# An Adaptive Security Framework for Internet of Things Networks Leveraging SDN and Machine Learning
## 4 Secure IoT Communication and Attack Mitigation
### Modeling IoT Attacks and Defenses
#### 4.3.1 Petri Nets for Modeling IoT Attacks  
Petri nets provide a graphical and mathematical modeling framework well-suited for analyzing distributed, concurrent systems like the IoT. Petri nets consist of places, transitions, and directed arcs connecting them. Places represent possible states, transitions depict actions or events, and tokens in places denote the current state. Petri net models capture the dynamic and distributed interactions between IoT components under normal conditions and attacks [28].  
Petri nets have been applied to model various IoT attacks, including denial-of-service, man-in-the-middle, and malicious code injection [1]. For instance, [26] used stochastic Petri nets to model a code injection attack against an IoT middleware platform. The attack stages were represented by transitions and the system's vulnerable states as places. Probabilistic reasoning on the Petri net evaluated attack impacts and defense strategies. We utilize Petri nets to model the neighbor solicitation (NS) flooding attack in IPv6 networks. The NS flooding attack exploits the NDP, which relies on NS and neighbor advertisement (NA) messages to map IP addresses and MAC addresses. Table 9 describes the places and transitions in the NS flooding Petri net.  
The attacker sends high volumes of NS messages with spoofed source IP addresses to overwhelm the target nodes. The Petri net model for the NS flooding attack is shown in Figure 3. The places correspond to the node states during an attack. P0 is the normal state. In P1, the attacker has obtained the victim's IP address through sniffing. P2 represents the state where spoofed NS messages have been generated. Flooding occurs in P3 as the victim is inundated with requests. P4 represents the failed state as the attack prevents legitimate traffic. The transitions model the stages of the attack. T0 initiates the attack, T1 sniffs the victim's address, T2 generates spoofed messages, and T3 floods the victim. Tokens denote the current state, marking the progress of the attack [9].  
Figure 3: Petri net model for NS flooding attack in IoT networks.  
\begin{table}
\begin{tabular}{c c} \hline \hline
**Place** & **Description** \\ \hline
**P0** & Normal state \\ \hline
**P1** & Attacker has victim’s IP address \\ \hline
**P2** & Spoofed NS messages generated \\ \hline
**P3** & Flooding with NS messages \\ \hline
**P4** & Attack disrupts legitimate traffic \\ \hline
**Transition** & **Description** \\ \hline
**T0** & Attack initiated \\ \hline
**T1** & Sniffing victim’s IP address \\ \hline
**T2** & Generating spoofed NS messages \\ \hline
**T3** & Flooding victim with NS messages \\ \hline \hline \end{tabular}
\end{table}
Table 9: Description of places and transitions in the NS flooding Petri net.  
This Petri net analysis precisely captures the attack sequence. The token movements reveal vulnerabilities and suggest countermeasures such as encrypting NDP traffic or detecting address spoofing. Extensions could include stochastic transitions to model the uncertainty and defense mechanisms as additional places and transitions.