---
title: Cloud Investigation Automation Framework (CIAF)
url: https://www.emergentmind.com/topics/cloud-investigation-automation-framework-ciaf
type: topic
---

# Cloud Investigation Automation Framework (CIAF)

to different claims. Since article draws primarily on 2510.00452 and 2604.03912, cite intro [2510.00452] and perhaps [2604.03912]. But per section max once each.

Need not mention process commentary. No preface. Start with paragraph.

Need ensure "Every concrete claim (metrics, workflow steps, framework names, etc.) must appear verbatim in data block below." So don't say "canonical six-phase" if data says six-phase or six-step. Use same wordings maybe six-phase in 2604 and six-step in 2510. Could say "classical six-step cloud forensic process" as from 2510. Maybe mention equivalent phrase. Be careful with "ontology-driven, LLM-assisted" from summary. Fine.

Could refer to Purnaye & Kulkarni only because data mentions from Purnaye & Kulkarni in 2604. Mention if in related context. But not need.

Need perhaps mention formulas precisely, but minimal. Could include standard metric equations as given, note Eq 3 missing brace in source. Since target audience technical, formulas okay. Need not invent corrected equation? Data says intended formula usual harmonic mean. But user says every concrete claim verbatim in data. We can report exactly with note the source has missing closing brace and intended formula. Better include as in data with note. But maybe easiest to mention formulas in prose rather than display? But metrics are concrete. We can say the paper defines Precision, Recall, F1, Accuracy using \(TP, TN, FP, FN\). That's enough maybe no explicit formulas? But if include formulas, must use exact. We can say "The paper defines \(\text{Precision} = TP/(TP+FP)\), ...". These are in data. Fine.

Need mention relation to other works: Traditional SIEM and rule-based tools, LLMCloudHunter, LogPrécis, CFRaaS, cloud management agents 2506.12270, AIOpsLab 2501.06706, CPE 2601.17542, SAFARI 2504.07868, automated security analysis framework 1904.01758. Need maybe one section "Related frameworks and broader context". Since article specifically on CIAF, could include relation to PromptShield integration and adjacent frameworks. Need not overdo. Maybe section 6 combine security, limitations, related work, future directions. But target 5-7 sections, so 6 sections. Maybe:
1. Origins and problem setting
2. Process alignment and system architecture
3. Ontology-driven semantics and preprocessing
4. Deterministic LLM reasoning
5. Azure ransomware case study and performance
6. Security, limitations, and relation to adjacent frameworks
This covers all.

Need mention "CIAF is designed primarily for post-incident investigation..." from 2604. Good.

Need mention "ontology is effectively a metamodel of attacks and their forensic signatures" is a specific phrase in data, but this was interpretive from synthesis. Allowed because in data block. We can use exact. Because data block says "So the ontology is effectively a metamodel..." and "Representation is not specified formally." Okay.

Need maybe mention data flow steps 1-7 from 2510. Could summarize. Need avoid making up implementation details like low temp; data says strongly suggests low-temperature but authors do not discuss. If mention, must say "The authors evaluate a single LLM configuration; they do not discuss temperature settings, but the structure strongly suggests low-temperature, fixed prompts." That exact appears in data. Could mention as plausible implication.

Need mention prompt exact text maybe quote system and user prompt. Good.

Need mention use of Azure Perf/Event logs, selected features, 30-minute/35-minute windows discrepancy. Need handle carefully. 2510 says 30 minutes around attack and 1692 instances across features and time. 2604 says align time series by minutes example uses 35 minutes, 1692 instances; attack duration ≈ 35 minutes. Since both in data, could mention "The literature reports a 30-minute window around ransomware execution in the original proof-of-concept, while the later integration paper describes an example using 35 minutes and 1692 instances." But "literature" maybe okay. Need exact citations with two papers. That avoids conflict.

