跳到正文
DEV Community· Balabhadra·· 3 小時前AI 評分43

PhantomTrace：調查系統日誌異常活動的離線 AI 數碼鑑證工具

PhantomTrace 👻: The Offline AI Forensic Detective Investigating Ghosts in System Logs

AI 導讀

PhantomTrace 是一款離線、以私隱為先的 AI 數碼鑑證工具，可分析系統日誌並重構可疑攻擊活動。它以 MITRE ATT&CK 為基礎的確定性規則引擎連結攻擊序列，再透過 Ollama 執行本地開放權重模型，或使用內置離線推理引擎調查證據及生成事件報告。項目以 MIT License 開源，並提供 Linux、Windows 及 Web 伺服器攻擊情境供測試。

正文

This is a submission for the Hacktoberfest Open-Source AI Challenge Week 4: Ghost in the Machine

What I Built

Every machine leaves a trace. Some tell a story.

When a computer or cloud server is compromised, attackers don't just disappear—they leave behind faint digital apparitions: dozens of failed authentication attempts in the dead of night, an unusual sudo session opened by a low-privileged account, a sudden backdoor user added to /etc/passwd, and an attempt to erase audit logs.

To seasoned SOC tier-3 analysts, these logs tell an obvious story. But for junior developers, sysadmins, and small open-source teams without dedicated security personnel, raw logs are intimidating walls of cryptic text. Existing SIEM tools will throw alerts, but reconstructing what happened, when it happened, and how the adversary navigated the system is agonizingly difficult.

Enter PhantomTrace 👻

PhantomTrace is an offline, privacy-first AI digital forensics investigator that resurrects suspicious system activity and conducts an autonomous digital autopsy.

Instead of another chatbot that writes Halloween ghost stories, PhantomTrace interprets the "Ghost in the Machine" theme through real-world cybersecurity:

  1. The "Ghosts": The hidden, lingering footprints left behind by adversaries in authentication and event logs.
  2. The "Medium": A deterministic rule-based threat engine grounded in the MITRE ATT&CK matrix that extracts and links attack sequences without hallucinating.
  3. The "Detective": An open-weight local AI model (running via Ollama or its built-in offline reasoning engine) that interrogates the evidence, reconstructs the breach lifecycle, and writes official forensic incident reports.
  4. The Haunted Terminal Mode: A retro CRT phosphor-green terminal where the forensic investigator narrates the intruder’s steps like a digital ghost speaking from the system bus.

Demo

  • GitHub Repository: https://github.com/balabhadra3141/Hacktoberfest-Week4
  • Interactive SOC Dashboard: http://localhost:5173
  • 1-Click Demo Scenarios: Built-in attack datasets ready to test in 10 seconds:
    • 🐧 Linux Server Breach: Multi-IP SSH brute force -> root credential acquisition -> privilege escalation -> rogue account creation (ghost_backdoor) -> crontab persistence.
    • 🪟 Windows Domain Lateral Movement: Event ID 4625 brute force -> 4624 successful logon -> 4672 SeDebugPrivilege elevation -> PsExec remote execution -> wevtutil log clearing.
    • 🌐 Web Server RCE: Directory traversal + SQL injection -> PHP web shell upload -> reverse shell payload execution.

Key Screens & Features in Action

  • SOC Overview Console: Real-time Ghost Threat Index gauge (0–100), alert severity distribution, and MITRE tactic breakdown charts.
  • Ghost Timeline: Interactive chronological attack reconstruction tracing the adversary's actions with color-coded severity nodes and raw log drill-downs.
  • AI Chat Investigator: Grounded interactive Q&A where you can ask "Was this a brute force attack?", "Which events connect in the kill chain?", or "Provide remediation steps".
  • Incident Report Generator: 1-click download of an official, publication-ready Incident Response PDF (generated locally via ReportLab) and structured JSON for SIEM ingestion.
  • Haunted Terminal: Retro cyber-terminal that types out the ghostly autopsy stream line by line.

