As cloud environments become increasingly complex, cybersecurity and forensic investigations must evolve to meet emerging threats. Large Language Models (LLMs) have shown promise in automating log analysis and reasoning tasks, yet they remain vulnerable to prompt injection attacks and lack forensic rigor. To address these dual challenges, we propose a unified, secure-by-design GenAI framework that integrates PromptShield and the Cloud Investigation Automation Framework (CIAF). PromptShield proactively defends LLMs against adversarial prompts using ontology-driven validation that standardizes user inputs and mitigates manipulation. CIAF streamlines cloud forensic investigations through structured, ontology-based reasoning across all six phases of the forensic process. We evaluate our system on real-world datasets from AWS and Microsoft Azure, demonstrating substantial improvements in both LLM security and forensic accuracy. Experimental results show PromptShield boosts classification performance under attack conditions, achieving precision, recall, and F1 scores above 93%, while CIAF enhances ransomware detection accuracy in cloud logs using Likert-transformed performance features. Our integrated framework advances the automation, interpretability, and trustworthiness of cloud forensics and LLM-based systems, offering a scalable foundation for real-time, AI-driven incident response across diverse cloud infrastructures.

翻译：随着云环境日益复杂，网络安全和取证调查必须不断发展以应对新出现的威胁。大语言模型在自动化日志分析和推理任务方面显示出潜力，但仍易受提示注入攻击影响，且缺乏取证严谨性。为应对这两大挑战，我们提出一个统一的、通过设计确保安全的生成式AI框架，该框架集成了PromptShield和云调查自动化框架（CIAF）。PromptShield通过基于本体的验证主动防御LLM免受对抗性提示攻击，标准化用户输入并减少操纵风险。CIAF则通过跨取证过程所有六个阶段的、基于本体的结构化推理，简化云取证调查。我们在AWS和微软Azure的真实世界数据集上评估了该系统，证明其在LLM安全性和取证准确性方面均有显著提升。实验结果显示，在攻击条件下，PromptShield提升了分类性能，其精确率、召回率和F1分数均超过93%；而CIAF利用基于Likert量表转换的性能特征，提高了云日志中勒索软件检测的准确性。我们的集成框架推进了云取证和基于LLM系统的自动化、可解释性和可信赖性，为跨多种云基础设施的实时、AI驱动事件响应提供了可扩展基础。