{"slug": "phantomtrace-the-offline-ai-forensic-detective-investigating-ghosts-in-system", "title": "PhantomTrace 👻: The Offline AI Forensic Detective Investigating Ghosts in System Logs", "summary": "A developer built PhantomTrace, an offline, privacy-first AI digital forensics tool that ingests Linux, Windows and web system logs, normalizes them through a deterministic regex threat engine mapped to MITRE ATT&CK techniques, and reconstructs chronological attack timelines. The open-source MIT-licensed project pairs a FastAPI backend with a React dashboard and uses local open-weight inference via Ollama, with a zero-fail offline fallback engine, to generate grounded investigator chat and exportable PDF/JSON DFIR reports.", "body_md": "*This is a submission for the [Hacktoberfest Open-Source AI Challenge Week 4: Ghost in the Machine](https://dev.to/challenges/hacktoberfest-week4-2026-10-26)*\n\nEvery machine leaves a trace. Some tell a story.\n\nWhen a computer or cloud server is compromised, attackers don't just disappear—they leave behind faint digital apparitions: dozens of failed authentication attempts in the dead of night, an unusual `sudo` session opened by a low-privileged account, a sudden backdoor user added to `/etc/passwd`, and an attempt to erase audit logs. \n\nTo seasoned SOC tier-3 analysts, these logs tell an obvious story. But for junior developers, sysadmins, and small open-source teams without dedicated security personnel, raw logs are intimidating walls of cryptic text. Existing SIEM tools will throw alerts, but reconstructing **what happened, when it happened, and how the adversary navigated the system** is agonizingly difficult.\n\n**PhantomTrace** is an offline, privacy-first AI digital forensics investigator that resurrects suspicious system activity and conducts an autonomous digital autopsy.\n\nInstead of another chatbot that writes Halloween ghost stories, **PhantomTrace** interprets the *\"Ghost in the Machine\"* theme through real-world cybersecurity:\n\n`http://localhost:5173`\n`ghost_backdoor`) -> crontab persistence.` SeDebugPrivilege` elevation -> `PsExec` remote execution -> `wevtutil` log clearing.\nThe entire codebase is open-source under the MIT License:\n\n```\nHacktoberfest-Week4/\n├── backend/\n│   ├── main.py               # FastAPI backend with CORS, streaming, & REST endpoints\n│   ├── detector.py           # Deterministic threat engine (MITRE ATT&CK mapping & scoring)\n│   ├── ollama_client.py      # Ollama local LLM connector + Zero-fail offline DFIR engine\n│   ├── report_generator.py   # Publication-ready PDF (ReportLab) & JSON export\n│   ├── samples.py            # Pre-loaded multi-stage attack scenarios\n│   └── requirements.txt      # Pure Python dependencies (FastAPI, uvicorn, reportlab)\n├── frontend/\n│   ├── src/\n│   │   ├── components/\n│   │   │   ├── Navbar.tsx            # Case status, Ghost Score pill, & engine indicator\n│   │   │   ├── SOCDashboard.tsx      # Metrics, Recharts attack vectors, & alert feed\n│   │   │   ├── EvidenceScanner.tsx   # 1-click scenario loader, file upload, & raw log paste\n│   │   │   ├── GhostTimeline.tsx     # Chronological attack graph with MITRE tactic tags\n│   │   │   ├── AIChatInvestigator.tsx# Grounded forensic investigator chat with prompt chips\n│   │   │   ├── ForensicReport.tsx    # Official DFIR report, IOC table, & 1-click PDF export\n│   │   │   └── HauntedTerminal.tsx   # Retro CRT cyber terminal with real-time digital autopsy\n│   │   ├── types.ts                  # TypeScript interfaces for all data structures\n│   │   ├── App.tsx                   # Central state & scenario orchestrator\n│   │   └── index.css                 # Cyber-obsidian & spectral emerald theme\n│   ├── package.json\n│   └── vite.config.ts\n├── samples/                          # Standalone raw sample logs\n├── run.bat                           # 1-Click Windows launcher\n└── README.md                         # Architecture, installation, & judge guide\n```\n\nYou can clone and run it with one command:\n\n```\ngit clone https://github.com/balabhadra3141/Hacktoberfest-Week4.git\ncd Hacktoberfest-Week4\n.\\run.bat   # Or `cd backend && uvicorn main:app` and `cd frontend && npm run dev`\n```\n\nPhantomTrace combines a deterministic rule pipeline with local open-weight AI inference:\n\n```\n       System Logs (Linux / Windows / Web)\n                      │\n                      ▼\n        ┌───────────────────────────┐\n        │   Log Normalization &     │\n        │   Deterministic Rules     │ ◄── Regex Threat Engine (MITRE T1110, T1548, etc.)