Code

The entire codebase is open-source under the MIT License:

Hacktoberfest-Week4/
├── backend/
│   ├── main.py               # FastAPI backend with CORS, streaming, & REST endpoints
│   ├── detector.py           # Deterministic threat engine (MITRE ATT&CK mapping & scoring)
│   ├── ollama_client.py      # Ollama local LLM connector + Zero-fail offline DFIR engine
│   ├── report_generator.py   # Publication-ready PDF (ReportLab) & JSON export
│   ├── samples.py            # Pre-loaded multi-stage attack scenarios
│   └── requirements.txt      # Pure Python dependencies (FastAPI, uvicorn, reportlab)
├── frontend/
│   ├── src/
│   │   ├── components/
│   │   │   ├── Navbar.tsx            # Case status, Ghost Score pill, & engine indicator
│   │   │   ├── SOCDashboard.tsx      # Metrics, Recharts attack vectors, & alert feed
│   │   │   ├── EvidenceScanner.tsx   # 1-click scenario loader, file upload, & raw log paste
│   │   │   ├── GhostTimeline.tsx     # Chronological attack graph with MITRE tactic tags
│   │   │   ├── AIChatInvestigator.tsx# Grounded forensic investigator chat with prompt chips
│   │   │   ├── ForensicReport.tsx    # Official DFIR report, IOC table, & 1-click PDF export
│   │   │   └── HauntedTerminal.tsx   # Retro CRT cyber terminal with real-time digital autopsy
│   │   ├── types.ts                  # TypeScript interfaces for all data structures
│   │   ├── App.tsx                   # Central state & scenario orchestrator
│   │   └── index.css                 # Cyber-obsidian & spectral emerald theme
│   ├── package.json
│   └── vite.config.ts
├── samples/                          # Standalone raw sample logs
├── run.bat                           # 1-Click Windows launcher
└── README.md                         # Architecture, installation, & judge guide

You can clone and run it with one command:

git clone https://github.com/balabhadra3141/Hacktoberfest-Week4.git
cd Hacktoberfest-Week4
.\run.bat   # Or `cd backend && uvicorn main:app` and `cd frontend && npm run dev`

How I Built It

PhantomTrace combines a deterministic rule pipeline with local open-weight AI inference:

       System Logs (Linux / Windows / Web)
                      │
                      ▼
        ┌───────────────────────────┐
        │   Log Normalization &     │
        │   Deterministic Rules     │ ◄── Regex Threat Engine (MITRE T1110, T1548, etc.)
        └─────────────┬─────────────┘
                      │
        ┌─────────────▼─────────────┐
        │  Ghost Timeline Rebuilder │ ◄── Chronological Attack Sequences
        └─────────────┬─────────────┘
                      │
         ┌────────────┴────────────┐
         ▼                         ▼
┌──────────────────┐      ┌─────────────────────────┐
│ Local LLM        │      │ Grounded Fallback       │
│ (Ollama/Qwen2.5) │  OR  │ Offline Forensic Agent  │ (100% Free / Zero Setup)
└────────┬─────────┘      └────────────┬────────────┘
         │                             │
         └─────────────┬───────────────┘
                       │
       ┌───────────────┼───────────────┐
       ▼               ▼               ▼
┌──────────────┐ ┌─────────────┐ ┌───────────────┐
│ SOC Console  │ │ AI Chat Q&A │ │ PDF / JSON    │
│ & Terminal   │ │ Investigator│ │ Report Export │
└──────────────┘ └─────────────┘ └───────────────┘

1. Deterministic Grounding (Preventing AI Hallucinations)

A major risk in AI cybersecurity is hallucination—an LLM imagining an attack or inventing a fake IP address.
PhantomTrace solves this through a two-stage pipeline:

  • Stage 1 (Deterministic Core): detector.py uses high-speed regex pattern matching to parse Linux syslog/auth.log, Windows EVTX-exported events, and Web server access logs. It identifies confirmed threat indicators (SSH brute force, sudo elevation, rogue accounts) and tags them with official MITRE ATT&CK technique IDs (T1110.001, T1548.003, T1136.001, T1070.001).
  • Stage 2 (Narrative & Correlation): The local AI model receives only verified facts and timeline nodes as grounding context. The AI's job is synthesis, kill-chain correlation, and threat explanation—not guessing.

2. Local Open-Weight Inference (Ollama + Qwen2.5 / Llama 3.2)

PhantomTrace connects directly to a locally hosted Ollama instance (http://127.0.0.1:11434) using open-weight models such as qwen2.5:3b or llama3.2.

  • No cloud API keys required.
  • Zero network requests leave your machine during analysis.
  • Zero-Fail Fallback Engine: To ensure the project works flawlessly for any judge or developer who doesn't have Ollama installed, the backend includes an embedded deterministic AI reasoning engine. If Ollama is offline, PhantomTrace switches automatically and seamlessly to this offline agent.

