Execution Trace Forensics in Low- Code Platforms for Critical Workflows

Abstract

Execution trace forensics in AI-assisted low-code platforms has become critical for ensuring compliance, transparency, and reliability in automated workflow environments. While low-code systems enable rapid software assembly, they introduce complex, multi-layered execution behaviors that obscure traceability and complicate forensic analysis. Existing approaches rely on conventional logging mechanisms, which are insufficient for identifying structural, semantic, temporal, and control-flow anomalies across distributed workflows. This study addresses this gap by proposing a formal forensic framework that models execution traces as state-transition sequences and quantifies deviations using anomaly-specific metrics across workflow stages. The results reveal that execution trace deviations exhibit stage-dependent and multi-dimensional characteristics, with transformation, orchestration, and integration layers acting as primary sources of instability. A heatmap-based analysis further demonstrates the differential distribution of anomaly types across workflow stages, enabling precise identification of critical deviation points. The proposed framework enhances forensic reconstruction, supports compliance validation, and provides a foundation for developing adaptive and real-time anomaly detection systems in low-code environments.