This is a submission for the Hacktoberfest Open-Source AI Challenge Week 4: Ghost in the Machine.
What I Built
An old log becomes unsettling when something almost fits: a familiar event at an unfamiliar hour, or a terminal name that appears only once.
Ghost Logbook explores that feeling through a fictional 1999 archive. An open-source Isolation Forest ranks unusual records. The interface then shows observations you can inspect, without inventing a story to explain them.
“This terminal is absent from the training vocabulary” is an observation. “Someone broke in” would be an invention. The app stops at the first sentence.
There are two synthetic examples: a quieter archive and the same archive with six deliberately altered records. You can compare them, inspect individual rows, or try a small CSV. The “ghost” is the gap between what a model expects and what a record actually contains.
Demo
A short route through the demo:
- Load the quieter archive and note the flagged count.
- Load the haunted archive. Compare its count and highest-ranked rows.
- Select a row and read its baseline comparisons.
- Export the report if you want to inspect the scores separately.
Both examples contain 180 fictional rows. In the current model, the quieter example has three flags and the haunted example eight. Those counts are model outputs, not evidence that exactly eight things are wrong.
Analysis runs in the browser. No CSV is uploaded to an inference service, and the app does not store it in cookies or browser storage. Hosting necessarily serves the page's assets; that is separate from uploading input data. A downloaded report contains the input values, so it deserves the same care as the original file. Clearing the view is not a secure-memory-erasure guarantee.
The source distribution also works without the hosted site: open dist/index.html in a JavaScript-capable browser. Its runtime resources are included, with no CDN, API key or package installation required.
Code
Source, training recipe and reproducible tests
Original application code, synthetic data and exported model are MIT-licensed. The repository includes the training recipe, model, reference predictions, browser scorer, examples and tests. Third-party attribution is recorded separately.
How I Built It
The AI component is scikit-learn 1.7.2's IsolationForest. I trained 48 trees on 2,048 fictional records, with a fixed seed, max_samples=256 and contamination=0.02. No user uploads are used for training.
Seven features describe log-transformed duration and payload, UTC hour as sine and cosine, source/event rarity, and status. The trained trees, thresholds and leaf sample counts are exported as data. A small JavaScript implementation follows each path locally and calculates the anomaly score.
That Python-to-browser transfer needed evidence. The browser casts features to float32 and follows scikit-learn's average isolation path-length calculation, with BSD attribution. All 250 reference scores agreed with Python within 1e-12; their threshold decisions agreed too.
The tests also cover practical problems that a model demo can easily overlook: quoted CSV fields, timezone offsets, invalid values, input limits, literal rendering of untrusted text and formula-safe report cells.
There are 46 passing automated tests: 27 engine/parser tests and 19 DOM-event integration tests. The latter exercise the actual application handlers, including file-reading success, failure and asynchronous races. They are not a complete browser simulation. A separate in-app browser pass used ordinary interface controls, a real local file chooser and a real report download. The downloaded 180-row report matched the engine's expected bytes.
Two failures shaped the final version. First, generated fixture timestamps contained microseconds while the initial parser accepted milliseconds. The fixture was normalized to seconds and the tests were rerun. Later, a delayed file-read rejection could revive an old error after clearing the screen or selecting a new file. The same request token now guards both successful and failed reads. Two regression tests failed before that fix and passed afterward.
Development, verification and this write-up were AI-led, with the account owner's authorization. The inference inside the application is the exported classical model. There is no hidden language-model API behind the page, and no human usability study is claimed.
A detector that shows its limits
On a separate 800-row synthetic quiet set, 14 records exceeded the threshold. Of the six deliberately changed demonstration rows, only three appeared in the top six scores. I kept that result rather than reshaping the example until every planted oddity won.
A rare combination can outrank a large change in one field. A fixed vocabulary knows nothing about a different organization. The training set's constant ok status cannot teach the forest how future errors behave.
These are anomaly scores, not probabilities or real-world accuracy. The notes are deterministic comparisons with the fictional baseline, not causal explanations or SHAP values. Ghost Logbook is an exploratory demonstration, not a security product.
Why Does Open Innovation Matter?
The trees, training distribution, scorer and reference predictions can all be inspected. A reader can change the synthetic baseline, rebuild the model and check which scores move. Disagreement becomes something to investigate rather than an explanation to accept on trust.
Local inference also removes an ongoing API dependency. The archive can keep working from its downloaded files even if this hosting service disappears. No closed API is inherently incapable of anomaly detection; the useful difference here is that this particular model's assumptions and computation remain available to its users.
Open code does not make the detector universally reliable. It makes its limitations easier to see and its behavior possible to reproduce.
The Spirit of It
The screen borrows an old terminal's restrained green ledger and amber traces. There are no jump scares, flashing effects or claims of a real haunting. Every name, date and event in the supplied examples is invented.
The unsettling moment is a row that the machine finds strange but cannot explain. The interface leaves that uncertainty intact. Sometimes an honest unanswered question fits a ghost story better than a confident answer.
Prize Categories
Overall category only. No partner technology category is claimed.
Top comments (0)