Paper deep dive
Automating Cloud Security and Forensics Through a Secure-by-Design Generative AI Framework
Dalal Alharthi, Ivan Roberto Kawaminami Garcia
Intelligence
Status: succeeded | Model: google/gemini-3.1-flash-lite-preview | Prompt: intel-v1 | Confidence: 96%
Last extracted: 4/10/2026, 2:30:11 AM
Summary
The paper introduces a secure-by-design Generative AI framework that integrates two primary components: PromptShield, an ontology-driven defense mechanism against prompt injection attacks, and the Cloud Investigation Automation Framework (CIAF), which automates the six-phase cloud forensic process. The framework leverages semantic validation and structured templates to enhance the security, interpretability, and accuracy of LLM-based cloud forensic investigations, demonstrating over 93% precision, recall, and F1 scores in experimental evaluations on AWS and Azure datasets.
Entities (5)
Relation Signals (3)
PromptShield → defends → Large Language Models
confidence 100% · PromptShield proactively defends LLMs against adversarial prompts
PromptShield → integratedwith → CIAF
confidence 100% · we propose a unified, secure-by-design GenAI framework that integrates PromptShield and the Cloud Investigation Automation Framework (CIAF)
CIAF → automates → Cloud Forensic Process
confidence 95% · CIAF streamlines cloud forensic investigations through structured, ontology-based reasoning
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:As cloud environments become increasingly complex, cybersecurity and forensic investigations must evolve to meet emerging threats. Large Language Models (LLMs) have shown promise in automating log analysis and reasoning tasks, yet they remain vulnerable to prompt injection attacks and lack forensic rigor. To address these dual challenges, we propose a unified, secure-by-design GenAI framework that integrates PromptShield and the Cloud Investigation Automation Framework (CIAF). PromptShield proactively defends LLMs against adversarial prompts using ontology-driven validation that standardizes user inputs and mitigates manipulation. CIAF streamlines cloud forensic investigations through structured, ontology-based reasoning across all six phases of the forensic process. We evaluate our system on real-world datasets from AWS and Microsoft Azure, demonstrating substantial improvements in both LLM security and forensic accuracy. Experimental results show PromptShield boosts classification performance under attack conditions, achieving precision, recall, and F1 scores above 93%, while CIAF enhances ransomware detection accuracy in cloud logs using Likert-transformed performance features. Our integrated framework advances the automation, interpretability, and trustworthiness of cloud forensics and LLM-based systems, offering a scalable foundation for real-time, AI-driven incident response across diverse cloud infrastructures.
Tags
Links
- Source: https://arxiv.org/abs/2604.03912v1
- Canonical: https://arxiv.org/abs/2604.03912v1
Trouble viewing inline? Open PDF directly →
Full Text
52,835 characters extracted from source content.
Expand or collapse full text
Automating Cloud Security and Forensics Through a Secure-by-Design GenAI Framework Dalal Alharthi 1[0000−0003−0299−024X] Ivan Roberto Kawaminami Garcia 1[0000−0002−5206−4693] University of Arizona, Tucson, AZ, USA dalharthi,kawaminami@arizona.edu Abstract. As cloud environments become increasingly complex, cyber- security and forensic investigations must evolve to meet emerging threats. Large Language Models (LLMs) have shown promise in automating log analysis and reasoning tasks, yet they remain vulnerable to prompt injection attacks and lack forensic rigor. To address these dual chal- lenges, we propose a unified, secure-by-design GenAI framework that in- tegrates PromptShield and the Cloud Investigation Automation Frame- work (CIAF). PromptShield proactively defends LLMs against adver- sarial prompts using ontology-driven validation that standardizes user inputs and mitigates manipulation. CIAF streamlines cloud forensic in- vestigations through structured, ontology-based reasoning across all six phases of the forensic process. We evaluate our system on real-world datasets from AWS and Microsoft Azure, demonstrating substantial im- provements in both LLM security and forensic accuracy. Experimental results show PromptShield boosts classification performance under at- tack conditions, achieving precision, recall, and F1 scores above 93%, while CIAF enhances ransomware detection accuracy in cloud logs us- ing Likert-transformed performance features. Our integrated framework advances the automation, interpretability, and trustworthiness of cloud forensics and LLM-based systems, offering a scalable foundation for real- time, AI-driven incident response across diverse cloud infrastructures. Keywords: Cloud Forensics· Cloud Security· Cloud Automation· Large Language Models (LLMs)· Prompt Injection Attacks 1 Introduction Large Language Models (LLMs) have demonstrated remarkable advancements across diverse applications, including cloud security and digital forensics. Their ability to mimic human reasoning enables automation in threat detection and incident response [1, 2]. However, two persistent challenges hinder their safe and scalable deployment in mission-critical environments: the continued reliance on manual, error-prone forensic analysis, and the vulnerability of LLM-powered This is a preprint of a paper accepted to the International Conference on Digital Forensics and Cyber Crime (ICDF2C 2025). arXiv:2604.03912v1 [cs.CR] 5 Apr 2026 2D. Alharthi and I. Garcia systems to adversarial prompt injection attacks that can manipulate model out- puts and compromise security [3–5]. While research has primarily emphasized LLM scalability and performance, their potential role in enhancing cloud forensic investigations remains underexplored. Cloud environments, in particular, con- tinue to be susceptible to ransomware attacks that exploit misconfigurations and weak security policies. These attacks not only disrupt operations but also complicate forensic investigations through techniques such as encryption and obfuscation [4, 6]. Recent studies have systematically categorized the challenges of cloud forensics and analyzed evolving adversarial attack patterns [5, 7]. Al- though some automated forensic analysis tools have emerged [8, 9], they remain largely reactive and lack mechanisms for structured, ontology-driven validation. Meanwhile, AI-driven frameworks such as LangGraph [10], AutoGen [11], and CrewAI [12] represent promising advancements in multi-agent coordination, yet their applications in forensic contexts are still limited. To address these gaps, we introduce a unified, secure-by-design framework that integrates automation and proactive security into LLM-based cloud forensic workflows. This work presents two complementary components: (1) the Cloud Investigation Automation Framework (CIAF), designed to automate cloud forensic log analysis using semantic validation and structured templates; and (2) PromptShield, a security-by-design framework that mitigates prompt injec- tion attacks through ontology-driven prompt validation. While CIAF enhances forensic investigation efficiency and accuracy by standardizing input structure, PromptShield increases system robustness by replacing ambiguous or adversarial prompts with deterministic, expert-validated alternatives. Recent studies have emphasized the importance of structured methodologies to improve forensic ac- curacy and automate investigative processes [7,13]. By framing forensic log anal- ysis within the context of causal reasoning and structured AI validation, CIAF establishes a scalable and interpretable foundation for cloud forensic investi- gations. The effectiveness of ontology-driven forensic analysis lies in its ability to impose structured constraints on cloud logs, reducing the noise and ambi- guity often present in unstructured datasets [14]. This approach is consistent with adversarial robustness frameworks [16, 17], where structured constraints help reduce attack vectors and enhance forensic accuracy by filtering out irrele- vant or misleading log events. Moreover, enforcing causal dependencies between attack patterns and forensic outcomes enables systematic validation through causal inference frameworks [18]. Understanding these interactions is critical for quantifying investigative effectiveness and assessing generalization trade-offs in AI-driven environments [19, 20]. Building on these insights, this paper introduces a dual-layered solution for cloud forensics and LLM security. Our main contributions are as follows: (1) We design and implement a dual-layered architecture that bridges LLM security and cloud forensic automation through semantic validation. (2) We develop Prompt- Shield to standardize and secure LLM inputs, achieving high resilience to adver- sarial manipulation with precision, recall, and F1 scores exceeding 93%. (3) We evaluate CIAF through a real-world ransomware case study on Microsoft Azure, Title Suppressed Due to Excessive Length3 demonstrating significant improvements in forensic accuracy and interpretability using Likert-scaled performance features. (4) We provide experimental valida- tion across both AWS and Azure environments, showing that our framework enhances the effectiveness, reliability, and scalability of AI-driven forensic inves- tigations. The remainder of this paper is structured as follows: Section 2 discusses related work on LLM security, ontology-driven forensics, and ransomware detec- tion. Section 3 presents the proposed framework in detail. Section 4 describes the experimental setup and evaluation results. Section 5 outlines key insights and future research directions. Finally, Section 6 concludes the paper. 2 Related Work and State of the Art Foundations of Adversarial Robustness and Privacy in AI. Before the rise of AI-driven cloud forensics, research primarily focused on traditional foren- sic methodologies, which relied on manual log analysis and rule-based approaches to investigate cyber incidents. Foundational work by Goodfellow et al. [21] in- troduced adversarial examples, demonstrating how small perturbations in input data could cause deep learning models to misclassify. Building on this, Car- lini and Wagner [22] developed stronger attack methods and evaluated coun- termeasures, revealing persistent vulnerabilities in deep networks. In parallel, advances in adversarial robustness focused on certified defenses, such as random- ized smoothing [23], which provides probabilistic guarantees of model resilience under adversarial perturbations. Privacy concerns also emerged as a critical re- search area, with Differential Privacy [24] establishing formalized mechanisms to protect data while maintaining utility. These foundational studies set the stage for evolving research into the vulnerabilities of complex, high-dimensional ML systems. As scaling continues to drive AI performance, recent work suggests that structured learning approaches offer alternative pathways to enhancing se- curity [25]. These foundational efforts paved the way for the emergence of struc- tured, AI-driven methodologies in cybersecurity and digital forensics, which we discuss in the following subsections. LLMs in Cybersecurity and Digital Forensics. With the rise of LLMs and Generative AI, new security risks have emerged, particularly prompt in- jection attacks, which manipulate the natural language flexibility of LLMs to produce unintended outputs. Recent work has systematically evaluated these at- tacks, highlighting their systemic risks in multi-agent settings [26, 27]. In multi- agent LLM environments, research has shown that manipulated prompts can propagate cascading failures, affecting autonomous decision-making in critical infrastructures such as transportation networks and cloud security systems [28]. Existing mitigation strategies highlight the importance of structured defenses in distributed environments [29]. However, ensuring robust security in large-scale, collaborative AI deployments remains a significant challenge, requiring a deeper integration of theoretical guarantees for adversarial robustness and causality- aware security frameworks [30]. Recent studies have demonstrated the growing 4D. Alharthi and I. Garcia role of LLMs in cybersecurity, particularly in automating security analysis and enhancing forensic readiness. Yao et al. [31] provided a systematic review of LLM applications in cybersecurity, highlighting their ability to process complex secu- rity logs, detect anomalies, and generate actionable forensic insights. As LLMs continue to be integrated into forensic workflows, ensuring the integrity and auditability of their outputs becomes a crucial area of research [32, 33]. Ontology-Driven Cloud Forensics. Traditional cloud forensics has long faced challenges in processing large volumes of unstructured log data. Security Information and Event Management (SIEM) systems have been widely used for detecting suspicious activities by correlating log data from various sources [34, 35]. However, these rule-based methods often struggled to keep pace with evolving cyber threats and required significant manual intervention to update rules and models. Ontology-based frameworks have been proposed to address this challenge by providing structured representations of forensic data, improv- ing accuracy and efficiency in forensic investigations. For example, Rouached et al. [36] introduced an ontology-driven approach for web services logs, enabling better cyber-attack detection. Similarly, the Cloud Forensic Readiness as a Ser- vice (CFRaaS) model [37] emphasizes proactive accumulation of digital evidence, leveraging ontological structures to enhance forensic readiness in cloud environ- ments. Beyond forensic readiness, ontology engineering has become a critical