{"id":51012268,"url":"https://github.com/adamburkegh/iot-cyber-pm","last_synced_at":"2026-06-21T04:31:12.104Z","repository":{"id":358580462,"uuid":"1239552890","full_name":"adamburkegh/iot-cyber-pm","owner":"adamburkegh","description":"Cyber attack detection with process mining and machine learning","archived":false,"fork":false,"pushed_at":"2026-05-18T02:45:32.000Z","size":239,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-05-18T04:50:11.602Z","etag":null,"topics":["cyber-security","machine-learning","process-mining"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/adamburkegh.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-05-15T07:48:17.000Z","updated_at":"2026-05-18T02:45:36.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/adamburkegh/iot-cyber-pm","commit_stats":null,"previous_names":["adamburkegh/iot-cyber-pm"],"tags_count":1,"template":false,"template_full_name":null,"purl":"pkg:github/adamburkegh/iot-cyber-pm","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/adamburkegh%2Fiot-cyber-pm","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/adamburkegh%2Fiot-cyber-pm/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/adamburkegh%2Fiot-cyber-pm/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/adamburkegh%2Fiot-cyber-pm/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/adamburkegh","download_url":"https://codeload.github.com/adamburkegh/iot-cyber-pm/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/adamburkegh%2Fiot-cyber-pm/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":34594326,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-06-21T02:00:05.568Z","response_time":54,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cyber-security","machine-learning","process-mining"],"created_at":"2026-06-21T04:31:08.437Z","updated_at":"2026-06-21T04:31:12.096Z","avatar_url":"https://github.com/adamburkegh.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"## Cyber Attack Detection with Process Mining and Machine Learning\n\nThis project demonstrates a research idea: process mining to learn what normal IoT traffic looks like, then create an ML classifier based on PM-informed features. It uses Zeek logs from the [IoT-23 dataset](https://www.stratosphereips.org/datasets-iot23) for this training. It accompanies the paper:\n\nBurke, A.T, Ashraf, M., Kadirov, M., Janusz, A (2026). *IoT Threat Detection using Process Conformance and ML Classification*, ASPAI 2026 (forthcoming). \n\n\nPipeline and experiment design:\n\u003cimg width=\"5392\" height=\"1326\" alt=\"IoT IDS pipeline\" src=\"experiment.png\" /\u003e\n\nResults from the ASPAI 2026 paper are those in [results/20260408](results/20260408).\n\nZeek logs are first split by scenario type. Benign captures train the\n**process mining** module, which discovers a reference process model\nand uses it to compute conformance metrics for the malicious captures.\nThose metrics are joined back to the original network features and\npassed to the **machine learning** module, which prepares the data,\ntrains a classifier (Random Forest by default; any scikit-learn\nestimator works), evaluates it under **Leave-One-File-Out (LOFO)**, and\nreports per-fold metrics.\n\nThe LOFO protocol matters: a random train/test split on IoT-23 leaks\ndata between train and test (rows from the same session sit on both\nsides) and inflates accuracy. LOFO holds out one whole capture file at\na time, so the numbers reflect performance on network scenarios the\nmodel has never seen.\n\n---\n\n## Table of Contents\n\n- [Installation and Running](#instructions)\n- [Structure](#structure)\n- [Citation](#citation)\n\n\n---\n\n## Installation and Running\n\n### 1. Requirements\n\n- Python 3.14\n- Download IoT-23 dataset from the official\n[Stratosphere Laboratory dataset page](https://www.stratosphereips.org/datasets-iot23).\n- Optional: [Graphviz](https://graphviz.org/download/) on `PATH` to\nrender the Petri net as an image. The pipeline runs fine without it.\n\n### 2. Install\n\n```bash\ngit clone https://github.com/adamburkegh/iot-cyber-pm-lab.git\ncd iot-cyber-pm-lab/iot_ids\npython -m venv .venv\n# Windows PowerShell:\n.\\.venv\\Scripts\\Activate.ps1\n# macOS / Linux:\nsource .venv/bin/activate\n\npip install -r requirements.txt\n```\n\nPython dependencies available in (requirements.txt).\n\n### 3. Get the data\n\nThe Stratosphere Laboratory dataset page offers a full distribution dataset (21 GB, includes raw `.pcap` files)\nand a lighter version (8.7 GB, labeled Zeek flows only); the lighter\nversion is sufficient for this pipeline.\n\nSort the Zeek `*.log.labeled` capture files into two folders by\nscenario type:\n\n```\ndataset/\n├── benign/      # IoT-23 benign-only scenarios (3 files)\n└── malicious/   # IoT-23 malicious scenarios\n```\n\n### 4. Run\n\n```\npython -m iot_ids.run\n```\n\nWhat happens:\n\n- A timestamped folder `var/\u003cYYYYMMDD_HHMMSS\u003e/` is created with the\ndiscovered Petri net (`labelled petri_net.lpn`,\n`stochastic_petri_net.slpn`, and `petri_net.png` if Graphviz is\ninstalled).\n- Per-fold accuracy / precision / recall / F1 and aggregated feature\nimportance are printed to the console.\n\n### 5. Tweak common settings\n\nEverything users typically want to change is in\n[`iot_ids/run.py`](iot_ids/run.py).\n\n\n---\n\n\n## Structure\n\n```\n/\n├── iot_ids/                # Python code\n│   └── run.py              # Entry point\n├── dataset/                # Drop IoT-23 .log.labeled files here\n├── results/                # Shared experimental results and models\n└── var/                    # Output folder populated at runtime\n```\n\n\n---\n\n## Citation\n\nIf this code or its results help your research, please cite the accompanying ASPAI 2026 paper *\"IoT Threat Detection using Process Conformance and ML Classification\".*\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fadamburkegh%2Fiot-cyber-pm","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fadamburkegh%2Fiot-cyber-pm","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fadamburkegh%2Fiot-cyber-pm/lists"}