用大模型从流程文档中自动发现业务逻辑漏洞。
LLM-based Vulnerability Discovery in Business Process Documentation
- 用大模型解析自然语言文档，提取操作序列与决策逻辑。
- 在短语级错误检测与完整流程结构还原上表现良好。
- 适合需要保障流程合规与质量的企业用户。
与软硬件一样，业务流程也易存在漏洞，可能导致产品质量问题、延误和成本上升。这些漏洞可能源于冲突需求、文档模糊、无效度量规范、遗漏质量检查或实际执行与规范不符。MIRABELLE 是一个系统，能从 ISO 9000/9001 文档、用户手册、工作指令和流程执行日志等业务流程资料中识别并表征业务逻辑（BL）漏洞。该系统利用 AI/ML 技术处理文档，生成可被图分析与形式逻辑方法处理的带属性图表示。然而，从以自然语言为主的文档中提取业务逻辑（如操作执行序列、决策点、输入输出资源）极具挑战，因需领域知识、流程复杂性及信息量庞大。本文聚焦于大语言模型（LLMs）在 MIRABELLE 中的作用，报告了多种 LLM 在漏洞检测关键阶段的表现，包括短语中的语法与技术错误标记，以及完整流程结构的恢复与提取。
原文摘要 · Abstract (English)
Just like software and hardware, business processes are susceptible to vulnerabilities that can lead to product quality issues, delays, and increased costs. Business process vulnerabilities can arise from a variety of sources, including conflicting requirements, ambiguous documentation, invalid measurement spec-ifications, omission of quality checks, or implementations that differ from speci-fications. MIRABELLE is a system that identifies and characterizes business logic (BL) vulnerabilities from available business process representations, in-cluding ISO 9000/9001 documentation, user guides, work instructions, and pro-cess execution logs. MIRABELLE leverages recent advances in AI/ML to pro-cess available business process documentation and generate attributed graph rep-resentations of the business logic that can be processed using both graph and for-mal logic approaches for identifying potential vulnerabilities. However, extract-ing the business logic (e.g., operation execution sequences, decisions, input/out-put resources) from mostly natural language artifacts is challenging due to the required domain expertise, inherent process complexity, and the sometimes very large volumes of information. This paper focuses on our experimentation with Large Language Models (LLMs) and their role within MIRABELLE. We report on the performance of several LLMs across vital stages of vulnerability detection, from grammatical and technical error-flagging in short phrasings, to complete process structure recovery and extraction.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。