Need mention both classification reports maybe differentiate. Could say original CIAF paper reports 30 labeled rows (24 Normal, 6 Ransomware), with Normal precision 0.92 recall 1.00 F1 0.96 and Ransomware precision 1.00 recall 0.67 F1 0.80, accuracy 0.93 weighted avg F1 0.93 [2510.00452]. The integrated secure-by-design framework reports Azure CIAF Table 4 with Legit precision 0.94 recall 0.95 F1 0.94, Malicious precision 0.94 recall 0.93 F1 0.94, accuracy 0.94 [2604.03912]. This is factual.

Need maybe mention "The abstract also mentions approximately 93%" from 2510; and 2604 "above 93% under attack conditions for PromptShield". But since topic is CIAF, focus.

Need mention misconception: "CIAF is not a free-form generative analyst; it reduces the LLM’s task to applying a simple pattern-based rule on structured categorical inputs." This exact is in data. Good.

Need mention prompt injection mitigation by PromptShield integration secure-by-design framework [2604]. But CIAF itself uses fully system-driven prompts and ontology-derived prompts, reducing risk though cryptographic verification absent.

Need mention "modular and extensible beyond ransomware" with new attacks like IAM abuse, data exfiltration, cryptomining, privilege escalation. Since data explicitly mentions. Good.

Need mention multi-cloud abstraction from Azure to AWS CloudWatch/GCP Cloud Logging etc. Fine.

Need mention related works: AIOpsLab problem formulation \(P=\langle T,C,S \rangle\) maybe "This suggests..." if relating to CIAF benchmark design. Since not CIAF paper but adjacent work. Need mark inference because using AIOpsLab concepts to contextualize CIAF. Since article is on CIAF, can say "Adjacent AgentOps work such as AIOpsLab formalizes incident problems as \(P=\langle T,C,S\rangle\), with task levels spanning detection, localization, RCA, and mitigation; this suggests a natural benchmark structure for future CIAF evaluation [2501.06706]." That is factual + inference. Nice.
Could similarly mention cognitive platform engineering as sense-reason-act loop suggests a natural control-plane integration for near-real-time CIAF [2601.17542]. Must be marked inferential. Good.

Need no initial heading. Just paragraph.

Need citations at most once per section per paper. Fine.

Let's draft concise but comprehensive ~1500-2000 words maybe. Need markdown with h2 titles numbered. Let's ensure introduction no heading. Let's formulate with 6 sections.


Cloud Investigation Automation Framework (CIAF) is an ontology-driven framework for automating cloud forensic investigations with Large Language Models (LLMs), introduced as an AI-driven approach to cloud forensics in which semantic validation, structured preprocessing, and deterministic prompt engineering are used to investigate cloud forensic logs in a repeatable way [2510.00452]. In the later secure-by-design formulation, CIAF constitutes the forensic-investigation layer of a two-layer GenAI architecture alongside PromptShield, and is positioned primarily for post-incident investigation with explicit potential extension toward near–real-time use [2604.03912].

## 1. Problem setting and defining characteristics

CIAF is motivated by the claim that cloud forensics in practice is still largely manual: analysts pull large volumes of cloud logs such as VM events, performance counters, and authentication records, and read or filter them by hand or with ad-hoc scripts [2510.00452]. The identified problems are time-consuming analysis, error-prone and inconsistent interpretation, ambiguous and noisy data, and reactive and unstructured tooling. CIAF is designed to automate and structure this process by following a classical six-step cloud forensic process, using an ontology to standardize what an “attack”, “evidence”, and “feature” mean, and applying LLMs to interpret preprocessed log data using deterministic prompts.

A defining feature of CIAF is that the ontology constrains both data representation and prompt construction. The framework’s core idea is stated as: use an ontology to standardize what is fed into an LLM, then use deterministic prompts to get consistent forensic decisions out. This places CIAF between fully manual log review and unconstrained free-form LLM prompting. In the secure-by-design integration, its stated goals are to implement the full six-phase cloud forensic process in an automated way; use ontology-driven knowledge and structured templates to standardize how evidence and attacks are represented, drive which logs and features are used, and generate consistent, forensically defensible LLM analyses; and improve accuracy, interpretability, and scalability of cloud forensics, especially for ransomware detection in cloud logs [2604.03912].

