Forensight: End-to-End Cloud VM Workload Forensics from auditd Acquisition to 3D Threat Visualization

Cloud VM workloads represent a critical blind spot in IaaS forensic investigation: provider control-plane logs record infrastructure events but remain entirely blind to the privilege escalations, cron implants, reverse shells, and credential thefts executing inside running VM instances. This paper presents Forensight, a four-phase cloud VM workload forensics framework that addresses this gap by deploying a forensic agent directly on IaaS VM instances, attaching to the native Linux auditd subsystem, and processing the resulting kernel-level event stream through acquisition, semantic normalization, hybrid anomaly detection, and interactive 3D visualization under a continuous SHA-256 chain-of-custody guarantee. On a nine-scenario controlled corpus, the framework achieves precision of 0.910 on the held-out evaluation split, completes end-to-end pipeline execution in under 1.6 minutes, and detects all injected chain mutations. Real-kernel validation is provided by Forensight-AuditD-8, a labeled dataset of 14,758 authentic auditd events captured from Docker-isolated Ubuntu containers on a live host kernel, covering eight attack scenarios including CVE-2021-4034.