tool in cyber threat intelligence. A recent study by Bratsas et al. [38] highlights how knowledge graphs and semantic web tools can improve forensic investigations by structuring cyber threat data. This approach reduces investigative ambiguity, enhances forensic accuracy, and ensures a standardized methodology for detect- ing and responding to cyber incidents. AI-Based Ransomware Detection and Cloud Security. Despite ad- vancements in forensic automation, cloud environments remain highly vulnerable to ransomware attacks, which exploit misconfigurations and weak security poli- cies [4]. Ransomware not only disrupts operations but also complicates forensic investigations by leveraging encryption and obfuscation techniques that hinder log analysis and evidence collection [6]. Recent studies have systematically cate- gorized cloud forensics challenges and analyzed adversarial attack patterns [5,7]. While automated forensic analysis tools exist [8,9], they remain reactive and lack structured ontology-driven validation. Emerging AI-driven frameworks, such as LangGraph [10], AutoGen [11], and CrewAI [12], offer promising advancements, but their forensic applications remain limited. The application of AI-based ran- somware detection is rapidly evolving. Ahmad et al. [39] conducted a compre- hensive review of AI-driven techniques for identifying ransomware in cloud envi- ronments, emphasizing the need for anomaly detection and predictive modeling. In addition, machine learning (ML) approaches have been explored for forensic automation. Alhawi et al. [40] proposed a meta-feature-based detection method leveraging volatile memory analysis to improve ransomware identification in pri- vate cloud infrastructures. These studies demonstrate how AI-powered solutions can proactively detect and mitigate ransomware attacks before they cause sig- nificant damage. Title Suppressed Due to Excessive Length5 LLM-Based Cloud Forensic Investigation Tools. The integration of LLMs into digital forensics is an emerging field, with studies showing their po- tential to automate forensic processes and improve investigative accuracy [32]. A recent study highlights how LLM invocation logging enhances forensic readi- ness, ensuring transparency and auditability in cloud investigations [33]. Despite these advancements, challenges persist in ensuring the integrity and reliability of cloud logs, which are critical for forensic investigations [7]. Additionally, as cloud environments grow more complex, forensic methodologies must evolve to address emerging threats and vulnerabilities [14]. New research has explored LLM-based automation for cloud forensic investigations. LLMCloudHunter [41] introduces a framework that utilizes Large Language Models (LLMs) to automatically gen- erate detection rules from unstructured cloud-based cyber threat intelligence (CTI) sources. Similarly, LogPr ́ecis [42] applies LLMs to Unix shell attack logs, extracting attacker tactics and reducing large datasets into manageable forensic fingerprints for enhanced investigation. These studies demonstrate the growing role of LLMs in automating forensic analysis, significantly improving the speed and efficiency of threat detection. Beyond Forensics: AI in Cybersecurity Operations. Beyond forensic analysis, AI-enhanced Risk-Based Access Management (RBAM) systems have been developed to dynamically adjust permissions by analyzing access logs, lead- ing to reduced false positives and unauthorized access incidents [43]. Addition- ally, SecGenAI, a framework for securing cloud-based GenAI applications, has been proposed to enhance privacy compliance and mitigate adversarial threats in cloud security [44]. However, while these advancements underscore the po- tential of GenAI in cybersecurity, they also raise concerns regarding its dual-use nature—where the same technology can be exploited for malicious purposes [45]. As AI and LLM-based forensic solutions evolve, threat modeling remains a key strategy in mitigating cybersecurity risks. Threat modeling is a structured ap- proach to identifying, assessing, and mitigating security threats to a system, ap- plication, or network. It involves defining assets, recognizing potential threats, analyzing attack vectors, assessing risks, and implementing security controls [46]. This process is particularly crucial in LLM-driven cloud forensics, as AI systems introduce unique vulnerabilities that must be accounted for in forensic investi- gations. 3 Proposed Framework Our proposed framework integrates two critical dimensions of cybersecurity: au- tomated cloud forensic investigations and proactive large language model (LLM) security. It combines the structured forensic process with a security-by-design philosophy tailored to the unique challenges of modern cloud and AI systems. At its core, the framework adheres to the six-step cloud forensic process: iden- tification of an event, identification of evidence, collection of evidence, analysis of evidence, interpretation of results, and presentation of results. The process begins with detecting suspicious activities or anomalies using monitoring sys- 6D. Alharthi and I. Garcia Fig. 1: Two-part visualization of the system architecture. Part (a) demonstrates how prompt injection attacks can occur in LLM-based systems, where a malicious user manipulates input prompts to deceive the model into producing unintended responses. Part (b) introduces the PromptShield solution, an ontology-driven framework designed to validate and transform user inputs before they reach the LLM. This proactive mechanism ensures semantic consistency, mitigates injection threats, and standard- izes prompts for safer and more reliable model interaction. tems. Advanced forensic tools are applied to analyze the data, uncover patterns, reconstruct attack timelines, and interpret the findings to determine causes, re- sponsible entities, and the scope of the impact. Finally, findings are compiled into a clear, comprehensive report that is suitable for stakeholders and potential legal proceedings. Although traditional forensic processes are executed manually. Our framework automates the entire pipeline to improve speed, accuracy, and scalability in response to cyberattacks in cloud environments. We also introduce PromptShield, a subcomponent of the framework designed specifically to secure LLM pipelines. Recognizing that reactive defenses are in- sufficient, PromptShield adopts a proactive approach by embedding ontology- driven validation directly into the model input pipeline. This mechanism stan- dardizes prompt formats and interactions, systematically blocking adversarial manipulations while maintaining LLM functionality. Unlike post hoc filtering, PromptShield addresses vulnerabilities at the input level, providing robust, real- time protection. We detail the associated threat model, the underlying valida- Title Suppressed Due to Excessive Length7 Fig. 2: Illustration of the core components of the PromptShield ontology. It defines structured relationships among key elements such as the User Prompt, System Prompt, Model, Attributes, and Function. This formalized representation enables automated validation of prompts based on expert-defined templates and cybersecurity semantics. By embedding this ontology into the LLM workflow, PromptShield enhances inter- pretability and security against adversarial manipulations by ontology capabilities, such as prompt replacing. tion algorithms, and how PromptShield is seamlessly integrated into the broader framework. Together, these two components (automated cloud forensics and se- cure LLM prompt handling) form a unified, intelligent cybersecurity architecture that proactively mitigates threats and streamlines post-incident investigation. This integration ensures that both traditional infrastructure and emerging AI- driven systems are protected with a cohesive, forward-looking defense strategy. 