Abstract
As cloud environments become increasingly complex, cybersecurity and forensic investigations must evolve to meet emerging threats. Large Language Models (LLMs) have shown promise in automating log analysis and reasoning tasks, yet they remain vulnerable to prompt injection attacks and lack forensic rigor. To address these dual challenges, we propose a unified, secure-by-design GenAI framework that integrates PromptShield and the Cloud Investigation Automation Framework (CIAF). PromptShield proactively defends LLMs against adversarial prompts using ontology-driven validation that standardizes user inputs and mitigates manipulation. CIAF streamlines cloud forensic investigations through structured, ontology-based reasoning across all six phases of the forensic process. We evaluate our system on real-world datasets from AWS and Microsoft Azure, demonstrating substantial improvements in both LLM security and forensic accuracy. Experimental results show PromptShield boosts classification performance under attack conditions, achieving precision, recall, and F1 scores above 93%, while CIAF enhances ransomware detection accuracy in cloud logs using Likert-transformed performance features. Our integrated framework advances the automation, interpretability, and trustworthiness of cloud forensics and LLM-based systems, offering a scalable foundation for real-time, AI-driven incident response across diverse cloud infrastructures.
Abstract (translated)
随着云环境日益复杂，网络安全与取证调查必须不断发展以应对新兴威胁。大语言模型（LLMs）在自动化日志分析与推理任务中展现出潜力，但仍易受提示注入攻击，且缺乏取证严谨性。为应对这两大挑战，我们提出了一个统一、设计安全的生成式AI框架，整合了PromptShield与云取证自动化框架（CIAF）。PromptShield通过本体驱动验证主动防御LLMs对抗性提示，该验证标准化用户输入并缓解操纵风险。CIAF则通过基于本体的结构化推理，简化了取证全过程六个阶段的云取证调查。我们在AWS与微软Azure的真实数据集上评估了该系统，证明其在LLM安全性与取证准确性方面均有显著提升。实验结果表明，PromptShield在攻击条件下提升了分类性能，精确率、召回率与F1分数均超过93%；而CIAF通过利克特变换的性能特征，增强了云日志中的勒索软件检测准确率。我们的集成框架推动了云取证与基于LLM系统的自动化、可解释性与可信度，为跨多样云基础设施的实时AI驱动事件响应提供了可扩展基础。
URL
https://arxiv.org/abs/2604.03912
