A Hybrid LLM-Based Framework for Automated Security Annotation Generation in Business Process Models

Md Kamrul Islam; Tiphaine Henry; Mattia Salnitri; Julius Köpke; Sami Souihi

Source-linked AI summary

A Hybrid LLM-Based Framework for Automated Security Annotation Generation in Business Process Models

Md Kamrul Islam, Tiphaine Henry, Mattia Salnitri, Julius Köpke, Sami Souihi

arXiv:2608.14370v1Aug 14, 2026cs.CRcs.AIcs.SE

TL;DR

Manual derivation of security annotations from natural-language requirements is expert-intensive and inconsistent, limiting practical adoption of security-aware BPMN extensions. This paper presents a hybrid LLM- and rule-based pipeline that automatically generates SecBPMN2 annotations and, across 27 curated text–model pairs, achieves higher precision than human annotators with comparable recall and less manual effort.

Problem
Security annotations are typically derived manually from natural-language descriptions, requiring specialized expertise, causing inconsistency, and scaling poorly in complex regulatory contexts.
Method
A hybrid pipeline combines LLM-based semantic extraction and schema-constrained mapping with rule-based normalization, validation, and SecBPMN2 model reconstruction.
Results
Across 27 curated text–model pairs, the pipeline consistently produces SecBPMN2-compliant annotations with higher precision than human annotators, comparable recall, and substantially less manual effort.
Takeaways & Limitations
Hybrid LLM- and rule-based automation reduces manual effort, improves consistency, and supports systematic operationalization of SecBPMN2 annotations.
Takeaways & Limitations
The evaluation uses only 27 curated expert-annotated process models, and partial BPMN construct support may limit generalizability.

Abstract

from arXiv · show

The modelling and analysis of secure business processes require the incorporation of security annotations into process models. Although BPMN extensions, including SecBPMN2, exist for this purpose, the derivation of accurate and complete security annotations from natural-language specifications remains a manual, expert-intensive, and error-prone task. This paper presents a hybrid framework that takes a BPMN process model and a security requirements document as input and automatically generates security annotations adhering to the SecBPMN2 specification. The approach combines Large Language Model (LLM)--based semantic extraction with schema-constrained mapping, rule-based normalization, and deterministic validation. The framework is evaluated comprehensively on a curated dataset of 27 process models from various domains. The results indicate that it consistently produces structurally valid SecBPMN2 annotations with high schema completeness. Compared to human security analysts, the system achieves substantially higher precision (0.58 vs. 0.29) while maintaining comparable recall (0.52 vs. 0.50) and reduces erroneous or misplaced annotations by nearly 50%. In addition, annotation generation is significantly faster than manual annotation. These findings demonstrate that hybrid LLM- and rule-based automation can reduce modeling effort while improving consistency and reliability, thereby providing a scalable foundation for security-by-design BPM.

1 Introduction

BPMN lacks native support for expressing security requirements, while SecBPMN2’s rich semantics and attachment rules make manual modeling and LLM-based generation challenging. The paper addresses this problem with a hybrid pipeline, benchmark dataset, and empirical evaluation to reduce effort and improve consistency.

Motivation: BPMN lacks native support for expressing security requirements, a growing problem in regulated and data-sensitive environments.Security extensions such as SecureBPMN, SecBPMN, and PE-BPMN add explicit process-level annotations but have seen limited practical adoption.
Motivation: SecBPMN2 provides semantically grounded security vocabulary and precisely defined attachment rules, but its rich semantics challenge human modelers and LLM-based text-to-model generation.Security requirements are often implicit, context-dependent, and linguistically heterogeneous.
Contributions: The paper proposes a hybrid pipeline coupling LLM-based extraction and mapping with rule-based normalization and validation for generating SecBPMN2 annotations from natural-language descriptions.The stated research question concerns automatically annotating BPMN models with SecBPMN2-compliant security annotations based on textual descriptions.
Contributions: The paper introduces a benchmark dataset aligning textual process descriptions with expert-designed SecBPMN2 ground-truth models and evaluates the approach across multiple LLMs and prompting…These contributions support systematic evaluation of automated security annotation generation.
Contributions: The contributions aim to reduce manual effort, improve consistency, and enable systematic operationalization of SecBPMN2 annotations.The paper presents these outcomes as advances in LLM-based support for security-aware process modeling.

