## 2 Related Work  
In the pursuit of comprehending the originality and substantive contributions of our endeavor, this section undertakes an exploration of established methodologies and techniques within the realm of classical business security. The distinctiveness and efficacy of our proposed work are subsequently illuminated through a comparative analysis against these extant paradigms. The application of static analysis and unit testing represents a partial mitigation strategy against security vulnerabilities that may manifest during the runtime of a business system. [PERSON] et al. [12] and [PERSON] et al. [13] proposed automated black-box testing and deep learning-based testing to solve security issues. However, the effective and concise testing is the main challenge for this solution. The lack of a test oracle, the time taken, the level of code coverage, the lack of source code and other factors severely limit the effectiveness of testing [14]. [PERSON] et al. [17], [PERSON] et al. [16] and [PERSON] et al. [15] created tools to detect programming errors. These tools match programs against known error patterns, and the quality of the error database affects the effectiveness of them. Developers will not readily accept tool reports due to their concerns on the tools' capabilities, the correctness of the suggested fixes, and the exploitability of the reported issues [23]. Authorization and authentication are the most mentioned security mechanisms [4]. Following the conceptual models of applications and applying the principle of least privilege, authorization and authentication mechanisms such as OAuth 2.0 [22], OpenID Connect [21], firewalls [20], and JWT [19] are designed to specify valid accesses. This increases the complexity of implementing security in each microservice, generating a complexity both in the development and in the increase in the attack surface, since individual attention must be given to each microservice [18]. It is crucial to underscore that these mechanisms, notwithstanding their sophistication, exhibit limitations in their capacity to utilize business semantic rules during the execution of business processes. Business application systems are characterized by the existence of sensitive information whose violation of security leads to endangering business interests. To approach the security of electronic business in a systematic way, [PERSON] et al. [24] and [PERSON] et al. [25] developed a methodology for implementing security in a distributed business environment. The authors aimed to propose a methodology to be used by persons who are not from information and communication technology backgrounds. Their concern was the security development of distributed business systems and the identification of security requirements, but they failed to propose a practical business security framework. In order to solve issues of data leakage and unauthorized data manipulation, [PERSON] et al. [26] designed a secure cryptography-based mechanism to protect against malicious attacks. [PERSON] et al. [27] proffered an innovative solution in the form of a microservice security agent. By integrating this agent with API gateway technology, a secure authentication mechanism was proffered. However, it cannot use business semantics as controls and has low extensibility. [PERSON] et al. [28], in an analogous vein, leveraged the Spring Security Framework and OAuth2 to fortify microservice APIs underpinned by the Spring framework. However, its protective ambit predominantly addressed CSRF, XSS, and Brute Force attacks, only underscoring a partial coverage. A number of emerging technologies are also increasingly being applied to business security. Blockchain is primarily used as a tamper-proof, secure, and permanent record of the business [29]. [PERSON] et al. [30] proposed blockchain-based technology to prevent business data tampering. [PERSON] et al. [31] indicated a hardware security module, with fewer privileges, no shared memory access, secure languages, and SGX technology with enclaves to prevent data leakage.