A hybrid framework that takes a BPMN process model and a security requirements document as input and automatically generates security annotations adhering to the SecBPMN2 specification is presented, providing a scalable foundation for security-by-design BPM.
Abstract
The modelling and analysis of secure business processes require the incorporation of security annotations into process models. Although BPMN extensions, including SecBPMN2, exist for this purpose, the derivation of accurate and complete security annotations from natural-language specifications remains a manual, expert-intensive, and error-prone task. This paper presents a hybrid framework that takes a BPMN process model and a security requirements document as input and automatically generates security annotations adhering to the SecBPMN2 specification. The approach combines Large Language Model (LLM)--based semantic extraction with schema-constrained mapping, rule-based normalization, and deterministic validation. The framework is evaluated comprehensively on a curated dataset of 27 process models from various domains. The results indicate that it consistently produces structurally valid SecBPMN2 annotations with high schema completeness. Compared to human security analysts, the system achieves substantially higher precision (0.58 vs. 0.29) while maintaining comparable recall (0.52 vs. 0.50) and reduces erroneous or misplaced annotations by nearly 50%. In addition, annotation generation is significantly faster than manual annotation. These findings demonstrate that hybrid LLM- and rule-based automation can reduce modeling effort while improving consistency and reliability, thereby providing a scalable foundation for security-by-design BPM.
The NIS-2 Directive increases the need for continuous, auditable compliance evidence and motivates a shift from document-based compliance toward machine-readable compliance artifacts. The Open Security Controls Assessment Language (OSCAL) is a standard for this purpose, which the German Federal Office for Information Security (BSI) is adapting with Grundschutz++. However, companies are still managing extensive legacy IT security concepts (IT-SCs), and migrating them without verification could transfer outdated assets into the new format. While existing research primarily addresses the generation of new concepts, there is a lack of a verification framework that extracts legacy IT-SCs into an auditable intermediate representation, deterministically compares the extracted graph with an independently constructed reference state, and exports schemavalid OSCAL artifacts. This paper introduces the Automated Security Concept Structure Extraction and Reverse Topologychecking (ASSERT) Framework, which addresses this gap by using ontology-based extraction of legacy documents into formal document graphs, a five-class graph difference against a verified reference graph, and the export into schema-valid OSCAL outputs for system description and assessment evidence. Using the BSI's RecPlast dataset, we compare a local open-weight model and a commercial model across three configurations with different levels of reference-ontology exposure. The evaluation shows that ASSERT makes document-infrastructure inconsistencies measurable, but reveals a trade-off between discovering undocumented entities and enforcing a schema.
Lea R. Muth, Marian Margraf· International Conference on...· 0 citations
A lifecycle model for LLM systems is proposed that supports security analysis by structuring it around security-relevant boundaries rather than workflow optimisation, and is supported by a 12-stage LLMOps pillar and a 9-category governance pillar.
Eleftherios Batzolis, George Drosatos, V. Katsouros et al.· 0 citations
This paper proposes an automated approach to extract domain models from source code using lightweight, locally deployable LLMs and achieves high F1-scores on a dataset of ten projects, each comprising a curated domain model and its corresponding implementation, while remaining fully executable on locally deployable LLMs.
Alessandra Mancas, Mounir Ammam, Hyacinth Ali et al.· 0 citations
Can large language models participate in the production and validation of ERTMS/ETCS data without undermining the certification arguments required by CENELEC EN 50128/50716? ERTMS/ETCS is a distributed safety-critical system (trackside, onboard, radio-block centre) whose behaviour is parameterised by large volumes of data drawn from the UNISIG Subsets; errors in that data propagate through the distributed architecture. This paper reports the current status of an ongoing industrial research effort at CLEARSY, ValidAItion, that bridges the ERTMS Operational Simulator to the CLEARSY Data Solver and applies rules expressed in the B mathematical language to that trackside data. During construction, a large language model (Claude) has authored the rule corpus and the parsers through a Model Context Protocol server; every proposal is adjudicated by the downstream toolchain and by systematic human review, and the toolchain has already rejected a syntactically valid but semantically illegal generated scenario. The contribution is architectural and industrial, not algorithmic: the work combines frameworks already in use at CLEARSY (CLEARSY Data Solver, ERTMS Operational Simulator) with a conversational authoring loop, rather than proposing a new formal method. It is a progress report: rule coverage is growing, the human-review campaign is underway, and the quantitative results will be published separately. The paper argues, on the evidence gathered so far, that formal rules in the mathematical language of B must remain the source of truth, while the language model serves as the fenced assistant in a distributed safety-critical railway system: AI proposes, the formal oracle disposes, the human confirms.
The paper addresses the use of large language models (LLMs) to automatically generate executable business processes in BPMN 2.0 from unstructured natural-language descriptions, with deployment to process engines such as Camunda Platform in mind. The text-to-BPMN XML mapping task is stated and decomposed into subproblems: extracting activities, events, and gateways; recovering control flow and branching; ensuring valid sequence flows and conformance to the BPMN specification. We survey process representations (BPMN XML, JSON as an intermediate format, graph-based models) and LLM adaptation methods: prompt engineering, instruction tuning, and fine-tuning. We argue that edge (sequence flow) generation is the weakest link once nodes are fixed, and summarize typical structural failure modes (dangling nodes, disconnects, gateway violations, etc.) and causes tied to autoregressive generation. A staged pipeline is proposed—separate generation of node set V and edge set E followed by post-validation — together with a three-level validation scheme: syntactic (BPMN XSD), structural (graph invariants), and executable (Camunda deploy and run). The article outlines a feedback-enabled pipeline architecture and discusses applicability and limitations.
Gennady G. Bulgakov, S. Yarushev· SOFT MEASUREMENTS AND COMPUT...· 0 citations
Domain-specific information systems often maintain their data model, rule base, and application infrastructure as separate artifacts, complicating maintenance and pre-deployment verification. This study investigates whether these artifacts can be unified in a verifiable ontology-to-code pipeline without changing the expected classifications. The proposed Model-Driven Architecture uses the Business Application Builder framework and a Web Ontology Language 2 Description Logic ontology to represent domain structure, classification rules, and generation metadata. HermiT verifies consistency, satisfiability, and subsumption under open-world semantics before code generation. The generator produces persistence, business-logic, data-transfer, and presentation layers, while the generated Java application evaluates stored records under closed-world semantics and resolves overlapping categories using ontology-declared priorities. In a Serbian research-evaluation case study, the generated system reproduced the M30 and M33 classifications of an established Jess implementation. An internal secondary experiment generated and executed a prenatal-diagnosis application; all six runtime classifications matched the HermiT entailments and expected outcomes. The public artifact independently reproduces the ontology-level experiments but excludes the proprietary generator and generated source code. The results support the feasibility of ontology-driven generation for static-classification systems, whereas arithmetic risk computation and temporal event processing remain better suited to complementary procedural technologies. No performance superiority is claimed.
Borivoj Bogdanović, S. Nikolić· Computers· 0 citations
