Hybrid LLM Framework Automates Security Annotation Generation for BPMN Models

A novel hybrid framework that merges Large Language Models (LLMs) with rule-based normalization and deterministic validation has been developed to automatically create security annotations for Business Process Model and Notation (BPMN) models, in compliance with the SecBPMN2 specification. This framework utilizes a BPMN process model alongside a security requirements document to tackle the challenging, expert-reliant, and error-prone process of extracting precise and comprehensive security annotations from natural language. By combining LLM-driven semantic extraction with schema-constrained mapping and rule-based normalization, the framework was tested on a curated set of 27 process models from diverse domains, consistently yielding structurally sound SecBPMN2 annotations with high schema completeness. The findings are documented in a paper on arXiv (arXiv:2608.14370v1) and aim to enhance the efficiency of modeling and analyzing secure business processes by automating the integration of security annotations.