\n        └─────────────┬─────────────┘\n                      │\n        ┌─────────────▼─────────────┐\n        │  Ghost Timeline Rebuilder │ ◄── Chronological Attack Sequences\n        └─────────────┬─────────────┘\n                      │\n         ┌────────────┴────────────┐\n         ▼                         ▼\n┌──────────────────┐      ┌─────────────────────────┐\n│ Local LLM        │      │ Grounded Fallback       │\n│ (Ollama/Qwen2.5) │  OR  │ Offline Forensic Agent  │ (100% Free / Zero Setup)\n└────────┬─────────┘      └────────────┬────────────┘\n         │                             │\n         └─────────────┬───────────────┘\n                       │\n       ┌───────────────┼───────────────┐\n       ▼               ▼               ▼\n┌──────────────┐ ┌─────────────┐ ┌───────────────┐\n│ SOC Console  │ │ AI Chat Q&A │ │ PDF / JSON    │\n│ & Terminal   │ │ Investigator│ │ Report Export │\n└──────────────┘ └─────────────┘ └───────────────┘\n```\n\nA major risk in AI cybersecurity is hallucination—an LLM imagining an attack or inventing a fake IP address. \n\nPhantomTrace solves this through a two-stage pipeline:\n\n`detector.py` uses high-speed regex pattern matching to parse Linux syslog/auth.log, Windows EVTX-exported events, and Web server access logs. It identifies confirmed threat indicators (SSH brute force, `sudo` elevation, rogue accounts) and tags them with official `T1110.001`, `T1548.003`, `T1136.001`, `T1070.001`).\nPhantomTrace connects directly to a locally hosted **Ollama** instance (`http://127.0.0.1:11434`) using open-weight models such as `qwen2.5:3b` or `llama3.2`. \n\nBuilt with **React 19**, **TypeScript**, **Tailwind CSS**, and **Recharts**:\n\nIn digital forensics and cybersecurity, **open innovation is not just a preference—it is a non-negotiable architectural requirement.**\n\nSystem logs contain some of the most sensitive data an organization possesses: private IP architectures, internal hostnames, user credentials, failed passwords, and command histories. \n\nSending raw production authentication logs to a proprietary, cloud-hosted closed API (like OpenAI or Anthropic) violates compliance standards (GDPR, HIPAA, SOC 2) and actively creates a new data-exfiltration risk. \n\nWith **open-weight models and Ollama**, PhantomTrace operates completely offline. You can disconnect your ethernet cable, turn off Wi-Fi, and run an in-depth forensic investigation on an air-gapped laptop in a data center.\n\nClosed AI APIs are black boxes that can change, deprecate models, or alter safety guardrails overnight. In forensic investigations where evidence might be presented in court or an insurance audit, you need predictable, auditable, deterministic inference. Open-source models can be versioned, inspected, fine-tuned, and verified locally.\n\nSmall startups, non-profits, independent developers, and open-source maintainers cannot afford enterprise SIEM subscriptions that charge thousands of dollars per gigabyte of ingested logs. PhantomTrace proves that open-source AI and deterministic engineering can give anyone an enterprise-grade digital forensic investigator for **$0**.\n\nThis entire application—from backend threat rules and Ollama integration to the React dashboard, timeline graph, and PDF report generator—was developed through an agentic pair-programming session with **Antigravity**.\n\nThe workflow:\n\nThe moment this project truly came alive was when we tested the **Haunted Terminal Mode** on the Linux Server Breach dataset:\n\n```\n╔══════════════════════════════════════════════════════════════════════╗\n║ PHANTOMTRACE FORENSIC KERNEL v1.0.0-HACKTOBERFEST                   ║\n║ Every machine leaves a trace. Some tell a story.                    ║\n╚══════════════════════════════════════════════════════════════════════╝\n[*] [PHANTOMTRACE] Initializing Spectral Memory Extraction...\n[*] Probing kernel ring buffer and forensic event journals...\n[*] Captured 14 spirit traces across system bus.\n[!] DANGER: Detected 5 paranormal security deviations!\n[!] Spectral Origin Located: Foreign IP entity `198.51.100.42` manifesting on port 22.\n[>] Trace #1: SSH Brute Force Attack (5 attempts) [T1110.001]\n    ↳ Whisper: Detected 5 failed authentication attempts originating from IP 198.51.100.42.\n[💀] THE GHOST BREACHED THE GATE: Authentication barrier collapsed!\n[💀] GHOST ELEVATION: The entity possessed root UID 0 permissions!\n[💀] PHANTOM RESIDUE: Adversary left a rogue soul in the user registry!\n[*] Forensic timeline sealed. Digital autopsy complete.\n```\n\nWatching cryptic log lines transform into a coherent, gripping narrative—not as fictional fantasy, but as an accurate, MITRE-mapped autopsy of a real cyber incursion—made it clear: **AI doesn't just need to generate text; it can give eyes and ears to systems that were previously silent.**\n\n*Built with ❤️ for Hacktoberfest 2026. Every machine leaves a trace. Some tell a story.* 👻", "url": "https://wpnews.pro/news/phantomtrace-the-offline-ai-forensic-detective-investigating-ghosts-in-system", "canonical_source": "https://dev.to/balabhadra520/phantomtrace-the-offline-ai-forensic-detective-investigating-ghosts-in-system-logs-1kn4", "published_at": "2026-10-30 22:10:09+00:00", "updated_at": "2026-10-30 22:19:43.541116+00:00", "lang": "en", "topics": ["artificial-intelligence", "ai-tools", "ai-agents", "large-language-models", "developer-tools"], "entities": ["PhantomTrace", "Ollama", "FastAPI", "MITRE ATT&CK", "ReportLab", "GitHub", "Hacktoberfest"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/phantomtrace-the-offline-ai-forensic-detective-investigating-ghosts-in-system", "markdown": "https://wpnews.pro/news/phantomtrace-the-offline-ai-forensic-detective-investigating-ghosts-in-system.md", "text": "https://wpnews.pro/news/phantomtrace-the-offline-ai-forensic-detective-investigating-ghosts-in-system.txt", "jsonld": "https://wpnews.pro/news/phantomtrace-the-offline-ai-forensic-detective-investigating-ghosts-in-system.jsonld"}}