threats, particularly in the face of constantly evolving attack techniques and an expanding attack surface, is crucial for ensuring IoT security.  
Intrusion detection systems (IDS), which are core tools in network security defense, play a critical role in identifying and responding to various network attacks. Traditional IDS methods are generally categorized into signature-based detection and anomaly-based detection. Signature-based IDS rely on predefined attack signatures and rule databases to detect intrusions by matching known patterns [2]. While effective against known threats, this method is limited in its ability to detect novel or variant attacks [3]. Additionally,maintaining and updating the rule sets can be costly and time-consuming. In contrast, anomaly-based IDS establish a baseline of normal network behavior and identify deviations from this baseline as anomalies [4]. However, this approach tends to generate a high false-positive rate in the dynamic and complex IoT environment, and its detection performance significantly deteriorates in the presence of imbalanced data.  
To address these challenges, this paper proposes a semi-supervised intrusion detection algorithm based on a Transformer and a generative adversarial network: TransGAN-IDS. The algorithm is trained using only normal traffic data and is specifically designed to tackle issues such as data imbalance and the detection of unknown attacks. By incorporating the Transformer's self-attention mechanism, the model captures long-range dependencies within traffic sequences, enhancing its ability to effectively identify potential anomalous behaviors [5]. Furthermore, the generator and discriminator in the GAN structure engage in a competitive process, further improving the model's ability to detect subtle anomalies and increasing the precision of traffic generation and discrimination.  
The main contributions of this paper include the following:  
1. Addressing the challenges faced by traditional intrusion detection methods in IoT environments, such as data imbalance and difficulties detecting unknown attacks. By training the model exclusively on normal traffic, the proposed algorithm enhances its robustness in detecting new and previously unseen attacks.
2. Validating the effectiveness of the proposed algorithm through experiments on the CIC-IDS2017 and Kitsune datasets. The results show that the algorithm performs well on both datasets when handling complex network traffic, significantly outperforming traditional methods.