A Petri Net and LSTM Hybrid Approach for Intrusion Detection Systems in Enterprise Networks

View full-text article in PMC

. 2024 Dec 11;24(24):7924. doi: 10.3390/s24247924

Algorithm 1 LSTM and Petri Net Workflow for IDS

1:
Data Preprocessing:
2:
Load dataset
3:
Balance benign and attack packets
4:
Labels mapping (0 for benign, 1 for attack)
5:
Handle missing and infinite values
6:
Standardize features
7:
Remove highly correlated features
8:
Apply PCA to reduce dimensionality
9:
Prepare Data for LSTM:
10:
Convert data to sequences of window size 50
11:
Split data into training, validation, and test sets
12:
LSTM Model Training:
13:
Define LSTM model with layers
14:
Compile model with binary cross-entropy loss and Adam optimizer
15:
Train model with training and validation data
16:
Save trained model
17:
LSTM Model Evaluation:
18:
Evaluate model on test data
19:
Calculate confusion matrix and classification report
20:
Petri Net Definition:
21:
Define places: $p 1, p 2, p 3, b, a, n$
22:
Define transitions: $t 1, t 2, t 3, t 4$
23:
Define arcs:
24:
$t 1$ : $b \to p 1$
25:
$t 2$ : $p 1 \to p 2$ & $p 1 \to p 3$
26:
$t 3$ : $p 2 \to a$ & $p 2 \to b$
27:
$t 4$ : $p 3 \to n$ & $p 3 \to b$
28:
Petri Net Execution:
29:
Initialize Petri Net with test data
30:
for $i = 1$ to 10 do
31:
Fire transition $t 1$ to simulate packet arrival
32:
for $j = 1$ to 50 do
33:
Wait for next packet
34:
Fire transition $t 1$ to simulate packet arrival
35:
end for
36:
Fire transition $t 2$ to predict packet flow using LSTM
37:
if $p 2$ has token and $p 3$ does not then
38:
Fire transition $t 4$ (Benign packet flow)
39:
Store packets in non-blocked list
40:
else
41:
Fire transition $t 3$ (Attack packet flow)
42:
Store packets in blocked list
43:
end if
44:
Move to next set of packets
45:
end for