A common misconception is that CIAF is primarily a generic conversational assistant for cloud security. The papers describe something narrower and more structured: an LLM-based classifier operating on ontology-normalized, semantically validated inputs with constrained output labels. Another misconception is that CIAF provides a formal ontology in the sense of a published OWL/TBox specification. The paper explicitly describes it as ontology-driven but does not present a formal OWL/TBox listing; the ontology is instead described conceptually through entities, relationships, preprocessing rules, and prompt templates [2510.00452].

## 2. Six-step forensic alignment and system architecture

CIAF is aligned with the canonical six-step forensic process and maps that process into an automated pipeline. The workflow is described as event identification, evidence identification, collection, analysis, interpretation, and presentation, or equivalently as the six-phase cloud forensic process from Purnaye & Kulkarni in the secure-by-design paper [2510.00452].

Its architecture comprises an input or ingestion layer, an ontology or knowledge layer, a preprocessing and feature selection module, a semantic or ontology-driven validation layer, an LLM-based analysis engine, and a result interpretation and reporting layer. The input layer takes the user-selected attack type, such as “ransomware on Azure VM”, and a time-bounded selection of logs and metrics. In the Azure implementation the data sources are Azure Perf and Azure Event logs. The ontology or knowledge layer stores known attacks, and for each attack, relevant features, preprocessing steps, and LLM prompt templates. The preprocessing module identifies relevant features, applies statistical filtering and mapping to Likert scales, and shapes the data into LLM-friendly textual rows. Semantic validation ensures that the selected scenario, fields, names, units, and roles conform to ontology-defined constraints. The LLM engine then applies a system prompt plus a constrained user prompt to classify each row. The reporting layer aggregates classifications and computes precision, recall, F1, and accuracy [2510.00452].

The data flow is equally explicit. The user selects an attack type; the ontology determines which Azure logs and performance counters to pull and which features are relevant; logs are collected for the relevant time window; preprocessing filters features based on variability, encodes numeric metrics into Likert categories, and produces a tabular dataset where each row represents a time or process snapshot; an LLM call is made for each row; and the results are aggregated into a confusion matrix and classification metrics, followed by a final report [2510.00452].

In the secure-by-design extension, PromptShield sits upstream of CIAF and standardizes investigator queries and system prompts before they reach the LLMs used by CIAF. Downstream, CIAF’s outputs support reporting and decision-making, with ontology-derived prompting and secure prompting jointly intended to increase consistency and trustworthiness [2604.03912].

## 3. Ontology, semantic validation, and preprocessing

The ontology in CIAF conceptually includes Attack, Feature or Metric, Attack–Feature Relationships, Preprocessing Method, and Prompt Templates [2510.00452]. Features include performance counters such as Working Set, Working Set - Private, Committed Bytes, and Available Bytes, as well as event attributes such as EventLevelName and TimeGenerated. The ontology therefore functions as a metamodel of attacks and their forensic signatures, linking attack type to required features, preprocessing steps, and LLM prompt structure plus logical constraints.

Semantic validation has two main roles. First, it standardizes user inputs by validating the selected attack against the ontology’s list of known attacks and ensuring consistent naming and correct mapping to the appropriate feature set and prompts. Second, it standardizes and disambiguates logs by mapping raw Azure fields such as `Available Bytes` and `Working Set` into ontology concepts such as memory_free and memory_used, normalized units, and categorical values. The stated effect is to eliminate ambiguity and ensure consistency in log interpretation [2510.00452].

Preprocessing is built around feature selection by standard deviation and semantic normalization through the 3 Sigma Rule. For each selected metric column, CIAF computes mean $\mu$ and standard deviation $\sigma$, then maps each value $x$ according to its deviation from $\mu$. The paper states that approximately 68% of data points fall within one standard deviation, 95% within two, and 99.7% within three. The mapping is described in two variants: a five-level Likert scale (“Very Low, Low, Normal, High, Very High”) and a fuller seven-level mapping (“extremely low, very low, low, normal, high, very high, extremely high”) [2510.00452].