2 Related Work

Related work spans security-aware BPMN extensions, automated BPMN generation from text, and structured security-requirement extraction, differing in input, automation, semantics, BPMN integration, and constraint enforcement. Existing approaches do not combine all five capabilities in one framework.

Overview: The research landscape is organized around three directions that differ across natural-language input, automation, security semantics, BPMN-artifact integration, and constraint enforcement.These dimensions summarize the comparison of related work.
BPMN security extensions: Security-aware BPMN extensions add constructs for authorization, duty constraints, privacy, data protection, and comprehensive security modeling.SecBPMN2-ml further defines a structured security-goal vocabulary grounded in RMIAS.
Automated BPMN generation from text: Text-to-BPMN research automates model construction through syntactic parsing, rule-based extraction, translation pipelines, iterative prompting, conversational modeling, and direct BPMN XML generation.These methods accept natural-language input but focus on functional structure rather than explicit security semantics.
Structured security-requirement extraction: LLMs can extract entities and relations from natural-language security specifications but struggle to produce complete, semantically consistent formal models under controlled benchmarks.Domain-specific approaches also derive structured requirements from standards such as ISO/IEC 27001, generally yielding textual-level security representations.
Research gap: No existing approach integrates natural-language input, automated generation, SecBPMN2 semantics, BPMN-level integration, and systematic constraint enforcement within one framework.Existing work instead addresses security semantics, automation from text, or structured requirement extraction separately.

3 Motivating Example

The Route-Based Trajectory negotiation process motivates automated security annotation because it involves sensitive, safety-critical information and requires translating implicit natural-language requirements into explicit SecBPMN2 annotations. This example exposes the mismatch between flexible security requirements and schema-constrained annotations tied to specific BPMN elements.

Motivating example: The Route-Based Trajectory negotiation process models iterative exchanges between pilots and air-traffic controllers during flight-trajectory proposal, revision, and approval.A simplified version serves as the paper’s motivating example.
Motivating example: Automated security annotation is especially important for processes involving sensitive or safety-critical information, such as flight-trajectory negotiation.The RBT process provides a representative example of this setting.
Security-annotation challenge: Security requirements use flexible, implicit, context-dependent natural language, whereas SecBPMN2 requires explicit, schema-constrained annotations attached to specific BPMN elements.The RBT example highlights this fundamental challenge in security-aware business-process modeling.

4 Approach

The approach combines semantic extraction from security requirements with normalized BPMN structure, then maps and validates SecBPMN2 annotations through schema-constrained intermediate representations. It assumes valid BPMN 2.0 input within the SecBPMN2-supported subset and preserves traceability between requirements and process models.

Pipeline overview: The four-stage pipeline extracts security goals and normalizes BPMN structure in parallel before combining them through LLM-assisted mapping and validation.Stage 1 is semantic and model-agnostic, while Stage 2 produces a normalized graph-oriented JSON representation for downstream reasoning.
Design principles: Semantic interpretation and structural validation are decoupled, and reversible intermediate representations support traceability from textual requirements to process models.JSON is used because current LLMs can practically comply with schemas, although the serialization format remains an implementation choice.
Schema and notation: The method represents each security annotation as α = (e, g, p), pairing a BPMN element, security goal, and goal-specific parameter set.Annotation suffixes Act, DO, MF, GW, and ORG constrain the permissible BPMN element category.
Stage 1: semantic extraction: Stage 1 extracts candidate goals, target categories, parameter placeholders, and textual anchors without binding annotations to concrete BPMN identifiers.The output is schema-conformant JSON, and examples include accountability, auditability, and integrity annotations for the RBT negotiation process.
Stage 2: structural normalization: Stage 2 converts BPMN 2.0 XML into a canonical, token-efficient JSON model that retains constructs, identifiers, connectivity, and control-flow relations while omitting XML-specific overhead.A linear-time traversal reconstructs explicit gateway branching paths and conditions, while the original XML remains available for visualization and export.
Stage 3: annotation mapping: Stage 3 maps candidate annotations to normalized BPMN elements and constructs a SecBPMN2-JSON model that preserves BPMN structure while adding security constraints and associations.Each candidate becomes α = (e, g, p) by associating it with a BPMN element identifier.