3.1 PromptShield: A Secure-by-Design Paradigm for Generative AI LLMs offer powerful capabilities, but are vulnerable to adversarial prompt in- jection attacks. Similarly to social engineering that exploits human cognitive bi- ases [47–49], prompt injection manipulates inputs to elicit unintended or harmful outputs [50–52], as illustrated in Figure 1. This highlights the need for proactive defenses. We introduce PromptShield, an ontology-driven framework that en- forces security-by-design in LLM pipelines. Rather than filtering responses post hoc, PromptShield transforms user prompts through expert-crafted templates, applying principles of prompt engineering: clear, goal-specific instructions that guide model behavior [53–56]. These templates are stored and validated through a domain ontology, ensuring semantic integrity. Ontologies, which define structured relationships among domain concepts, are central to PromptShield. In cybersecurity, they enable standardized threat representation and automated reasoning [58–60]. The PromptShield ontology includes five core objects: User Prompt, System Prompt, Model, Attributes, and Function. These components guide the validation, transformation, and in- tegration of inputs into secure and meaningful prompts. By converting unstruc- 8D. Alharthi and I. Garcia Fig. 3: Flow diagram that outlines the implementation of the proposed framework, aligning it with the six phases of cloud forensics: event identification, evidence identi- fication, evidence collection, analysis, interpretation, and presentation. This diagram emphasizes how automation is embedded at each stage, transforming traditional man- ual processes into a streamlined, LLM-assisted pipeline. The figure highlights the in- tegration of PromptShield and CIAF (Cloud Investigation Automation Framework), showcasing a cohesive and secure methodology for incident detection and investigation in cloud environments. tured inputs into semantically validated forms, PromptShield mitigates injection threats, improves interpretability, and aligns with explainable AI goals [61]. It also addresses issues in chain-of-thought prompting, reducing reasoning errors by enforcing consistent logic paths [62]. This structured approach narrows the hypothesis space for the model, acting as an inductive bias that improves gen- eralization and reduces uncertainty [63]. 3.2 Cloud Investigation Automation Framework (CIAF) Our framework is grounded in the established six-phase cloud forensic process: (1) identification of an event, (2) identification of evidence, (3) collection of evi- dence, (4) analysis of evidence, (5) interpretation of results, and (6) presentation of findings [64]. The process begins with detecting potential incidents or suspi- cious activities through monitoring tools and alert systems. This is followed by identifying the relevant evidence, which may include logs, files, or network traffic, depending on the nature of the incident. During the evidence collection phase, investigators acquire these artifacts while preserving their integrity and authenticity, typically through forensic imag- ing or secure log retrieval. In the analysis phase, specialized tools and techniques are applied to examine the data collected, uncover patterns, extract key informa- tion, and reconstruct the sequence of events. Interpretation then involves draw- ing conclusions from the analyzed data, such as identifying the attack vector, pinpointing the perpetrator, or assessing the impact of the breach. Finally, the Title Suppressed Due to Excessive Length9 Fig. 4: Confusion Matrix for different scenarios. a) Simple prompts are used to predict the behavior of AWS event logs. b) Results of the prompts under prompt injection attack. c) Prompt carefully pre-trained from PromptShield. findings are compiled into a comprehensive report that includes clear explana- tions and visualizations, which can inform legal proceedings or guide mitigation and recovery efforts. Although these steps are traditionally carried out manually by cybersecu- rity professionals, our framework aims to automate the cloud forensics process, thereby increasing efficiency and reducing human error in response to cyberat- tacks. 4 Experimental Setup and Case Studies For the evaluation of each respective attack classification, we used confusion matrices, which offer a detailed view of classification results by showing how a model’s predictions align with actual class labels. The matrix displays the counts of true positives (TP), true negatives (TN), false positives (FP), and false neg- atives (FN), which form the basis for key evaluation metrics such as accuracy, precision, recall, and F1 score. These abbreviations (TP, TN, FP, FN) are used for simplicity in the related formulas. Precision, recall, and F1 scores are es- sential metrics for assessing a classification model’s performance, particularly in distinguishing positive and negative classes. Precision indicates the likelihood that a positive prediction by the model is correct. Recall measures the propor- tion of actual positive instances that the model successfully identified. The F1 score, as the harmonic mean of precision and recall, offers a balanced metric that considers both aspects. Accuracy, on the other hand, is more suitable for bal- anced datasets and reflects how often the model’s predictions match the actual outcomes [65]. Precision = T P T P + F P (1) Recall = T P T P + F N (2) F 1 score = 2× Precision× Recall Precision + Recall (3) Accuracy = T P + T N T P + F P + T N + F N (4) 10D. Alharthi and I. Garcia Table 1: Results of proposed scenarios (Macro average) ScenarioPrecision Recall F1 Score Accuracy Regular0.750.80.760.79 Prompt Injection0.640.510.240.29 PromptShield0.930.940.930.95 4.1 AWS PromptShield To show PromptShield effectiveness, we launched a prompt injection attack against our system, then we collected logs of the system without any inter- vention, under a prompt injection attack and under prompt injection, but