用大模型自动给业务流程图加安全标注，又快又准。
A Hybrid LLM-Based Framework for Automated Security Annotation Generation in Business Process Models
- 结合大模型语义提取与规则校验，自动生成符合标准的安全标注。
- 生成结果精度达0.58，比人工高一倍，错误标注减少近50%。
- 适合需要快速、一致地实现安全建模的开发者与企业用户。
构建安全业务流程模型需在流程图中添加安全标注。尽管已有如SecBPMN2等扩展标准，但从自然语言需求文档中准确生成完整标注仍依赖人工，耗时且易错。本文提出一种混合框架，输入BPMN流程图与安全需求文档，自动产出符合SecBPMN2规范的标注。方法融合大语言模型（LLM）语义提取、模式约束映射、规则归一化与确定性验证。在涵盖27个跨领域流程模型的定制数据集上评估显示，系统生成的标注结构合法且模式完备度高。相比人工分析师，系统精度达0.58（人工0.29），召回率相当（0.52 vs. 0.50），错误或错位标注减少近50%，且生成速度显著提升。结果表明，混合式自动化可降低建模负担，提升一致性与可靠性，为安全设计驱动的业务流程建模提供可扩展基础。
原文摘要 · Abstract (English)
The modelling and analysis of secure business processes require the incorporation of security annotations into process models. Although BPMN extensions, including SecBPMN2, exist for this purpose, the derivation of accurate and complete security annotations from natural-language specifications remains a manual, expert-intensive, and error-prone task. This paper presents a hybrid framework that takes a BPMN process model and a security requirements document as input and automatically generates security annotations adhering to the SecBPMN2 specification. The approach combines Large Language Model (LLM)--based semantic extraction with schema-constrained mapping, rule-based normalization, and deterministic validation. The framework is evaluated comprehensively on a curated dataset of 27 process models from various domains. The results indicate that it consistently produces structurally valid SecBPMN2 annotations with high schema completeness. Compared to human security analysts, the system achieves substantially higher precision (0.58 vs. 0.29) while maintaining comparable recall (0.52 vs. 0.50) and reduces erroneous or misplaced annotations by nearly 50%. In addition, annotation generation is significantly faster than manual annotation. These findings demonstrate that hybrid LLM- and rule-based automation can reduce modeling effort while improving consistency and reliability, thereby providing a scalable foundation for security-by-design BPM.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。