5 Prototype Implementation

The prototype operationalizes the SecBPMN2 automation pipeline within a BPMN modeling environment through a three-layer architecture. It combines LLM-assisted extraction and mapping with deterministic validation and reconstruction, and is publicly available for reproducibility.

Architecture: The prototype extends an open-source BPMN assistant with BPMN modeling and conversational interfaces for supplying process models and security requirements.These interfaces form the user interaction layer of the three-layer architecture.
Pipeline execution: The application services layer executes security annotation extraction, BPMN normalization, schema-constrained mapping, and SecBPMN2-compliant reconstruction.These four stages operationalize the proposed automation pipeline.
Reproducibility: The prototype implementation is publicly available to support reproducibility.Public availability provides access to the implemented SecBPMN2 automation pipeline.

6 Evaluation

The evaluation on 27 paired process-model and security-requirement cases tests structural validity, extraction quality, human comparability, category-level recall, and computational efficiency. The hybrid pipeline consistently produces valid SecBPMN2 annotations, but extraction performance varies with process complexity, retrieval strategy, and security-goal category.

Evaluation Dataset: 27 process models span aviation, healthcare, finance, public services, and hospitality, combining 20 published case studies with 7 industrial examples.Because no public benchmark provided paired artifacts, the authors manually authored one security description per model.
Experimental Design: The evaluation compares prompt-based extraction and RAG with GPT-4.1-mini and Mistral Small 3.2 under identical decoding settings.RAG uses documentation retrieved from a knowledge base covering SecBPMN2, SecBPMN2BC, and STS-ML.
Structural Validity and Extraction Performance: Both models achieve consistently high schema validity across complexity tiers, indicating reliable enforcement of SecBPMN2 structural constraints.Structural validity measures conformance to the meta-model and correctness of annotation attachment.
Structural Validity and Extraction Performance: Extraction performance declines as process complexity increases; GPT-4.1-mini RAG reaches F1 0.73 on simple workflows, whereas prompt-based extraction reaches F1 0.34 versus 0.23 on complex models.On medium-tier processes, the two GPT-4.1-mini strategies perform comparably.
Human Baseline Comparison: Human annotators show mean Jaccard 0.416 and mean Cohen’s κ 0.409, while requiring nine minutes per process on average.Human annotations were independently produced by three experts, and annotation time ranged from approximately two minutes for simple workflows to over twenty minutes for complex models.
Category Analysis: Category-level recall reaches up to 0.79 for CIA-triad objectives, while implicitly expressed authenticity, accountability, and auditability goals have lower recall.The pipeline therefore captures explicit protection-oriented requirements more reliably than assurance- and compliance-oriented annotations.

7 Discussion and Conclusion

The paper concludes that its hybrid LLM- and rule-based pipeline generates structurally valid SecBPMN2 annotations by combining semantic interpretation with schema-constrained validation. Evaluation on 27 curated text–model pairs indicates improved annotation quality and reduced manual effort, while limitations motivate broader datasets, newer models, and improved retrieval and representations.

Contributions: The pipeline combines semantic interpretation of natural-language requirements with rule-based SecBPMN2 schema enforcement to generate structurally valid security-aware BPMN models.Decoupling semantic extraction from schema validation reconciles flexible natural-language specifications with strict security-modeling requirements.
Evaluation: 27 curated text–model pairs show that schema-aware prompting and compatibility-constrained mapping improve annotation quality across models and extraction strategies.The pipeline consistently produces SecBPMN2-compliant annotations, with higher precision than human annotators and comparable recall using substantially less manual effort.
Limitations: Support for the full range of BPMN constructs remains partial because the normalized representation abstracts away certain modeling details.The system can detect and filter structurally inconsistent or non-attachable annotations but does not yet automatically repair or resolve conflicts.
Limitations: The evaluation uses a curated dataset of 27 expert-annotated process models aggregated from the literature, limiting the breadth of validation.The passage indicates that the dataset spans multiple sources but does not provide further scope details in the supplied text.
Future Work: Future work will address accuracy and robustness through larger benchmark datasets, newer foundation models, improved retrieval for complex long-context processes, and alternative graph-based representations.Planned investigations include improving the relevance and utilization of retrieved security knowledge and assessing graph-based encodings’ effects on token efficiency and annotation.