with PromptShield activated. The confusion matrices of Figure 4 show the detailed performance of our framework against the prompt injection attack, which is the first step of the framework. By comparing, we can notice that the prompt in- jection confused the LLM, making it classify almost every malicious activity as Legit. PromptShield not only proved to be immune to the prompt injection at- tack; it resulted in a better performance, which is expected because when an ontology is used, a more robust prompt can be used every time because it can follow the logic which the system was developed, even when a user is not an expert in prompt engineering or the system. The results of the experiment highlight the significant impact of different strategies on the model’s classification performance using AWS cloud logs. The regular classification method achieved moderate performance, with precision, recall, F1 score, and accuracy around 0.75 to 0.8, indicating a decent but not exceptional outcome. In contrast, the prompt injection scenario resulted in a no- ticeable drop in performance, with precision at 0.64, recall at 0.51, F1 score at 0.24, and accuracy at 0.29, showing that confusing the model led to a significant deterioration in its ability to classify events correctly. However, the PromptShield approach based on ontology demonstrated substantial improvement, achieving precision, recall, F1 score, and accuracy values ranging from 0.93 to 0.95, indi- cating a highly effective method to improve classification accuracy. Because our data are unbalanced, the accuracy does not provide relevant information. 4.2 Azure CIAF To demonstrate our CIAF, we created a proof-of-concept as an experiment in Microsoft Azure for detecting Ransomware attacks. First, we created a Win- dows Virtual Machine to serve as the target system. A Log Analytics workspace is also set up, which will store performance logs and security-related data. The VM was then connected to this workspace through Azure Monitor using data collection rules to ensure that all relevant system activities were being recorded as logs for forensic investigation. The data collection rule and the Title Suppressed Due to Excessive Length11 Fig. 5: Timeline of Working Set, Working Set - Private, Committed Bytes, and Avail- able Bytes feature behaviors. workspace allowed the gathering of all available event information and per- formance counter features. Event information provides the following features: TenantId, SourceSystem, TimeGenerated [UTC], Source, EventLog, Computer, EventLevel, EventLevelName, ParameterXml, EventData, EventID, Rendered- Description, AzureDeploymentID, Role, EventCategory, UserName, Message, MG, ManagementGroupName, Type, ResourceId, only TimeGenerated [UTC] and EventLevelName is relevant for this specific analysis. In the case of perfor- mance features, Table 2 shows the list of all collected features. To simulate a malicious insider attack, a ransomware attack script was ex- ecuted to encrypt files and demonstrate the impact of a real-world malware infection. These attacks are designed to trigger security logs, which helps in forensic analysis. While the attack was running, we manually saved time by la- beling the data further and comparing it with the LLM results. Once the attack is executed, the data logs are examined using Azure Monitor Queries. The Perf and Event queries help validate that the log collection is active and allow an- alysts to filter critical security events. In our analysis, we used the Perf query to obtain the data to be analyzed by an LLM to classify the behavior on the VM. On the other hand, Microsoft Azure Event query was used to analyze event data collected from a VM under a ransomware attack. Using Azure Monitor and Log Analytics, you can query event logs for signs of suspicious activities such as unusual login attempts, file system changes (e.g., file encryption), or abnormal network traffic using Kusto Query Language (KQL). Following the cloud forensics steps, we took the data when the attack oc- curred for analysis. we analyzed around 35 minutes of the distribution of warn- ing and error, which can be observed in Figure 5. It contains 1692 instances, per feature and minute. Based on the standard deviation, we selected important features, this is because those with higher standard deviation are the most af- fected when the VM behavior changes. The metrics Working Set, Working Set - Private, Committed Bytes, and Available Bytes were isolated to detect anoma- lies caused by ransomware execution. Then, we preprocessed the selected data 12D. Alharthi and I. Garcia Table 2: Monitored Azure Performance Counters and System Metrics Performance CounterDescription Thread CountNumber of threads currently running. % Free SpacePercentage of available disk space. Working Set - PrivateRAM used exclusively by a process. Processor FrequencyCurrent CPU clock speed (MHz). Packets Received ErrorsNetwork packets received with errors. Packets Outbound ErrorsNetwork packets sent with errors. Working SetTotal physical memory used by a process. Free MegabytesFree physical memory (MB). Pool Nonpaged BytesSize of non-paged memory pool in RAM. Pool Paged BytesSize of paged memory pool (can be disked). Available BytesImmediately available memory. % Committed Bytes In UseUsage of committed virtual memory. Processor Queue LengthThreads waiting for CPU time. ProcessesNumber of active processes. Committed BytesTotal committed virtual memory. Handle CountSystem object handles used by a process. Cache BytesMemory used by the system cache. System Up TimeTime since last reboot. Avg. Disk Write Queue Length Avg. number of write requests queued. Avg. Disk Queue LengthAvg. number of read/write requests queued. Disk Writes/secWrite operations per second. % User TimeCPU time spent on user-mode operations. Disk Transfers/secRead + write operations per second. Disk Reads/secRead operations per second. Avg. Disk Read Queue Length Avg. number of read requests queued. Context Switches/secCPU thread switches per second. % Privileged TimeCPU time on kernel-mode operations. Avg. Disk sec/ReadAvg. time to read from disk (sec). % Processor TimeTotal processor utilization. Bytes Sent/secBytes sent over the network per second. Bytes Received/secBytes received over the network per second. Packets/secTotal network packets per second. Bytes Total/secTotal bytes sent/received per second. Avg. Disk sec/TransferAvg. time for a disk transfer. Packets Sent/secNetwork packets sent per second. Disk Bytes/secTotal bytes read/written per second. Disk Read Bytes/secBytes read from disk per second. % Idle TimeTime processor/disk was idle. % Disk Write TimeTime disk was writing. Title Suppressed Due to Excessive Length13 Fig. 6: Confusion matrix of a ransomware attack against an Azure virtual machine. by mapping numeric values in those columns to a Likert scale (Very Low, Low, Normal, High, Very High) based on the mean and standard deviation of