exposure identification

To address the insufficient security and scalability of engineering workflow automation and cross-organizational collaboration in Industry 4.0, this paper proposes an engineering workflow management approach integrating Asset Administration Shells (AAS) with BPMN. We innovatively design a distributed, write-on-copy AAS infrastructure to ensure data consistency and access security, and develop a lightweight workflow engine prototype supporting native AAS operations, enabling automatic mapping and execution of BPMN processes onto AAS interactions. This method unifies digital twin representation, asset modeling, and business process logic, thereby significantly enhancing standardization of engineering data exchange, end-to-end process traceability, and multi-stakeholder collaboration efficiency. Experimental evaluation demonstrates the system’s feasibility for secure inter-organizational coordination and its horizontal scalability across heterogeneous industrial environments.

This study addresses the challenge of effectively monitoring early-stage agent systems, where structural flaws often obscure task-level errors. The authors propose a three-dimensional (quality, suitability, efficiency) and three-granularity (intra-run, inter-run, structural) monitoring and triaging framework tailored for low-maturity agent systems. They introduce a novel system maturity staging model based on the coefficient of variation and monitoring granularity, integrated with a severity classification adapted from FMEA to guide human review. The resulting transferable monitoring architecture supports document-driven, multi-stage workflows, enhanced by a synthetic testbed with controlled error injection. Experimental results demonstrate that structural defects significantly mask task-level signals; 97% of issues can be automatically traced, with only 2% requiring human intervention, and each granularity level precisely identifies its corresponding defect type (coefficients of variation: 0.02, 1.25, and 0.00, respectively).

Prior work lacks empirical characterization of problem-solving processes in software development. Method: Integrating grounded theory coding, sequential pattern mining, and multidimensional statistical analysis on 356 Mozilla Firefox issue reports, this study extracts fine-grained, reusable problem-solving process patterns from collaborative textual artifacts. Contribution/Results: We identify 47 empirically grounded process patterns—challenging the traditional linear assumption by revealing pervasive nonlinearity: 73% of fixes involve iterative backtracking or parallel activities. The resulting process landscape and pattern catalog systematically characterize distributional regularities across issue types, defect categories, and repair durations. This advances understanding of real-world engineering complexity and provides an evidence-based foundation for process optimization, collaborative tool design, and developer support.

Business process optimization remains challenging due to fragmented methodologies across process mining, predictive process monitoring, and process-aware recommendation—each operating in isolation without a unified theoretical foundation or integration framework. Method: This paper proposes a closed-loop optimization framework that systematically integrates Alpha algorithm/Inductive Miner for process discovery, LSTM/Transformer for runtime prediction, collaborative filtering/graph neural networks for action recommendation, and explainable AI (XAI) for interpretability—enabling automated bottleneck identification, anomaly forecasting, and prescriptive optimization from event logs. Contribution/Results: We establish the first unified conceptual boundary, evolutionary taxonomy, and synergy paradigm across the three domains; construct a comprehensive classification schema covering 120+ studies; clarify application scopes and standardized evaluation benchmarks; and deliver an industrially actionable methodology selection guide with validated deployment pathways.

Traditional vulnerability remediation metrics, such as Mean Time to Remediate (MTTR) and SLA compliance, often fail to capture the true pace of patch deployment and tend to overestimate actual remediation capability. This work proposes the first audit framework for enterprise vulnerability management that explicitly models remediation cadence by incorporating dimensions such as routine delays, release cycles, deployment coverage, and organizational structure to quantitatively assess how deployment rhythm affects remediation efficacy. The approach integrates a cadence audit model, normalized scenario simulation, geometric deployment analysis, and residual pressure evaluation, introducing novel concepts of “calendar discounting” and “capacity diagnostics.” Experimental results demonstrate that, under an identical 30-day average delay, bi-monthly, monthly, and bi-weekly release cadences consume 17.4%, 5.2%, and 1.3% of theoretical remediation capacity, respectively, revealing significant bias when relying solely on MTTR.

This work addresses the limitations of existing large language models, which are typically confined to isolated tasks and struggle to integrate into industrial-scale, multi-stage security workflows. To bridge this gap, the authors propose the first role-based multi-agent framework tailored to the entire vulnerability lifecycle, incorporating specialized agents—Planner, Analyzer, Fixer, and Verifier—augmented with CodeQL static analysis for enhanced precision. By introducing a role-oriented multi-agent architecture into end-to-end vulnerability management, this approach effectively aligns the capabilities of large models with real-world security engineering demands. Evaluated on 25 real-world C/C++ vulnerabilities, the system achieves a detection accuracy of 44%—comparable to GPT-5.5—and a repair accuracy of 19%, offering a practical and collaborative paradigm for intelligent security operations.

This study addresses the inadequacy of current IT compliance–oriented cybersecurity policies in safeguarding the physical safety of cyber-physical systems, as digital failures often precipitate real-world harm. By coding 292 critical infrastructure policies (2000–2025) and aligning them with the NIST SP 800-160 Vol. 2 resilience lifecycle, the research reveals a significant misalignment between prevailing policy approaches—overreliant on IT control catalogs during resistance and recovery phases—and actual physical risks. The work proposes a modernized “duty of reasonable care” standard centered on hazard-specific traceability, structured assurance cases, and cyber resilience engineering. It identifies three critical disconnects: misaligned delegation of standards, reduction of recovery mechanisms to mere incident reporting, and uneven sectoral adaptability. The study further outlines a viable pathway for federal policy that integrates engineering implementation with targeted incentives.

This work addresses the challenge of costly erroneous repairs in existing automated remediation systems, which often lack the ability to assess intervention necessity and thus rely on manual approval for safety. The authors formulate safe repair as an intervention decision problem under risk constraints and introduce a three-dimensional risk decomposition framework encompassing impact scope, reversibility, and epistemic uncertainty. They further design a context-adaptive human-in-the-loop gating strategy that enables interpretable, workload-aware safety interventions. Built upon constrained Markov decision processes (CMDPs), offline policy learning, Chaos Mesh fault injection, and the RCAEval classification framework, the proposed approach reduces erroneous repair rates by 39% and improves repair success rates by 2.5 percentage points on the Train Ticket benchmark, while decreasing on-call escalation burden by 17% compared to fixed-threshold baselines.