## 3 Modeling and Dataset Building  
### Traffic GAN Model  
In information security, attackers can bypass security systems and obtain legitimate identities through methods such as system vulnerabilities and backdoors to maliciously alter data. Therefore, it is essential to develop a method that treats the entire system as a black box, where it is possible to determine if the system has been attacked by analyzing the input and output data from the traffic control system. This method should be able to identify the locations of attacks within the system and restore any abnormal data. Utilizing Generative Adversarial Network (GAN) models can facilitate the learning of relationships between control signal data and current detection data for anomaly detection and data restoration, as illustrated in Figure 2.  
We combined traffic detection and traffic control data. Traffic detection data refers to the basic traffic parameters collected by traffic detection devices during normal operation, including the volume of traffic flow, roadway occupancy rate, queue length, travel speed, and vehicle spacing. Traffic control data consists of the commands used by signal control devices to adjust vehicle movement during normal operation, including signal cycles, green light duration, and phase differences. These two sets of data have a temporal and spatial correlation, and the size of the dataset is related to the physical boundaries of the selected road network. The signal control data is calculated by the control algorithm according to the current traffic condition, so there is a certain relationship between the control signal data and the current detection data. Therefore, it is possible to select associated data as training samples to train the GAN model. This approach has several advantages:  
Data Completion: If certain data in the system (such as detectors or control signals) are abnormal, we can restore them using the trained generator in the GAN model.  
Data Prediction: Given that traffic flow exhibits spatiotemporal correlations, the GAN model can also be employed for data prediction.  
Anomaly Detection: If certain data in the system (including detection data, control signals, and system time) becomes abnormal due to equipment failure or malicious attacks, we can identify these issues using the trained discriminator in the GAN model.  
The existing sample data is \(x\) and the generated sample data is \(G(z)\), with the generation model being G and the discriminative model being D. The objective function of the GAN is as shown in Equation (26):  
\[\underset{G}{\text{min}}_{D}\chi\bigg{\{}\underset{x\sim P_{z}}{E}[\log(D(x) )]+\underset{z\sim P_{z}}{E}[\log(1-D(G(z)))]\bigg{\}} \tag{26}\]  
The optimization process of the GAN algorithm is a minimax game involving two neural networks: the discriminator and the generator. When training the discriminator, the first term indicates that a higher output is better when the input is real, while the second term suggests that a lower output is preferable when the input is fake. In contrast, when training the generator, the second term signifies that the generator aims to maximize the output of the discriminator. To achieve victory, these two participants in the game must continually enhance their generative and discriminative capabilities until they reach a state of Nash equilibrium.