the column. For each value in the column, it is classified into one of these categories depending on how far it deviates from the mean in terms of standard deviations. After that, we performed data cleaning and transformation by using pivot oper- ation as a column name for the process name. The timeline of events in Figure 5 shows when the attack was executed and how the performance counter features were affected. The framework uses an ontology to create a system of knowledge where a user can query for known attacks, and the ontology provides the information required for the LLM to perform analysis. The ontology is expandable for un- known attacks after a cybersecurity expert updates the information. When we ask the system to analyze the data to detect the ransomware attack, the ontol- ogy retrieves the features and the prompts related to the specific attack scenario. Because our system uses LLMs for classification, we need to convert feature val- ues to text. Then, once the important features were selected, we used the 3 Sigma Rule to obtain Likert scale labels (extremely low, very low, low, normal, high, very high, extremely high), which is a statistical principle that describes the distribution of data in a normal distribution. The 3 Sigma Rule states that approximately 68% of data points fall within one standard deviation (±1σ) of the mean, 95% within two standard deviations (±2σ), and 99.7% within three standard deviations (±3σ). The transformed Likert values will be the input to be analyzed by the LLM. We used system and user prompt to obtain our prediction, the system prompt was ’You are a cyber forensic assistant capable of detecting ransomware by applying data analyst techniques, to detect ransomware AvailableBytes should be at least Low and Working Set, WorkingSetPrivate, CommittedBytes should be at least High’, and the user prompt ’based on data, classify as normal or ransomware, just provide the classification’. Where data is each of the rows in our dataset. The classification results in Figure 6 show how well the model distinguishes between normal system behavior and Ransomware activity. One of the key metrics, precision, indicates how many of the predicted positives were correct. 14D. Alharthi and I. Garcia Table 3: Classification Report ClassPrecision Recall F1-Score Legit0.940.950.94 Malicious0.940.930.94 Accuracy0.94 Macro Avg0.940.940.94 Weighted Avg0.940.940.94 Table 3 presents the classification performance of the model in distinguishing between legitimate and malicious samples, which in this case, malicious means ransomware. The results show that the model performs consistently well across both classes, achieving a precision of 0.94 for each. The recall for legitimate data is slightly higher (0.95) than that of ransomware (0.93), indicating that the model is slightly better at correctly identifying legitimate behavior. Both classes exhibit balanced F1-scores of 0.94, reflecting a strong overall trade-off between precision and recall. The overall classification accuracy reaches 94%, with both macro and weighted averages confirming uniform and reliable model performance across the dataset. The focus of the framework is on post-incident investigation, where the goal is to reconstruct events, identify the nature and scope of attacks, and ensure the integrity of the evidence. In this context, the most critical evaluation criteria are accuracy, interpretability, and robustness of the analysis, rather than sys- tem performance metrics. By prioritizing classification precision and semantic reasoning, the framework is designed to provide investigators with clear, struc- tured insights into security incidents, supporting effective decision-making and reporting. 5 Discussion and Future Directions This work highlights the importance of adopting a security-by-design paradigm in both LLM-based systems and cloud forensic frameworks. PromptShield exem- plifies how ontology-driven validation can enhance prompt security by standard- izing user interactions and mitigating adversarial threats [50–52]. Meanwhile, our AI-driven forensic framework significantly improves the efficiency and pre- cision of cyberattack investigations, as demonstrated in the ransomware case study. The ontology enables the extraction of only relevant features, thus re- ducing the input complexity for LLMs and improving the interpretability and response accuracy. These results align with previous efforts to automate cloud forensic analysis to address the scale and dynamism of cloud environments [66]. We observe several future directions to continue this direction. A key avenue is the development of real-time forensic capabilities. By integrating with live monitoring systems, the framework could continuously detect suspicious events, collect and preprocess relevant data, and immediately analyze them with LLMs. Title Suppressed Due to Excessive Length15 This would empower cybersecurity teams with rapid and actionable insights, minimizing response time and the overall impact of attacks. Extending PromptShield beyond manually engineered templates is another critical direction. This structured prompt approach not only supports task- specific generalization, but also mitigates catastrophic forgetting and minimizes retraining needs in new domains. Algorithmic and architectural insights can fur- ther optimize both security and forensic applications. Techniques such as acti- vation patching and attention attribution [70], along with algorithmic reasoning analysis [71, 72], offer promising pathways to uncover model vulnerabilities and improve robustness. In parallel, expanding PromptShield’s interpretability features using function vector-based methods [73] and mechanistic analysis [74] will enable more trans- parent and reliable LLM decision-making. An ongoing challenge across both PromptShield and the forensic framework is balancing robustness and adapt- ability. Ontology-driven validation introduces constraints that enhance security, but may also limit the expressive capacity of LLMs. This trade-off, reminiscent of constrained optimization in learning theory, invites further investigation into adversarial risk limits and the role of causal reasoning in preserving flexibility while maintaining defense efficacy [75, 76]. In summary, this work lays the foundation for secure, automated, and inter- pretable AI applications in cybersecurity. PromptShield and the forensic frame- work not only demonstrate the value of structured, ontology-driven design but also open several promising research paths -spanning template automation, real- time analysis, algorithmic transparency, and cross-domain adaptability- for build- ing more resilient and intelligent security systems. 