Ghost Trace: Local-First Digital Forensics Haunted by Open-Weight AI

#devchallenge #hf26challenge #opensource #security

This is a submission for the Hacktoberfest Open-Source AI Challenge Week 4: Ghost in the Machine

The Spark: What is the "Ghost in the Machine"?

When I saw this week's Hacktoberfest theme—Ghost in the Machine, spanning Halloween and Día de los Muertos—I didn't want to just make another toy chatbot with purple CSS and a pumpkin icon. I wanted to build something where the ghost metaphor was real, practical, and rooted in a genuine engineering problem.

In digital forensics and incident response (DFIR), investigating a compromised server is literally hunting for ghosts. An attacker breaks into a machine, moves around, and disappears, leaving behind only forgotten digital traces: six failed logins on an internal service account, a sudden privilege leap, and a database dump accessed at 2 AM.

Security teams call these forensic artifacts; in my head, they are the lingering spirits of past system events.

That led me to build GhostTrace
: a local-first digital forensics workbench with a Día de los Muertos and Halloween atmosphere. It ingests system logs, detects attacks through deterministic rules, correlates "echoes" across past events, and uses a local open-weight model to explain the evidence without leaking data or hallucinating facts.

Why Open-Source AI Matters for Forensics

Before talking about features, this is the core reason GhostTrace exists: you cannot send breach logs to cloud LLMs.

When a server gets breached, log files contain:

Internal corporate IP addresses and network topologies.
Compromised employee usernames and service account names.
Internal database paths, API endpoints, and configuration secrets.
In many cases, plaintext passwords typed into username fields by mistake.

Copy-pasting those logs into ChatGPT or a cloud API is a massive compliance violation and an active security risk. If you are investigating a leak, you cannot risk leaking the investigation itself.

Furthermore, real incident response often happens on an air-gapped machine with the network cable pulled or Wi-Fi disabled to contain an attack.

By running open-weight models (Llama 3.2 3B and Gemma 3 4B) locally through Ollama:

Zero Data Exfiltration: The logs stay in memory on 127.0.0.1. Nothing touches the cloud.
Works With No Internet: Incident responders can analyze systems in an isolated SCIF or offline disaster zone.
Zero Token Costs: Ingesting 100 MB (over 150,000 log events) costs exactly $0.00.
Model Swappability: Users aren't locked into one vendor's pricing or availability. If you prefer Google's Gemma or Meta's Llama, you just pick it in the settings drawer.
What GhostTrace Does

Here is a walkthrough of what I built:

Ingestion and Raw File Inspection

GhostTrace accepts standard .json and .jsonl system logs (tested up to 100 MB and 200,000 records).

To make it beginner-friendly, I bundled 5 synthetic cases (brute-force bursts, routine noise, ambiguous traces, malformed records, and prompt injection attacks). On the landing page, users can click "View File" to preview line-numbered raw log records or download the .jsonl directly to see the required schema before uploading their own traces.

GhostTrace Case Cards with Raw File Preview and Download

Raw File Inspection Modal with line numbers and copy button

The 3D Séance Hall and Graveyard Timeline

I wanted the interface to honor the theme without sacrificing readability:

Séance Hall: A 3D WebGL scene rendered with Three.js featuring glowing candlelight, falling cempasúchil (marigold) petals, floating spirit wisps, and an automatic Día de los Muertos ofrenda altar (active around Oct 31 / Nov 1-2).
The Graveyard Timeline: Every log event is plotted as a digital tombstone. You can filter by severity, event type, or echo group, and click any record to inspect the untouched, raw payload in the Evidence Drawer.

GhostTrace 3D Seance Hall WebGL Scene

Procedural 3D Audio and The Speed Ghost

Instead of loading bulky audio files, I wrote a procedural audio synthesizer from scratch using the Web Audio API:

3D Binaural Doppler Panning: When whispers trigger, the sound sweeps from your left ear to your right ear in exact sync with a flying ghost dashing across the screen.
The "Haaaawwwww..." Whisper: Uses parallel vocal formant filters (850Hz open throat gliding to 470Hz rounded lips) followed by an eerie, tremoring banshee cry.
Respecting User Preferences: I added a toggle in Settings (Visuals & Apparitions) so anyone who finds the flying ghost distracting can turn it off with one click, while keeping the audio or running in silent mode.

Visuals and Apparitions toggle in Settings

Deterministic Findings with Citation-Checked AI

One of my pet peeves with "AI for security" tools is hallucination. An AI that invents fake IP addresses or accuses innocent accounts is worse than useless.

GhostTrace solves this with a two-layer architecture:

Layer 1 (The Law): 4 deterministic rules (GT-001 Brute Force, GT-002 Privileged Access, GT-003 Sensitive File Read, GT-004 Off-Hours Spikes) run mathematically against the data.
Layer 2 (The Ghost Investigator): The local open-weight model (llama3.2:3b or gemma3:4b) writes a dossier explaining why the attack happened.
The Citation Guardrail: Every explanation is verified against the case data. If the model hallucinates an event ID (EV-xxxxxx), a fake IP, or an unknown timestamp, GhostTrace automatically flags and strips it. If the evidence is insufficient, a hard sufficiency gate prevents the model from fabricating conclusions.

GhostAI Assistant ("Echo")

In the bottom-right corner sits Echo, a floating ghost avatar with a speech bubble saying "Come close to me...". Clicking Echo opens an in-app chatbot that explains how GhostTrace works, breaks down detection rules, guides you on what log formats to upload, or summons audio cues. It runs on local Ollama with an instant fallback knowledge base if the model is asleep.

Preview unavailable

Hard Problems and Real Trade-offs

A few things that were surprisingly tricky during development:

Procedural Whisper vs. Metallic Ringing: Initially, filtering white noise with high resonance (Q > 4) made the whisper sound like a high-pitched metallic whistle. I had to rebuild the vocal tract using wide bandpass formants (Q between 1.6 and 2.4) and a 5.2Hz tremolo LFO to get an organic, airy "Haaaawwwww" breath.
Handling 100 MB Uploads In-Memory: I didn't want GhostTrace writing temporary files to disk because forensic evidence shouldn't leave residual traces on the host. Streaming chunks into a bytearray in FastAPI and parsing line-by-line in memory keeps it fast while maintaining a zero-footprint guarantee.
Exorcism (Instant Purge): Clicking "Exorcise Case" triggers a deep memory wipe that clears all parsed events, findings, and timeline rows from RAM, returning the app to an unburdened clean state.
Development Journey and Agent Session

I built and iterated GhostTrace with pair-programming assistance from an agent. You can inspect the actual session transcript, thoughts, and technical iterations below:

Building GhostTrace: Local-First DFIR & Haunted Open-Source AI Workbench

You

Let's build and refine GhostTrace for Hacktoberfest Week 4: Ghost in the Machine, featuring local open-source AI (Ollama with llama3.2:3b and gemma3:4b), procedural 3D spatial horror audio, and local digital forensics.

Agent

Implemented procedural Doppler horror audio with vocal formant whisper and banshee screams in Web Audio API, built the local GhostAI chatbot assistant with Ollama llama3.2:3b, expanded upload limit to 100MB, added per-case raw file inspection/download modals, and added a visual settings toggle for the flying ghost apparition. Tested locally on RTX 3050 GPU with 60 FPS locked.

How to Run It Locally

GhostTrace is completely open source under the MIT license.

bash