Automating Cloud Security and Forensics Through a Secure-by-Design Generative AI Framework

• URL: http://arxiv.org/abs/2604.03912v1
• Date: Sun, 05 Apr 2026 00:41:09 GMT
• Title: Automating Cloud Security and Forensics Through a Secure-by-Design Generative AI Framework
• Abstract summary: Large Language Models (LLMs) have shown promise in automating log analysis and reasoning tasks, yet they remain vulnerable to prompt injection attacks and lack forensic rigor.<n>We propose a unified, secure-by-design GenAI framework that integrates PromptShield and the Cloud Investigation Automation Framework (CIAF)<n>Our integrated framework advances the automation, interpretability, and trustworthiness of cloud forensics and LLM-based systems.
• Score: 0.0
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: As cloud environments become increasingly complex, cybersecurity and forensic investigations must evolve to meet emerging threats. Large Language Models (LLMs) have shown promise in automating log analysis and reasoning tasks, yet they remain vulnerable to prompt injection attacks and lack forensic rigor. To address these dual challenges, we propose a unified, secure-by-design GenAI framework that integrates PromptShield and the Cloud Investigation Automation Framework (CIAF). PromptShield proactively defends LLMs against adversarial prompts using ontology-driven validation that standardizes user inputs and mitigates manipulation. CIAF streamlines cloud forensic investigations through structured, ontology-based reasoning across all six phases of the forensic process. We evaluate our system on real-world datasets from AWS and Microsoft Azure, demonstrating substantial improvements in both LLM security and forensic accuracy. Experimental results show PromptShield boosts classification performance under attack conditions, achieving precision, recall, and F1 scores above 93%, while CIAF enhances ransomware detection accuracy in cloud logs using Likert-transformed performance features. Our integrated framework advances the automation, interpretability, and trustworthiness of cloud forensics and LLM-based systems, offering a scalable foundation for real-time, AI-driven incident response across diverse cloud infrastructures.

Related papers

• SecureForge: Finding and Preventing Vulnerabilities in LLM-Generated Code via Prompt Optimization [61.91729298584227]
  We introduce SecureForge, an automated pipeline that audits security risks of frontier models and produces auditing-informed secure system prompts.<n>SecureForge first identifies benign prompts that produce statically detectable vulnerabilities, and then amplifies them into a large synthetic prompt corpus of diverse scenarios.<n>On frontier models, SecureForge yields a statistically significant improvement in both unit test success and output security, with output vulnerabilities reduced by up to 48%.
  arXiv  Detail & Related papers  (2026-05-08T18:40:47Z)
• Reasoning-Aware AIGC Detection via Alignment and Reinforcement [55.09684020007737]
  REVEAL is a framework that generates interpretable reasoning chains before classification.<n>It achieves state-of-the-art performance across multiple benchmarks.
  arXiv  Detail & Related papers  (2026-04-21T07:29:55Z)
• Serverless AI Security: Attack Surface Analysis and Runtime Protection Mechanisms for FaaS-Based Machine Learning [0.0]
  This paper presents the first comprehensive security analysis of machine learning workloads in serverless environments.<n>We characterize the attack surface across five categories: function-level vulnerabilities, model-specific threats, infrastructure attacks, supply chain risks, and IAM complexity.<n>We propose Serverless AI Shield (SAS), a multi-layered defense framework providing pre-deployment validation, runtime monitoring, and post-execution forensics.
  arXiv  Detail & Related papers  (2026-01-15T23:32:37Z)
• CaMeLs Can Use Computers Too: System-level Security for Computer Use Agents [60.98294016925157]
  AI agents are vulnerable to prompt injection attacks, where malicious content hijacks agent behavior to steal credentials or cause financial loss.<n>We introduce Single-Shot Planning for CUAs, where a trusted planner generates a complete execution graph with conditional branches before any observation of potentially malicious content.<n>Although this architectural isolation successfully prevents instruction injections, we show that additional measures are needed to prevent Branch Steering attacks.
  arXiv  Detail & Related papers  (2026-01-14T23:06:35Z)
• Cloud Security Leveraging AI: A Fusion-Based AISOC for Malware and Log Behaviour Detection [0.0]
  Cloud Security Operations Center (SOC) enable cloud governance, risk and compliance by providing insights visibility and control.<n>We implement an AI-Augmented Security Operations Center (AISOC) on AWS that combines cloud-native instrumentation with ML-based detection.
  arXiv  Detail & Related papers  (2025-12-16T21:56:11Z)
• Cloud Investigation Automation Framework (CIAF): An AI-Driven Approach to Cloud Forensics [0.0]
  We introduce the Cloud Investigation Automation Framework (CIAF), a framework that systematically investigates cloud forensic logs.<n>CIAF standardizes user inputs through semantic validation, eliminating ambiguity and ensuring consistency in log interpretation.<n>Results show significant improvement in ransomware detection, achieving precision, recall, and F1 scores of 93 percent.
  arXiv  Detail & Related papers  (2025-10-01T03:05:47Z)
• A Call to Action for a Secure-by-Design Generative AI Paradigm [0.0]
  Large language models (LLMs) are vulnerable to prompt injection and other adversarial attacks.<n>This paper introduces PromptShield, a framework that ensures deterministic and secure prompt interactions.<n>Our results demonstrate a significant improvement in model security and performance, achieving precision, recall, and F1 scores of approximately 94%.
  arXiv  Detail & Related papers  (2025-10-01T03:05:07Z)
• Deep Learning Models for Robust Facial Liveness Detection [56.08694048252482]
  This study introduces a robust solution through novel deep learning models addressing the deficiencies in contemporary anti-spoofing techniques.<n>By innovatively integrating texture analysis and reflective properties associated with genuine human traits, our models distinguish authentic presence from replicas with remarkable precision.
  arXiv  Detail & Related papers  (2025-08-12T17:19:20Z)
• AgentVigil: Generic Black-Box Red-teaming for Indirect Prompt Injection against LLM Agents [54.29555239363013]
  We propose a generic black-box fuzzing framework, AgentVigil, to automatically discover and exploit indirect prompt injection vulnerabilities.<n>We evaluate AgentVigil on two public benchmarks, AgentDojo and VWA-adv, where it achieves 71% and 70% success rates against agents based on o3-mini and GPT-4o.<n>We apply our attacks in real-world environments, successfully misleading agents to navigate to arbitrary URLs, including malicious sites.
  arXiv  Detail & Related papers  (2025-05-09T07:40:17Z)
• AutoPT: How Far Are We from the End2End Automated Web Penetration Testing? [54.65079443902714]
  We introduce AutoPT, an automated penetration testing agent based on the principle of PSM driven by LLMs. Our results show that AutoPT outperforms the baseline framework ReAct on the GPT-4o mini model.
  arXiv  Detail & Related papers  (2024-11-02T13:24:30Z)
• AI-Enabled System for Efficient and Effective Cyber Incident Detection and Response in Cloud Environments [0.0]
  The escalating sophistication and volume of cyber threats in cloud environments necessitate a paradigm shift in strategies.<n>This research explores the application of AI and ML and proposes an AI-powered cyber incident response system for cloud environments.<n>The findings highlight the effectiveness of the Random Forest model, achieving an accuracy 90% for the Network Traffic and 96% for the Malware Analysis Dual Model application.
  arXiv  Detail & Related papers  (2024-04-08T15:22:03Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.