Semantics-aware Petri net motifs for multi-stage ICS cyberattack modeling

Industrial control and cyber–physical systems require security mechanisms that are both verifiable by design and analyzable after deployment. This paper introduces a dual-entry Petri net–based methodology that combines design-time modeling via verified secure primitives with post hoc analysis driven by MITRE ATT&CK techniques and CIA-oriented vulnerability motifs. The framework captures adversarial behaviors and defensive mechanisms as composable Petri net fragments, and formalizes CIA impact via violation semantics over reachable markings, enabling both proactive and diagnostic security reasoning. We define canonical constructs for confidentiality, integrity, and availability, providing reusable templates for modeling vulnerabilities and countermeasures. Through illustrative case studies (including secure firmware updates and attack-path analysis in industrial automation scenarios), we show how the proposed framework supports systematic vulnerability discovery, model-based verification, and the development of reusable Secure Primitive Functions for design-time hardening.