Large Language Models (LLMs) have gained prominence in domains including cloud security and forensics. Yet cloud forensic investigations still rely on manual analysis, making them time-consuming and error-prone. LLMs can mimic human reasoning, offering a pathway to automating cloud log analysis. To address this, we introduce the Cloud Investigation Automation Framework (CIAF), an ontology-driven framework that systematically investigates cloud forensic logs while improving efficiency and accuracy. CIAF standardizes user inputs through semantic validation, eliminating ambiguity and ensuring consistency in log interpretation. This not only enhances data quality but also provides investigators with reliable, standardized information for decision-making. To evaluate security and performance, we analyzed Microsoft Azure logs containing ransomware-related events. By simulating attacks and assessing CIAF's impact, results showed significant improvement in ransomware detection, achieving precision, recall, and F1 scores of 93 percent. CIAF's modular, adaptable design extends beyond ransomware, making it a robust solution for diverse cyberattacks. By laying the foundation for standardized forensic methodologies and informing future AI-driven automation, this work underscores the role of deterministic prompt engineering and ontology-based validation in enhancing cloud forensic investigations. These advancements improve cloud security while paving the way for efficient, automated forensic workflows.

翻译：大型语言模型（LLM）在云安全和取证等领域已获得显著关注。然而，云取证调查仍依赖于人工分析，导致其耗时且易出错。LLM能够模拟人类推理，为自动化云日志分析提供了一条途径。为此，我们提出了云调查自动化框架（CIAF），这是一个本体驱动的框架，能够系统性地调查云取证日志，同时提高效率和准确性。CIAF通过语义验证标准化用户输入，消除了歧义并确保日志解释的一致性。这不仅提升了数据质量，还为调查人员提供了可靠、标准化的决策信息。为了评估安全性和性能，我们分析了包含勒索软件相关事件的Microsoft Azure日志。通过模拟攻击并评估CIAF的影响，结果显示勒索软件检测能力得到显著提升，精确率、召回率和F1分数均达到93%。CIAF的模块化、可适应设计使其适用范围超越勒索软件，成为应对多样化网络攻击的稳健解决方案。通过为标准化取证方法奠定基础并为未来人工智能驱动的自动化提供参考，本工作强调了确定性提示工程和基于本体的验证在增强云取证调查中的作用。这些进展不仅提升了云安全性，也为高效、自动化的取证工作流程铺平了道路。