LATIDIA · Ciberseguridad

De los requisitos a los árboles de ataque: agentes de LLM en tierra para la revisión de seguridad a tiempo de diseño

arXiv: 2610.03820v1Tipo de anuncio: nuevo Resumen: Las debilidades de seguridad a nivel de diseño pueden surgir de requisitos, suposiciones de confianza, controles faltantes y flujos de datos antes de que comience la implementación. Prácticas de seguridad existentes

La noticia

arXiv:2610.03820v1 Announce Type: new Abstract: Design-level security weaknesses can arise from requirements, trust assumptions, missing controls, and data flows before implementation begins. Existing security practices often identify these issues after code is written. We present a multi-agent LLM framework for design-time security analysis from product requirement documents and architecture diagrams. The proposed framework parses architecture diagrams into graph representations, generates misuse and failure cases, constructs attack trees, checks governance and compliance gaps, recommends mitigations, assigns enterprise security-domain tags, and produces a candidate revised architecture recommendation for expert review. The framework does not retrieve from Common Weakness Enumeration (CWE) databases at inference time. Instead, it analyzes system behavior, trust boundaries, component