This is a submission for the Hacktoberfest Open-Source AI Challenge Week 4: Ghost in the Machine
Every machine leaves a trace. Some tell a story.
When a computer or cloud server is compromised, attackers don't just disappear—they leave behind faint digital apparitions: dozens of failed authentication attempts in the dead of night, an unusual sudo session opened by a low-privileged account, a sudden backdoor user added to /etc/passwd, and an attempt to erase audit logs.
To seasoned SOC tier-3 analysts, these logs tell an obvious story. But for junior developers, sysadmins, and small open-source teams without dedicated security personnel, raw logs are intimidating walls of cryptic text. Existing SIEM tools will throw alerts, but reconstructing what happened, when it happened, and how the adversary navigated the system is agonizingly difficult.
PhantomTrace is an offline, privacy-first AI digital forensics investigator that resurrects suspicious system activity and conducts an autonomous digital autopsy.
Instead of another chatbot that writes Halloween ghost stories, PhantomTrace interprets the "Ghost in the Machine" theme through real-world cybersecurity:
http://localhost:5173
ghost_backdoor) -> crontab persistence. SeDebugPrivilege elevation -> PsExec remote execution -> wevtutil log clearing.
The entire codebase is open-source under the MIT License:
Hacktoberfest-Week4/
├── backend/
│ ├── main.py # FastAPI backend with CORS, streaming, & REST endpoints
│ ├── detector.py # Deterministic threat engine (MITRE ATT&CK mapping & scoring)
│ ├── ollama_client.py # Ollama local LLM connector + Zero-fail offline DFIR engine
│ ├── report_generator.py # Publication-ready PDF (ReportLab) & JSON export
│ ├── samples.py # Pre-loaded multi-stage attack scenarios
│ └── requirements.txt # Pure Python dependencies (FastAPI, uvicorn, reportlab)
├── frontend/
│ ├── src/
│ │ ├── components/
│ │ │ ├── Navbar.tsx # Case status, Ghost Score pill, & engine indicator
│ │ │ ├── SOCDashboard.tsx # Metrics, Recharts attack vectors, & alert feed
│ │ │ ├── EvidenceScanner.tsx # 1-click scenario , file upload, & raw log paste
│ │ │ ├── GhostTimeline.tsx # Chronological attack graph with MITRE tactic tags
│ │ │ ├── AIChatInvestigator.tsx# Grounded forensic investigator chat with prompt chips
│ │ │ ├── ForensicReport.tsx # Official DFIR report, IOC table, & 1-click PDF export
│ │ │ └── HauntedTerminal.tsx # Retro CRT cyber terminal with real-time digital autopsy
│ │ ├── types.ts # TypeScript interfaces for all data structures
│ │ ├── App.tsx # Central state & scenario orchestrator
│ │ └── index.css # Cyber-obsidian & spectral emerald theme
│ ├── package.json
│ └── vite.config.ts
├── samples/ # Standalone raw sample logs
├── run.bat # 1-Click Windows launcher
└── README.md # Architecture, installation, & judge guide
You can clone and run it with one command:
git clone https://github.com/balabhadra3141/Hacktoberfest-Week4.git
cd Hacktoberfest-Week4
.\run.bat # Or `cd backend && uvicorn main:app` and `cd frontend && npm run dev`
PhantomTrace combines a deterministic rule pipeline with local open-weight AI inference:
System Logs (Linux / Windows / Web)
│
▼
┌───────────────────────────┐
│ Log Normalization & │
│ Deterministic Rules │ ◄── Regex Threat Engine (MITRE T1110, T1548, etc.)
