A Cloud-Native Architecture for Human-in-Control LLM-Assisted OpenSearch in Investigative Settings

2026-04-22

AI Summary

This study addresses the semantic gap between unstructured evidence and natural language queries in complex criminal investigations, which hinders retrieval efficiency. To bridge this gap, the authors propose a cloud-native microservice architecture designed for private cloud deployment, integrating large language models (LLMs) into a human-in-the-loop workflow to automatically translate natural language queries into valid OpenSearch domain-specific language. The system combines BM25 lexical retrieval with nested semantic vector embeddings, establishing the first LLM-driven hybrid retrieval framework tailored for high-sensitivity investigative scenarios. A functional prototype evaluated on the Enron email dataset demonstrates technical feasibility and provides a reproducible system architecture baseline alongside a rigorous evaluation methodology.

Technology Category

• Data Mining & Knowledge Management: Conversational Systems for Recommendation & Retrieval
• Natural Language Processing: Question Answering
• Search and Optimization: Distributed Search

Application Category

• Search and Retrieval-Augmented AI: Large language models for search
• Semantics and Knowledge: Data modeling to support human-machine intelligence, including LLMs agents, intelligent system behavior, explanations, and user-friendly interactions
• User Modeling, Personalization and Recommendation: Fairness-aware retrieval and ranking

Abstract

Complex criminal investigations are often hindered by large volumes of unstructured evidence and by the semantic gap between natural language investigative intent and technical search logic. To address this challenge, we present a design and feasibility study of a cloud-native microservice architecture tailored to private-cloud deployments, contributing to research in secure cloud computing and leveraging modern cloud paradigms under high security and scalability requirements. The proposed system integrates Large Language Models into a "Human-in-Control" workflow that translates natural-language queries into syntactically valid OpenSearch Domain-Specific Language expressions. We describe the implementation of a hybrid retrieval strategy within OpenSearch that combines BM25-based lexical search with nested semantic vector embeddings. The paper focuses on system design and preliminary functional validation, establishing an architectural baseline for future empirical evaluation. Technical feasibility is demonstrated through a functional prototype, and a rigorous evaluation methodology is outlined using the Enron Email Dataset as a structural proxy for restricted investigative corpora.

Problem

• criminal investigation
• unstructured evidence
• semantic gap
• natural language intent
• technical search logic

Innovation

• cloud-native architecture
• human-in-control
• large language models
• hybrid retrieval
• OpenSearch