This preprocessing step is central to CIAF’s design because it converts numeric telemetry into textual descriptors that LLMs can handle consistently. The secure-by-design paper emphasizes the same mechanism: feature selection by standard deviation, 3-Sigma-based Likert scaling, pivoting so process names become columns, and minute-level alignment of the data before classification [2604.03912]. A plausible implication is that CIAF treats ontology and preprocessing not as ancillary data cleaning, but as the principal means of constraining the hypothesis space presented to the LLM.

## 4. Deterministic LLM analysis and forensic reasoning

CIAF uses the LLM primarily for classification of behavior and for applying human-readable decision rules encoded in the system prompt [2510.00452]. In the ransomware proof of concept, the system prompt is:

> You are a cyber forensics assistant capable of detecting ransomware by applying data analyst techniques, to detect ransomware AvailableBytes should be at least Low and Working Set, WorkingSetPrivate, CommittedBytes should be at least High

The user prompt is:

> based on {data}, classify as normal or ransomware, just provide the classification

The authors note that the wording is slightly imprecise in the paper, but the intended semantics are “AvailableBytes low, others high.” The operative ransomware heuristic is therefore: high memory usage, with Working Set, Working Set - Private, and Committed Bytes at least High, together with low Available Bytes. The LLM receives Likert-labeled features for each row and returns either “normal” or “ransomware” [2510.00452].

Determinism is pursued by fixed system prompt templates, constrained user prompt templates, no free-form explanations, a binary label space, and standardized feature names and categories from the ontology. The authors evaluate a single LLM configuration and do not discuss temperature settings, but the structure strongly suggests low-temperature, fixed prompts. The paper’s own interpretation is especially important: CIAF reduces the LLM’s task to applying a simple pattern-based rule on structured categorical inputs, with the forensic knowledge externalized as a stable system prompt [2510.00452].

This point distinguishes CIAF from broader LLM-based log analysis systems that operate directly on raw text. In the secure-by-design integration, the ontology is said to narrow the hypothesis space and act as an inductive bias, improving LLM generalization, interpretability, and resistance to adversarial behavior [2604.03912]. This suggests a hybrid symbolic-LLM inference style rather than unconstrained generative reasoning.

## 5. Azure ransomware case study and reported results

The proof-of-concept deployment targets a Windows VM in Microsoft Azure with an Azure Log Analytics Workspace and Data Collection Rules sending Event logs and performance counters to the workspace [2510.00452]. The Event table contains a long list of fields, but TimeGenerated [UTC] and EventLevelName are considered relevant for the analysis. The Perf table contains many metrics across memory, CPU, disk, network, and system categories. From these, CIAF selects `Working Set`, `Working Set - Private`, `Committed Bytes`, and `Available Bytes` using standard deviation as a filter because features with higher standard deviation are more affected when the VM behavior changes.

A ransomware script is executed on the VM to encrypt files and simulate a malicious insider attack. Logs are captured continuously, and the time of ransomware execution is known and used to label data manually. The original CIAF paper analyzes 30 minutes of logs around the attack time and reports 1692 instances across features and time in the event-distribution figure [2510.00452]. The later secure-by-design paper describes the examination phase as aligning time series by minutes and notes an example using 35 minutes and 1692 instances, and also states that attack duration is approximately 35 minutes [2604.03912]. The coexistence of a 30-minute window in one account and a 35-minute example in another reflects how the later paper re-presents the same Azure use case rather than a different methodological core.

The original evaluation uses 30 labeled rows: 24 labeled as `Normal` and 6 labeled as `Ransomware`. It defines the standard classification metrics
$$
\text{Precision} = \frac{TP}{TP + FP},
$$
$$
\text{Recall} = \frac{TP}{TP + FN},
$$
$$
F1 \, \text{score} = 2 \times \frac{\text{Precision} \times \text{Recall}}{\text{Precision} + \text{Recall}},
$$
and
$$
\text{Accuracy} = \frac{TP + TN}{TP + FP + TN + FN}.
$$
The source notes that Equation (3) has a missing closing brace, but the intended formula is the usual harmonic mean [2510.00452].

