Events The 1st International Online Conference on Technologies

Event submissions

Published

This submission belongs to the session S1. Information and Communication Technologies of the event The 1st International Online Conference on Technologies

Published date

06 Nov, 2026

Academic Editor

Achilles D. Boursianis

Citation

Jeremiah Oluwagbemi Abimbola, Zero-Shot Cross-Dataset Fraud Detection in ERP Event Logs via Tabular Foundation Models, in Proceedings of The 1st International Online Conference on Technologies, 11 November–13 November 2026, MDPI: Basel, Switzerland

Facebook

Twitter

$Zero-Shot Cross-Dataset Fraud Detection in ERP Event Logs via Tabular Foundation Models$

Jeremiah Oluwagbemi Abimbola ¹

1. Faculty of Automatic Control, Silesian University of Technology, Gliwice, 44-100, Poland

Abstract

Fraud and anomaly detection in enterprise resource planning (ERP) systems typically requires labelled training data from the same process log in which the detector will be deployed. During ERP migrations, process redesigns, or cold-start deployments without historical fraud labels, this requirement makes conventional detectors costly or infeasible to retrain; whether detection can transfer across heterogeneous Object-Centric Event Log (OCEL)~2.0 logs without target-domain supervision remains unclear. A Tabular Foundation Model (TabFM) is evaluated in zero-shot in-context classification mode on Order Management, Procure-to-Pay, and Container Logistics logs using seven normalised, schema-independent case features that characterise event volume, activity diversity, duration, resource dispersion, rework, out-of-hours activity, and control-flow conformance; synthetic fraud labels are injected at a 5 % rate through a circularity-free protocol that prevents label leakage by deriving labels from signals excluded from the model inputs. TabFM achieves strong discrimination across the well-aligned transfers (AUC = 0.914 - 1.000) and is competitive with cross-dataset XGBoost, but the Order-Management-to-Container-Logistics transfer fails (AUC = 0.212), plausibly because the sparse, low-repetition source process and event-dense target process have the greatest structural and feature-distribution mismatch. These results demonstrate a retraining-free, immediately deployable fraud-detection approach for ERP system migrations and settings without labelled target data, provided that source and target processes are sufficiently aligned in the normalised feature space.

Keywords

Fraud detection

Taublar Foundation Models

Zero shot

Energy-Efficient Cascaded Machine Learning Framework for Network Anomaly Detection

MACHINE LEARNING BASED ANOMALY DETECTION FOR INTERNET OF THINGS DEVICES IN SMART HOSPITALS