3. Frontend & Visualizations

Built with React 19, TypeScript, Tailwind CSS, and Recharts:

  • Obsidian & Spectral Emerald Palette: A sleek Security Operations Center (SOC) theme.
  • Recharts Integration: Visual breakdown of MITRE ATT&CK tactics and alert severity distributions.
  • ReportLab Engine: Generates official DFIR incident reports in PDF format with executive summaries, IOC tables, and remediation playbooks.

Why Does Open Innovation Matter?

In digital forensics and cybersecurity, open innovation is not just a preference—it is a non-negotiable architectural requirement.

1. Absolute Privacy & Air-Gapped Operation

System logs contain some of the most sensitive data an organization possesses: private IP architectures, internal hostnames, user credentials, failed passwords, and command histories.
Sending raw production authentication logs to a proprietary, cloud-hosted closed API (like OpenAI or Anthropic) violates compliance standards (GDPR, HIPAA, SOC 2) and actively creates a new data-exfiltration risk.
With open-weight models and Ollama, PhantomTrace operates completely offline. You can disconnect your ethernet cable, turn off Wi-Fi, and run an in-depth forensic investigation on an air-gapped laptop in a data center.

2. Auditability & Grounded Transparency

Closed AI APIs are black boxes that can change, deprecate models, or alter safety guardrails overnight. In forensic investigations where evidence might be presented in court or an insurance audit, you need predictable, auditable, deterministic inference. Open-source models can be versioned, inspected, fine-tuned, and verified locally.

3. Zero Cost & Universal Accessibility

Small startups, non-profits, independent developers, and open-source maintainers cannot afford enterprise SIEM subscriptions that charge thousands of dollars per gigabyte of ingested logs. PhantomTrace proves that open-source AI and deterministic engineering can give anyone an enterprise-grade digital forensic investigator for $0.

My Agent Session

This entire application—from backend threat rules and Ollama integration to the React dashboard, timeline graph, and PDF report generator—was developed through an agentic pair-programming session with Antigravity.

The workflow:

  1. Architectural design focusing on deterministic threat detection + local LLM grounding.
  2. Rapid implementation of the FastAPI backend, ReportLab PDF generator, and synthetic incident logs.
  3. Building the React + TypeScript frontend with Tailwind CSS and Recharts.
  4. Testing live inference and verifying complete offline resilience.

The Spirit of It

The moment this project truly came alive was when we tested the Haunted Terminal Mode on the Linux Server Breach dataset:

╔══════════════════════════════════════════════════════════════════════╗
║ PHANTOMTRACE FORENSIC KERNEL v1.0.0-HACKTOBERFEST                   ║
║ Every machine leaves a trace. Some tell a story.                    ║
╚══════════════════════════════════════════════════════════════════════╝
[*] [PHANTOMTRACE] Initializing Spectral Memory Extraction...
[*] Probing kernel ring buffer and forensic event journals...
[*] Captured 14 spirit traces across system bus.
[!] DANGER: Detected 5 paranormal security deviations!
[!] Spectral Origin Located: Foreign IP entity `198.51.100.42` manifesting on port 22.
[>] Trace #1: SSH Brute Force Attack (5 attempts) [T1110.001]
    ↳ Whisper: Detected 5 failed authentication attempts originating from IP 198.51.100.42.
[💀] THE GHOST BREACHED THE GATE: Authentication barrier collapsed!
[💀] GHOST ELEVATION: The entity possessed root UID 0 permissions!
[💀] PHANTOM RESIDUE: Adversary left a rogue soul in the user registry!
[*] Forensic timeline sealed. Digital autopsy complete.

Watching cryptic log lines transform into a coherent, gripping narrative—not as fictional fantasy, but as an accurate, MITRE-mapped autopsy of a real cyber incursion—made it clear: AI doesn't just need to generate text; it can give eyes and ears to systems that were previously silent.

Prize Categories

  • Open Innovation Track: Privacy-first, offline digital forensics powered by open-weight AI models.
  • Cybersecurity & AI Agents Track: Autonomous DFIR agent with deterministic grounding, MITRE ATT&CK correlation, and automated incident response reporting.
  • Ghost in the Machine (Halloween Theme): Uncovering the ghost traces left in machine memory and narrating the breach via the Haunted Terminal.

Built with ❤️ for Hacktoberfest 2026. Every machine leaves a trace. Some tell a story. 👻

來源：DEV Community · dev.to

#開源/倉庫#Agent#部署/工程