Automated Security Annotation for Business Processes

Summary & Methodology Analysis

The framework operates through a four-stage pipeline designed to translate natural-language requirements into SecBPMN2-compliant XML. Stage 1 utilizes LLMs for security goal extraction, followed by Stage 2, which normalizes BPMN 2.0 XML models into a canonical JSON representation. Stage 3 performs schema-constrained mapping, where the system aligns extracted security goals with specific BPMN elements. The final stage uses rule-based template reconstruction to output the fully annotated model as XML. This architecture leverages LLMs like GPT-4.1-mini and Mistral Small 3.2 to bridge the gap between unstructured text and formal process modeling constraints. By constraining the LLM output via a schema, the framework ensures the final annotations adhere to the required SecBPMN2 standards. The system demonstrated a precision of 0.58 and a recall of 0.52, significantly outperforming human benchmarks of 0.29 precision and 0.50 recall. Despite these gains, the framework has notable limitations that impact production readiness. It currently supports only a partial range of BPMN constructs due to the abstraction introduced during model normalization. Furthermore, the system lacks mechanisms for automatic repair or conflict resolution for annotations. The evaluation was limited to 27 process models, which indicates that further testing is required to verify generalizability across larger or more complex enterprise environments.