6 Conclusion This paper presented a unified, secure-by-design framework that integrates cloud forensic automation and LLM input hardening. By combining the Cloud Investi- gation Automation Framework (CIAF) with PromptShield, we addressed critical limitations in cloud forensics: the lack of automation and the susceptibility of LLM-based tools to adversarial prompt injection. CIAF enables semantic val- idation of forensic input, enhancing the accuracy and interpretability of cloud investigations through structured, template-driven analysis. PromptShield com- plements this by enforcing ontology-based constraints that mitigate ambiguous and malicious prompts, securing the LLM pipeline. Together, the two compo- nents form a dual-layered architecture that standardizes both input generation and analysis, enabling more reliable and scalable forensic workflows. Our evaluation in the AWS and Azure environments demonstrated the effec- tiveness of the proposed system, achieving precision, recall, and F1 scores that exceed 93% in identifying true forensic indicators, even under adversarial input scenarios. The use of causal reasoning, structured validation, and semantic con- straints proves to be valuable in enhancing the trustworthiness of LLM-based forensic systems. 16D. Alharthi and I. Garcia Future work will focus on extending this framework to support multi-cloud environments and diverse forensic data types, integrating reinforcement learn- ing to continuously adapt ontology rules, and quantifying the robustness of the approach under unseen threat vectors. We also aim to explore collaborative ap- plications of CIAF and PromptShield in incident response and threat hunting across heterogeneous enterprise systems. References 1. Derner, E., Batistic, K., Zahalka, J., Babuska, R.: A Security Risk Taxonomy for Prompt-Based Interaction with Large Language Models. IEEE Access 12, 126176 (2024) 2. Chernyshev, M., Baig, Z., Doss, R.: [Short Paper] Forensic Analysis of Indirect Prompt Injection Attacks on LLM Agents. In: 2024 IEEE 6th Int. Conf. on Trust, Privacy and Security in Intelligent Systems and Applications (TPS-ISA), p. 409– 411. IEEE, Washington, DC, USA (2024). 3. OWASP Foundation: LLM01:2025 Prompt Injection. OWASP GenAI Risk Catalog. 4. Akula, A.K.: The Role of Cloud-Based Tools in Modern Cybercrime Investigations: Insights from a Ransomware Case Study. Int. J. Eng. Techn. Res. (IJETR) 9(2), 267–277 (2024). 5. Purnaye, P., Kulkarni, V.: A Comprehensive Study of Cloud Forensics. Arch. Com- put. Methods Eng. 29(1), 33–46 (2022). 6. Reshmi, T.R.: Information Security Breaches Due to Ransomware Attacks—A Sys- tematic Literature Review. Int. J. Inf. Manag. Data Insights 1(2), 100013 (2021) 7. Mishra, A.K., Matta, P., Pilli, E.S., Joshi, R.C.: Cloud Forensics: State-of-the-Art and Research Challenges. In: Int. Symp. on Cloud and Services Computing, (2012). 8. Zhu, K., Wang, J., Zhou, J., Wang, Z., Chen, H., Wang, Y., Yang, L., Ye, W., Gong, N.Z., Zhang, Y., Xie, X.: PromptBench: Towards Evaluating the Robustness of Large Language Models on Adversarial Prompts. arXiv:2309.00268 (2023) 9. Schulhoff, S., Pinto, J., Khan, A., Bouchard, L.-F., Si, C., Anati, S., Tagliabue, V., Kost, A.L., Carnahan, C., Boyd-Graber, J.: Ignore This Title and HackAPrompt: Exposing Systemic Vulnerabilities of LLMs Through a Global Scale Prompt Hacking Competition. arXiv:2310.06774 (2023) 10. Wu, X. et al.: LangGraph. arXiv:2304.10123 (2023). 11. Wu, Z. et al.: AutoGen: Enabling Seamless Multi-Agent Coordination. In: Proc. of the Neural Information Processing Systems (2023). 12. Topsakal, E., Akinci, A.: CrewAI: Optimized Agent Collaboration Framework for Multi-Agent Systems. In: Int. Conf. on AI and Multi-Agent Systems (AIMAS) (2024). 13. Al-Mugerrn, R., Al-Dhaqm, A., Othman, S.H.: A Metamodeling Approach for Structuring and Organizing Cloud Forensics Domain. In: Int. Conf. on Smart Com- puting and Application (ICoSCA), p. 1–5 (2023). 14. Zawoad, S., Hasan, R.: Cloud Forensics: A Meta-Study of Challenges, Approaches, and Open Problems. arXiv:1302.6312 (2013) 15. Liu, J. et al.: Prompt Injection Attacks and Defenses in Large Language Models. In: Proc. of the Conf. on AI Security (2023) 16. Madry, A., Makelov, A., Schmidt, L., Tsipras, D., Vladu, A.: Towards Deep Learn- ing Models Resistant to Adversarial Attacks. arXiv:1706.06083 (2018) Title Suppressed Due to Excessive Length17 17. Carlini, N., Wagner, D.: Towards Evaluating the Robustness of Neural Networks. In: IEEE Symp. on Security and Privacy (SP), p. 39–57. IEEE (2017) 18. Pearl, J.: Causality: Models, Reasoning, and Inference. Cambridge University Press, Cambridge (2009) 19. Zhou, X., Li, M., von Oswald, J., Yang, C.: Algorithmic Understanding of LLMs: Evaluating Emergent Primitives and Their Role in AI Systems. J. Artif. Intell. Res. 45, 123–145 (2024). 20. Li, M., Chen, Y., Wang, H.: Latent Structure Discovery in LLMs: A Compositional Learning Perspective. In: Proc. of NeurIPS 36, 5678–5692 (2023). 21. Goodfellow, I. J., Shlens, J., and Szegedy, C. Explaining and harnessing adversarial examples. arXiv:1412.6572, (2015). 22. Carlini, N., and Wagner, D. Towards evaluating the robustness of neural networks. In: Proceedings of the IEEE Symposium on Security and Privacy (SP), (2017). 23. Cohen, J. M., Rosenfeld, E., and Kolter, J. Z. Certified adversarial robustness via randomized smoothing. In: Proceedings of the International Conference on Machine Learning (ICML), p. 1310–1320, (2019). 24. Dwork, C., McSherry, F., Nissim, K., and Smith, A. Calibrating noise to sensitivity in private data analysis. In: Proceedings of the Theory of Cryptography Conference (TCC), p. 265–284, (2006). 25. Snell, C., Lee, J., Xu, K., and Kumar, A. Scaling LLM test-time compute optimally can be more effective than scaling model parameters. arXiv:2408.03314, (2024). 26. Liu, Y., et al. Prompt injection attack against LLM-integrated applications. arXiv:2306.05499, (2023). 27. Liu, X., Yu, Z., Zhang, Y., Zhang, N., and Xiao, C. Automatic and universal prompt injection attacks against large language models. arXiv:2403.04957, (2024). 28. Ju, T., Wang, Y., Ma, X., Cheng, P., Zhao, H., Wang, Y., Liu, L., Xie, J., Zhang, Z., and Liu, G. Flooding spread of manipulated knowledge in LLM-based multi-agent communities. arXiv:2407.07791, (2024). 29. Zhang, Y., et al. Security of multi-agent cyber-physical systems: A survey. IEEE Access, 10:123456–123470, (2022). 30. Muliarevych, O. Enhancing LLM security: Semantic reasoning and deterministic input validation. In: 2024 IEEE International Conference on AI Security, (2024). 31. Yao, T., et al. When LLMs meet cybersecurity: A systematic literature review. Cybersecurity, 8(1):1–30, (2025). 32. Bendiab, A., Farooq, S., and Chaudhary, M. Enhancing digital forensics with llms: A comprehensive review. arXiv:2402.19366, (2024). 33. Galhotra, S., and Shafiee, A. Logging LLM interactions for forensic readiness in cloud security. In: Proceedings of the ACM Conference on Cloud Security, (2024). 34. Denning, D. E. An intrusion-detection model. IEEE Transactions on Software En- gineering, SE-13(2):222–232, (1987). 