🤖 AI Summary
This study addresses the challenge of identifying security weaknesses during the requirements and design phases prior to implementation by proposing a threat modeling framework based on multi-agent large language models. The framework parses system architecture diagrams to generate attack trees, analyzes trust boundaries and data flows, and recommends mitigation strategies. Its core innovation lies in eliminating reliance on conventional CWE retrieval; instead, it employs misuse cases to correlate components and attack paths while introducing an iterative validation loop to enhance traceability and practical applicability. Experimental evaluations conducted on Microsoft reference scenarios and open systems demonstrate that the proposed approach significantly outperforms existing baselines in review quality, effectiveness, and attack tree construction.
📝 Abstract
Design-level security weaknesses can arise from requirements, trust assumptions, missing controls, and data flows before implementation begins. Existing security practices often identify these issues after code is written. We present a multi-agent LLM framework for design-time security analysis from product requirement documents and architecture diagrams. The proposed framework parses architecture diagrams into graph representations, generates misuse and failure cases, constructs attack trees, checks governance and compliance gaps, recommends mitigations, assigns enterprise security-domain tags, and produces a candidate revised architecture recommendation for expert review. The framework does not retrieve from Common Weakness Enumeration (CWE) databases at inference time. Instead, it analyzes system behavior, trust boundaries, component interactions, and data-flow assumptions. Misuse cases act as intermediate representations that link findings to system components and attack paths, while a validation and refinement loop filters unsupported findings and improves grounding, traceability, and actionability. We evaluate the framework on a Microsoft reference-labeled threat-modeling example, labeled synthetic PRD--architecture pairs, and two open-ended systems: Berty and Gas Town. The reference-labeled case supports threat-recovery and actionability analysis, while the open-ended cases evaluate validity, noise, traceability, actionability, redundancy, and attack-tree quality. Results show that architecture-informed, misuse-driven reasoning improves review quality compared with single-shot and ablation baselines. Keywords: LLM Multi-Agent Systems, Design-Time Security, Threat Modeling, Vulnerability Discovery, Architecture Diagrams, Security Analysis, Misuse Case Derivation, Attack Trees, Iterative Reasoning, Security Governance.