A Petri Net and LSTM Hybrid Approach for Intrusion Detection Systems in Enterprise Networks

Area of Science:

• Cybersecurity
• Network Security
• Machine Learning

Background:

• Intrusion Detection Systems (IDS) are vital for network security.
• Machine Learning (ML) enhances IDS effectiveness but often lacks real-time traffic management.
• Traditional methods struggle with real-time application and immediate threat mitigation.

Purpose of the Study:

• To propose a novel hybrid approach for real-time identification and discarding of malicious network traffic.
• To combine Long Short-Term Memory (LSTM) networks with Petri Nets (PN) for enhanced IDS functionality.
• To develop an adaptable solution for virtual environments and Cyber-Physical Systems (CPS).

Main Methods:

• A Long Short-Term Memory (LSTM) supervised artificial neural network model processes consecutive packet groups.
• A Petri Net (PN) models the IDS architecture, controlling packet flow based on LSTM output.
• The hybrid LSTM-Petri Net model was trained and validated using the IDS 2018 dataset.

Main Results:

• The hybrid LSTM-Petri Net approach achieved a 99.71% detection accuracy.
• This represents a significant improvement over traditional LSTM-only methods, which averaged 97% accuracy.
• The system demonstrated real-time adaptability and effective threat detection capabilities.

Conclusions:

• The novel LSTM-Petri Net approach offers enhanced threat detection with improved accuracy and real-time adaptability.
• This hybrid model integrates machine learning with formal network modeling for advanced network security.
• The IDS/IPS is presented as a form of "virtual sensing technology" for modern cybersecurity needs.