标题： 云调查自动化框架（CIAF）：一种人工智能驱动的云计算取证方法 显示英文标题

标题： Cloud Investigation Automation Framework (CIAF): An AI-Driven Approach to Cloud Forensics

摘要： 大型语言模型（LLMs）在包括云安全和取证在内的领域中获得了关注。 然而，云取证调查仍然依赖于手动分析，这使得它们耗时且容易出错。 LLMs可以模仿人类推理，为自动化云日志分析提供了一条途径。 为了解决这个问题，我们引入了云调查自动化框架（CIAF），这是一个基于本体的框架，在系统地调查云取证日志的同时提高了效率和准确性。 CIAF通过语义验证标准化用户输入，消除歧义并确保日志解释的一致性。 这不仅提高了数据质量，还为调查人员提供了可靠、标准化的信息以供决策使用。 为了评估安全性和性能，我们分析了包含勒索软件相关事件的微软Azure日志。 通过模拟攻击并评估CIAF的影响，结果表明勒索软件检测有显著提高，达到了93%的精确率、召回率和F1分数。 CIAF模块化和可适应的设计不仅适用于勒索软件，还可作为应对多种网络攻击的稳健解决方案。 通过为标准化的取证方法奠定基础并指导未来的AI驱动自动化，这项工作强调了确定性提示工程和基于本体的验证在增强云取证调查中的作用。 这些进展提高了云安全水平，同时为高效、自动化的取证工作流程铺平了道路。 显示英文摘要

摘要： Large Language Models (LLMs) have gained prominence in domains including cloud security and forensics. Yet cloud forensic investigations still rely on manual analysis, making them time-consuming and error-prone. LLMs can mimic human reasoning, offering a pathway to automating cloud log analysis. To address this, we introduce the Cloud Investigation Automation Framework (CIAF), an ontology-driven framework that systematically investigates cloud forensic logs while improving efficiency and accuracy. CIAF standardizes user inputs through semantic validation, eliminating ambiguity and ensuring consistency in log interpretation. This not only enhances data quality but also provides investigators with reliable, standardized information for decision-making. To evaluate security and performance, we analyzed Microsoft Azure logs containing ransomware-related events. By simulating attacks and assessing CIAF's impact, results showed significant improvement in ransomware detection, achieving precision, recall, and F1 scores of 93 percent. CIAF's modular, adaptable design extends beyond ransomware, making it a robust solution for diverse cyberattacks. By laying the foundation for standardized forensic methodologies and informing future AI-driven automation, this work underscores the role of deterministic prompt engineering and ontology-based validation in enhancing cloud forensic investigations. These advancements improve cloud security while paving the way for efficient, automated forensic workflows.