发表机构
Peraton Labs（佩拉顿实验室）
机构由 AI 辅助整理，请以论文原文为准。AI 中文总结
该研究将LLMs应用于MIRABELLE系统，通过实验测试多种LLMs在业务流程文档漏洞检测各阶段的性能，以实现从业务流程表示中识别业务逻辑漏洞。
AI 中文摘要
与软件和硬件类似，业务流程也易出现漏洞，可能导致产品质量问题、进度延迟和成本增加。业务流程漏洞的产生来源多样，包括需求冲突、文档模糊、无效测量规范、质量检查缺失或与规范不符的实现。MIRABELLE是一个可从现有业务流程表示（包括ISO 9000/9001文档、用户指南、作业指导书和流程执行日志）中识别和表征业务逻辑（BL）漏洞的系统。MIRABELLE利用AI/ML的最新进展处理现有业务流程文档，并生成业务逻辑的属性图表示，该表示可通过图方法和形式逻辑方法处理，以识别潜在漏洞。然而，从主要为自然语言的工件中提取业务逻辑（如操作执行序列、决策、输入/输出资源）颇具挑战性，原因包括所需的领域专业知识、固有的流程复杂性以及有时信息体量极大。本文重点关注我们对大语言模型（LLMs）的实验及其在MIRABELLE中的作用，报告了多个LLMs在漏洞检测关键阶段的性能，从短短语的语法和技术错误标记，到完整流程结构的恢复与提取。
英文摘要
Just like software and hardware, business processes are susceptible to vulnerabilities that can lead to product quality issues, delays, and increased costs. Business process vulnerabilities can arise from a variety of sources, including conflicting requirements, ambiguous documentation, invalid measurement spec-ifications, omission of quality checks, or implementations that differ from speci-fications. MIRABELLE is a system that identifies and characterizes business logic (BL) vulnerabilities from available business process representations, in-cluding ISO 9000/9001 documentation, user guides, work instructions, and pro-cess execution logs. MIRABELLE leverages recent advances in AI/ML to pro-cess available business process documentation and generate attributed graph rep-resentations of the business logic that can be processed using both graph and for-mal logic approaches for identifying potential vulnerabilities. However, extract-ing the business logic (e.g., operation execution sequences, decisions, input/out-put resources) from mostly natural language artifacts is challenging due to the required domain expertise, inherent process complexity, and the sometimes very large volumes of information. This paper focuses on our experimentation with Large Language Models (LLMs) and their role within MIRABELLE. We report on the performance of several LLMs across vital stages of vulnerability detection, from grammatical and technical error-flagging in short phrasings, to complete process structure recovery and extraction.
