A Hybrid Petri Net–AI Architecture for Adaptive and Explainable Cybersecurity in Business Workflows

This paper presents a secure digital twin framework that integrates Petri Net process modeling with artificial intelligence–driven anomaly detection to protect cyber-aware business workflows. The approach begins by preprocessing the dataset and extracting more than eighty flow-level features such as timing, packet sizes, and TCP flags. The framework integrates Petri Nets with dual AI detectors using CIC-IDS2021 traffic data. Two complementary detectors, a Long Short- Term Memory Autoencoder and an Isolation Forest, learn normal traffic patterns and generate real-time anomaly scores. These scores dynamically influence the digital twin by controlling Petri Net transition guards and adaptive firing rates, while the overall system behavior is modeled as a continuous-time Markov chain to evaluate long-term risk and cost trade-offs. The proposed AI-integrated digital twin achieved an F1-score of 0.96 and an ROC-AUC of 0.98, outperforming static Petri Nets with an F1-score of 0.76 and ROC-AUC of 0.79 and stand-alone AI with an F1-score of 0.92 and ROC-AUC of 0.96. It reduced mean time to detection to 3.1 seconds and extended mean time to compromise to 11.7 seconds, while Markov chain risk analysis showed the compromise probability falling from 0.43 to below 0.02 with moderate security investment. These results demonstrate that combining explainable Petri Nets with adaptive artificial intelligence analytics creates an economically optimized, interpretable, and resilient cybersecurity strategy for complex business processes and modern Industry 4.0 systems.