SpecterLAN：找出網絡中的「幽靈」

This is a submission for the Hacktoberfest Open-Source AI Challenge Week 4: Ghost in the Machine

What I Built

I built SpecterLAN, a local-first network monitor that helps you understand which devices are connected to your network and what changed between scans.

SpecterLAN can show:

New devices
Devices that went offline
Devices that returned
IP address changes
Devices that still need review

For the Ghost in the Machine theme, unfamiliar or forgotten devices become the "ghosts" on your network.

SpecterLAN does not assume an unknown device is dangerous. It shows what changed and lets you identify the device yourself.

It also includes Ask the Ghost, where a local AI model explains network changes using evidence collected by SpecterLAN.

Everything runs locally on your device.

Demo

Watch the SpecterLAN demo

The demo shows:

A baseline network scan
A new device appearing
SpecterLAN detecting the change
Ask the Ghost explaining the change with local AI
A device changing IP while keeping the same identity
Another device going offline

SpecterLAN also includes Demo Séance, which uses simulated network data so people can test the full experience without exposing their real network.

Code

GitHub repository:

https://github.com/rishabh-hasija/spectarlan

SpecterLAN is open source and released under the MIT License.

How I Built It

SpecterLAN is built with:

Python
Streamlit
SQLite
Ollama
Gemma 3 4B as the default local AI model
Pydantic
Nmap when available, with a local fallback when it is not

Network scanning happens on the user's own device.

Scan history, device names, trust labels, and other information are stored locally in SQLite.

For AI analysis, SpecterLAN sends structured evidence only to the locally running Ollama service.

The default model is gemma3:4b.

SpecterLAN also detects other compatible Ollama models already installed on the device and lets the user select one from a dropdown.

Ask the Ghost does not decide whether a device is malicious.

Instead, SpecterLAN creates evidence records, checks the evidence referenced by the model, and removes unsupported AI output.

Why Does Open Innovation Matter?

Network information is private.

A network scan can contain device names, local addresses, hardware details, and information about devices inside someone's home.

I did not want SpecterLAN to send that information to an external AI API.

Using Ollama and an open-weight model means the AI runs on the same device as SpecterLAN.

There is:

No cloud AI
No API key
No SpecterLAN account
No registration
No shared database
No network history uploaded to a SpecterLAN server

Users can also switch to another compatible local Ollama model.

Even without AI, device discovery, tracking, and scan history continue to work.

This open and local approach keeps the user's network data under their control.

The Spirit of It

Devices appear, disappear, return, and sometimes change addresses.

SpecterLAN treats those changes like apparitions on your network.

A forgotten device might suddenly appear again. A new device might show up without a recognizable name. Ask the Ghost helps explain what SpecterLAN observed.

The Halloween theme is part of the experience, while the findings remain evidence-based.

Unknown does not mean malicious.

Prize Categories

Best Use of Gemma

SpecterLAN uses Gemma 3 4B through Ollama as its default local AI model.

Gemma powers Ask the Ghost, which explains changes between saved network scans using structured local evidence.

The model runs on the user's own device, so private network information does not need to be sent to a hosted AI provider.