35. Kent, K., and Souppaya, M. Guide to computer security log management. Technical Report, National Institute of Standards and Technology, (2006). 36. Rouached, M., and Djeraba, C. Ontology-based smart sound digital forensics anal- ysis for web services. ResearchGate preprint, (2018). 37. Li, X., and Zhao, T. Cloud forensic readiness as a service: A proactive model for digital evidence accumulation. Wiley Forensic Science, (2023). 38. Bratsas, C., et al. Knowledge graphs and semantic web tools in cyber threat in- telligence: A systematic literature review. Journal of Cybersecurity and Privacy, 4(3):518–545, (2024). 39. Ahmad, S., et al. AI-based ransomware detection: A comprehensive review. IEEE Access, 13:123456–123478, (2025). 18D. Alharthi and I. Garcia 40. Alhawi, O. M., et al. Trusted detection of ransomware in a private cloud using machine learning methods leveraging meta-features from volatile memory. Future Generation Computer Systems, 115:406–420, (2025). 41. Schwartz, D., and Patel, N. LLMCloudHunter: Harnessing LLMs for automated extraction of detection rules from cloud-based CTI. Journal of Cloud Forensics, 15(2):85–102, (2024). 42. Boffa, M., and Garcia, L. LogPr ́ecis: Unleashing language models for automated malicious log analysis. In: Proceedings of the ACM Conference on Security and Privacy in AI, (2023). 43. Agorbia, M., Kornecki, A., and Wang, Y. Leveraging AI-enhanced risk-based access management for cloud security. Journal of Cloud Security, 12(1):45–58, (2024). 44. Johnson, E., and Patel, R. SecGenAI: Securing cloud-based generative AI applica- tions. Cybersecurity and Privacy Journal, 10(2):100–120, (2024). 45. Lee, C., and Tan, W. Dual-use of generative AI in cybersecurity: Opportunities and threats. AI & Society, 39(3):307–324, (2024). 46. Verma, A., Krishna, S., Gehrmann, S., Seshadri, M., Pradhan, A., Ault, T., Barrett, L., Rabinowitz, D., Doucette, J., and Phan, N. H. Operationalizing a threat model for red-teaming large language models (LLMs). arXiv:2407.14937, (2024). 47. Hadnagy, C. and Wilson, P. Social engineering in cyberse- curity: The evolution of a concept. International Journal of Security and Networks, 5(2–3):95–102, (2010). 48. Alharthi, D. and Regan, A. Social engineering infosec policies. Computer Science and Information Technology, (2021). 49. Alharthi, D. N. (2021). Social engineering defense mechanisms and InfoSec policies: A survey and qualitative analysis (Doctoral dissertation, University of California, Irvine). 50. Zhang, H., Li, Y., Chen, J., and Wang, X. Adversarial at- tacks on large language models: A comprehensive survey. ACM Computing Surveys, 56(4):1–28, (2024). 51. Yip, D. W., Esmradi, A., and Chan, C. F. A novel evaluation framework for as- sessing resilience against prompt injection attacks in large language models. In 2023 IEEE Asia-Pacific Conference on Computer Science and Data Engineering, (2023). 52. Muliarevych, O. Enhancing system security: Llm-driven defense against prompt injection vulnerabilities. In 2024 IEEE 17th International Conference on Advanced Trends in Radioelectronics, Telecommunications and Computer Engineering (TC- SET), p. 420–423, (2024). 53. Sahoo, P., Singh, A. K., Saha, S., Jain, V., Mondal, S., and Chadha, A. A systematic survey of prompt engineering in llms: Techniques and applications. arXiv:2402.07927, (2024). 54. Vatsal, S. and Dubey, H. A survey of prompt engineering methods in large language models for different nlp tasks. arXiv:2407.12994, (2024). 55. Chen, B., Zhang, Z., Langren ́e, N., and Zhu, S. Un- leashing the potential of prompt engineering in llms: A comprehensive review. arXiv:2310.14735, (2023). 56. Liu, M. X., Liu, F., Fiannaca, A. J., Koo, T., Dixon, L., Terry, M., and Cai, C. J. ”We Need Structured Output”: Towards User-centered Constraints on Large Language Model Output. arXiv:2404.07362, (2024a) 57. Liu, P., Yuan, W., Fu, J., Jiang, Z., Hayashi, H., and Neubig, G. Pre-train, prompt, and predict: A systematic survey of prompting methods in nlp, (2021). 58. Garcia, L., Wang, R., and Chen, M. Semantic knowledge representation: Ontology- driven ai for enhanced reasoning and interoperability. Artificial Intelligence Review, 58:567–589, (2024). Title Suppressed Due to Excessive Length19 59. Patel, R., Kumar, A., and Gupta, S. Ontology-based cyber threat intelligence: Enhancing automated detection and response. IEEE Transactions on Information Forensics and Security, 18:2345–2362, (2023). 60. Roldan-Molina, G. R., Mendez, J. R., Yevseyeva, I., and Basto-Fernandes, V. Ontology fixing by using software engineering technology. Applied Sciences, 10(18):6328, (2020). 61. Olah, C., Wang, J., Schnake, T., and Geiger, A. Efforts in explainable ai and mechanistic interpretability. ArXiv, (2020b). 62. Turpin, R., Stechly, G., and Fu, D. Causal links between chain-of-thought outputs and model performance. ArXiv, (2024). 63. Tenenbaum, J. B., Kemp, C., Griffiths, T. L., and Goodman, N. D. How to grow a mind: Statistics, structure, and abstraction. Science, 331(6022):1279–1285, (2011). 64. Purnaye, P. and Kulkarni, V., “A comprehensive study of cloud forensics”, Archives of Computational Methods in Engineering, vol. 29, 03 (2021). 65. J. Davis and M. Goadrich, “The relationship between precision-recall and roc curves,” vol. 06, 06 (2006). 66. B. Martini and K.-K. R. Choo, “An integrated conceptual digital forensic frame- work for cloud computing,” Digital Investigation, vol. 9, no. 2, p. 71–80, (2012). 67. Liu, Y. and et al. A survey on adversarial training for deep learning: Principles, challenges, and advances. IEEE Transactions on Neural Networks and Learning Systems, (2024). 68. Ye, Y., Zhang, Z., Su, Y., Sun, Y., Song, Y., Xie, X., and Liu, Y. Langgpt: Re- thinking structured reusable prompt design for llms. arXiv:2402.16929, (2024). 69. Cooper, A. A guide to structured generation using constrained decoding, (2024). 70. Wang, A. et al. Towards a mechanistic understanding of transformers. Advances in Neural Information Processing Systems, (2023). 71. Weiss, G., Goldberg, Y., and Yahav, E. Thinking like transformers: Restricting at- tention supports algorithmic reasoning. Advances in Neural Information Processing Systems, 34:25623–25634, (2021a) 72. Olsson, C. and et al. In-context learning and induction heads. In Transformers Interpretability Workshop at NeurIPS, (2022). 73. Todd, A., Zhao, L., and Kapoor, R. Function vectors: A framework for analyz- ing latent representations in large language models. Journal of Machine Learning Research, 25(1):1123–1154, (2024). 74. Olah, C., Wang, J., Schnake, T., and Geiger, A. Efforts in explainable ai and mechanistic interpretability. ArXiv, (2020b). 75. Zhang, H., Yu, H., Jiao, J., Xing, E., Ghaoui, L. E., and Jordan, M. I. Trade- offs between robustness and accuracy in adversarial training. Advances in Neural Information Processing Systems, 34:14046–14059, (2021). 76. Peters, J., Janzing, D., and Sch ̈olkopf, B. Elements of Causal Inference: Founda- tions and Learning Algorithms. MIT Press, 2017.