└─────────────┬─────────────┘
│
┌─────────────▼─────────────┐
│ Ghost Timeline Rebuilder │ ◄── Chronological Attack Sequences
└─────────────┬─────────────┘
│
┌────────────┴────────────┐
▼ ▼
┌──────────────────┐ ┌─────────────────────────┐
│ Local LLM │ │ Grounded Fallback │
│ (Ollama/Qwen2.5) │ OR │ Offline Forensic Agent │ (100% Free / Zero Setup)
└────────┬─────────┘ └────────────┬────────────┘
│ │
└─────────────┬───────────────┘
│
┌───────────────┼───────────────┐
▼ ▼ ▼
┌──────────────┐ ┌─────────────┐ ┌───────────────┐
│ SOC Console │ │ AI Chat Q&A │ │ PDF / JSON │
│ & Terminal │ │ Investigator│ │ Report Export │
└──────────────┘ └─────────────┘ └───────────────┘
A major risk in AI cybersecurity is hallucination—an LLM imagining an attack or inventing a fake IP address.
PhantomTrace solves this through a two-stage pipeline:
detector.py uses high-speed regex pattern matching to parse Linux syslog/auth.log, Windows EVTX-exported events, and Web server access logs. It identifies confirmed threat indicators (SSH brute force, sudo elevation, rogue accounts) and tags them with official T1110.001, T1548.003, T1136.001, T1070.001).
PhantomTrace connects directly to a locally hosted Ollama instance (http://127.0.0.1:11434) using open-weight models such as qwen2.5:3b or llama3.2.
Built with React 19, TypeScript, Tailwind CSS, and Recharts:
In digital forensics and cybersecurity, open innovation is not just a preference—it is a non-negotiable architectural requirement.
System logs contain some of the most sensitive data an organization possesses: private IP architectures, internal hostnames, user credentials, failed passwords, and command histories.
Sending raw production authentication logs to a proprietary, cloud-hosted closed API (like OpenAI or Anthropic) violates compliance standards (GDPR, HIPAA, SOC 2) and actively creates a new data-exfiltration risk.
With open-weight models and Ollama, PhantomTrace operates completely offline. You can disconnect your ethernet cable, turn off Wi-Fi, and run an in-depth forensic investigation on an air-gapped laptop in a data center.
Closed AI APIs are black boxes that can change, deprecate models, or alter safety guardrails overnight. In forensic investigations where evidence might be presented in court or an insurance audit, you need predictable, auditable, deterministic inference. Open-source models can be versioned, inspected, fine-tuned, and verified locally.
Small startups, non-profits, independent developers, and open-source maintainers cannot afford enterprise SIEM subscriptions that charge thousands of dollars per gigabyte of ingested logs. PhantomTrace proves that open-source AI and deterministic engineering can give anyone an enterprise-grade digital forensic investigator for $0.
This entire application—from backend threat rules and Ollama integration to the React dashboard, timeline graph, and PDF report generator—was developed through an agentic pair-programming session with Antigravity.
The workflow:
The moment this project truly came alive was when we tested the Haunted Terminal Mode on the Linux Server Breach dataset:
╔══════════════════════════════════════════════════════════════════════╗
║ PHANTOMTRACE FORENSIC KERNEL v1.0.0-HACKTOBERFEST ║
║ Every machine leaves a trace. Some tell a story. ║
╚══════════════════════════════════════════════════════════════════════╝
[*] [PHANTOMTRACE] Initializing Spectral Memory Extraction...
[*] Probing kernel ring buffer and forensic event journals...
[*] Captured 14 spirit traces across system bus.
[!] DANGER: Detected 5 paranormal security deviations!
[!] Spectral Origin Located: Foreign IP entity `198.51.100.42` manifesting on port 22.
[>] Trace #1: SSH Brute Force Attack (5 attempts) [T1110.001]
↳ Whisper: Detected 5 failed authentication attempts originating from IP 198.51.100.42.
[💀] THE GHOST BREACHED THE GATE: Authentication barrier collapsed!
[💀] GHOST ELEVATION: The entity possessed root UID 0 permissions!
[💀] PHANTOM RESIDUE: Adversary left a rogue soul in the user registry!
[*] Forensic timeline sealed. Digital autopsy complete.
Watching cryptic log lines transform into a coherent, gripping narrative—not as fictional fantasy, but as an accurate, MITRE-mapped autopsy of a real cyber incursion—made it clear: AI doesn't just need to generate text; it can give eyes and ears to systems that were previously silent.
Built with ❤️ for Hacktoberfest 2026. Every machine leaves a trace. Some tell a story. 👻