Enterprise information systems manage business objects with persistent control states across transactions and changing organizations, posing a stateful enterprise control problem that requires consistent alignment of object identity, valid state transitions, execution authority, and audit evidence over time. This study establishes design knowledge for such scenarios, focusing on budget commitments. Using design science research, it proposes three technology-independent principles: Commitment Identity Binding, Context-Bound State Transition, and Controlled Execution Boundary and Evidence. These principles are implemented in a three-layer artifact combining a Knowledge Graph (KG), a state-transition module (SAI), and an audit evidence generation module (AIG) for context representation, state control, and structured evidence generation. Evaluated on 18 months of enterprise data, expert cases, ablation tests, historical replay, safety checks, and experiments with 30 practitioners, the artifact yields key findings: state consistency does not guarantee evidential completeness, and accurate rule identification cannot ensure valid transitions without temporal context. Historical Replay successfully replicated all 90 test cases under original contexts. When substantive information was held comparable, structured evidence improved final-state and rule-basis judgments and reduced review time. This work provides integrated design knowledge for stateful enterprise control over persistent business objects.
The best navigable graphs for approximate nearest-neighbor search are built serially: each inserted point searches the partially built graph, and its neighbors are selected from what that search visits — a serial dependency chain in which concurrent insertions contend for shared state and two builds of the same data differ. Graft keeps the search step and removes the mutation: the candidate-producing search needs only some navigable graph, and a much cheaper one suffices. Construction builds a rootstock — a forest of T independently seeded spatial-approximation trees, unioned into a fixed, redundant scaffold — then harvests: every point, in parallel, beam-searches the frozen scaffold with itself as the query, and the expanded vertices are occlusion-pruned into its adjacency list. Both phases are embarrassingly parallel, and the graph is bitwise identical at any thread count. A per-point stopping rule (patience) preserves graph quality across a 10× increase in n where a fixed search budget tuned at the smaller scale does not. The build costs 0.5%–5% of n distance computations per point; in paired repeated-build experiments at 106 points its wall-clock time is at parity with tuned Vamana on SIFT, 1.3–3.2× slower on GloVe, and 4–17× slower than the GEMM-based PiPNN. The return is measured in distance evaluations, the hardware-independent cost: at recall 0.95–0.97, Graft is within 5% of Vamana on SIFT, GloVe, and a 1024-dimensional Wikipedia benchmark (1.12× on GIST, 1.3× on Fashion, 14%–20% behind on GloVe’s 0.985–0.99 tail); 20%–22% ahead of PiPNN on GloVe; 9%–39% ahead of HNSW at 107–108 points. A degree-matched random substrate needs 4.7× more distances per query: the scaffold’s routability is necessary. The construction consumes only distance comparisons and applies unchanged to any metric.
Business process event logs record activities, resources, timestamps, and other process attributes, and therefore provide the basis for trace-level anomaly detection. Existing methods often lack a unified reference for normal behavior and do not explicitly coordinate structural deviations with semantic information. We propose MAGE, a structural-prior-guided graph-enhanced language embedding framework for business process anomaly detection. MAGE first constructs structural priors solely from normal traces in the training set, including normal directly-follows relations, trace-length statistics, and adjacent-event resource-switching statistics. It then compares each trace with these priors to generate structural deviation signals and constructs both an activity-resource-time-slice heterogeneous graph and a structure-aware textual representation. A heterogeneous graph Transformer extracts structural representations, while a LoRA-adapted Qwen3 model extracts semantic representations. Gated cross-attention fuses the two modalities for trace-level anomaly classification. The structural prior and graph self-supervised pretraining use only normal training traces, whereas the final multimodal classifier is jointly optimized on labeled training samples. Experiments on synthetic logs and public real event logs with controlled anomaly injection show that MAGE achieves the highest mean F1-scores of 0.872 and 0.860, respectively, among the compared methods under the evaluated settings. Ablation results further indicate that the structural prior, heterogeneous graph encoding, structure-aware prompting, and cross-modal fusion each contribute positively to F1-score under the evaluated settings. Together, these findings provide evidence for combining normal-process structural constraints with language-based semantic information in trace-level business process anomaly detection.
Graph anomaly detection is a critical task in graph data mining, focused on uncovering abnormal patterns within complex networks. Recently, graph neural networks (GNNs) have exhibited expressive capability in graph representation learning, and graph anomaly detection with GNNs on attributed graphs has attracted increasing attention. However, existing GNN-based methods often suffer from over-smoothing, where multi-layer convolution operations lead to indistinguishable node representations, ultimately degrading anomaly detection performance. Furthermore, many existing approaches fail to capture the nuanced distinctions in both graph structure and node attributes, resulting in suboptimal results. To tackle these issues, we propose a community-aware graph anomaly detection method, termed CaGAD, which integrates a community-aware structural encoder with an attribute encoder to extract complementary features from both topology and node attributes. This structural encoder captures both local and community-level node information. The learned structural features are then integrated into the attribute encoder via a layer-wise fusion mechanism. This design enables effective cross-modal interaction and mitigates over-smoothing by preserving feature diversity across layers. Finally, anomalies are identified by reconstructing the attributed graph from the fused representations and analyzing the reconstruction errors. Extensive experiments on six real-world datasets demonstrate that CaGAD outperforms state-of-the-art methods in terms of detection accuracy.