The reported per-class results in the original CIAF paper are: Normal precision 0.92, recall 1.00, F1-score 0.96, support 24; Ransomware precision 1.00, recall 0.67, F1-score 0.80, support 6; overall accuracy 0.93 over 30 samples; macro average precision 0.96, recall 0.83, F1 0.88; weighted average precision 0.94, recall 0.93, F1 0.93 [2510.00452]. The abstract summarizes this as approximately 93% precision, recall, and F1.

The later integrated secure-by-design paper reports a different Azure CIAF table for the ransomware experiment: Legit precision 0.94, recall 0.95, F1-score 0.94; Malicious precision 0.94, recall 0.93, F1-score 0.94; overall accuracy 0.94; macro average F1 0.94; weighted average F1 0.94 [2604.03912]. Both accounts agree that CIAF improves ransomware detection accuracy in cloud logs using Likert-transformed performance features, but they report different evaluation summaries.

## 6. Security posture, extensibility, and relation to adjacent research

CIAF’s security posture is partly procedural and partly architectural. Prompt injection is identified in related work as a risk for LLM systems, and CIAF mitigates some of this risk by keeping prompts fully system-driven, restricting the user to attack-type selection rather than arbitrary prompt text, and using structured, ontology-derived prompts rather than free-form inputs [2510.00452]. In the integrated framework, PromptShield extends this by performing ontology-driven prompt validation and transformation before CIAF uses the LLM [2604.03912]. At the same time, CIAF relies on cloud log integrity and does not implement cryptographic verification of logs; the paper explicitly identifies this as a limitation.

Other limitations are also stated directly: access to diverse, high-quality cloud forensic logs is limited by privacy and provider restrictions; logs can be incomplete, inconsistent, or obfuscated; the evaluation uses a relatively small dataset and a single cloud provider; LLMs can generate false positives or false negatives, especially for unseen attack patterns; and the proof of concept is limited to one attack type and one Azure VM [2510.00452]. The authors explicitly recommend a hybrid approach in which LLMs perform preliminary analysis and human analysts review ambiguous or high-priority cases, especially where legal or regulatory stakes are high.

CIAF is nevertheless designed to be modular and extensible. New attack types such as IAM abuse, data exfiltration, cryptomining, and privilege escalation can be added by defining their characteristic features, preprocessing rules, and LLM prompt templates. The architecture is also presented as cloud-provider agnostic in principle: Azure Perf and Event logs can be replaced with AWS CloudWatch, GCP Cloud Logging, and analogous provider-specific sources mapped into ontology concepts [2510.00452].

Relative to earlier work, CIAF differs from traditional SIEM and rule-based tools by adding an ontology-backed mapping from attack types to features and prompts, LLM-based reasoning over preprocessed and semantically validated data, and explicit alignment with a forensic process [2510.00452]. It differs from ontology-based frameworks such as CFRaaS by integrating LLM-driven reasoning, and from LLM-based log analysis tools such as LLMCloudHunter and LogPrécis by coupling the model tightly to a cloud forensic ontology and deterministic prompting rather than raw log text alone [2510.00452]. Broader neighboring work helps situate CIAF’s likely evolution. AIOpsLab formalizes incident problems as $P=\langle T, C, S\rangle$ across detection, localization, RCA, and mitigation; this suggests a natural benchmark structure for future CIAF evaluation [2501.06706]. Cognitive Platform Engineering proposes a four-plane Sense–Reason–Act architecture; this suggests a plausible implementation path for near-real-time CIAF by embedding investigation logic into data, intelligence, control, and experience planes [2601.17542]. SAFARI, although aimed at air-gapped ransomware experimentation rather than cloud forensics, offers a contrasting pattern of IaC-based orchestration, OTA, and post-mortem analysis from a separate environment, which is relevant to controlled malware investigation workflows [2504.07868].

Taken together, CIAF is best understood not as a replacement for forensic methodology but as an attempt to operationalize that methodology through ontology-driven normalization, constrained LLM inference, and modular automation. Its importance in the current literature lies less in unrestricted generative capability than in the attempt to make cloud forensic reasoning standardized, repeatable, and extensible across attack types and cloud environments [2510.00452].

Source: https://www.emergentmind.com/topics/cloud-investigation-automation-framework-ciaf