Phantom Sensor Log — Local System Anomaly & Hardware Horror Generator

This is a submission for the Hacktoberfest Open-Source AI Challenge Week 4: Ghost in the Machine

What I Built

Phantom Sensor Log is a ghost that haunts your computer, and it never leaves your computer. It watches your machine's vital signs (CPU, memory, new processes, outbound network traffic), learns what "normal" feels like, and treats anything unusual as paranormal activity. When something stirs, a local open-weight model writes a short horror or Día de los Muertos tale about what your machine was doing while you weren't looking.

The theme has two sides, so I used both:

• Halloween: every anomaly becomes a haunting, rated Whisper, Poltergeist, or Banshee. Each card keeps its "Evidence" line, so the story is always tied to real numbers.
• Día de los Muertos: when a process that lived a while and used real memory dies, it gets a place on the Ofrenda 🌼, a small card with its lifespan, memory footprint, and a one-line epitaph. Even your forgotten background processes get remembered.

There's also a Dawn Report, a morning summary of what haunted your machine overnight.

Demo

Setup is about five commands: install Ollama, pull a Gemma model, create a virtualenv, pip install -r requirements.txt, and run python app.py.

How I Built It

The whole pipeline is one small Python program:

psutil → anomaly detector → Gemma (via Ollama) → SQLite → Flask dashboard

• Gemma, running locally through Ollama, is the narrator. It writes the tales, the epitaphs, and the Dawn Report. I used gemma3:4b, and swapping models is a one-line change in config.py.
• TabPFN is the optional detector. It learns what CPU and network usage should look like given the other sensors and flags readings that don't fit. Its weights are gated on Hugging Face, so it needs a one-time free download, then runs offline.
• A robust z-score detector is the default, so the project works even if TabPFN isn't installed. If TabPFN fails to load, the app falls back automatically.
• Only anonymized facts go to the model, like sensor name, value, and "usually X." Gemma is told to use only those facts and never invent numbers.

Things I got wrong first (and fixed):

• My first version let the ghost haunt itself. Gemma writing a story uses CPU, which triggered the next anomaly, which triggered another story. The fix was a 10-minute cooldown, a daily cap, and one model call at a time.
• Narration originally ran inside the monitoring loop, so monitoring froze while the ghost was thinking. It now runs in background threads.
• The first dashboard scrolled forever. It now has tabs, fixed-height panels, expandable cards, and a featured "latest haunting."

Honest limits: this is a lightweight anomaly detector, not a research-grade one. Also, psutil can't give clean per-process network usage, so the "something is phoning home" story uses system-wide outbound traffic.

Why Does Open Innovation Matter?

A machine's telemetry is intimate. Process names, activity patterns, and network bursts describe what you do all day. This project only makes sense if that data stays with you.

• Privacy: the ghost lives on your machine. No process name or network spike ever goes to a third party.
• Offline: it keeps haunting with the Wi-Fi off. A cloud API would go silent exactly when you most want a local ghost.
• Cost: a monitor that runs 24/7 and writes stories would have a real API bill with a closed model. Here it costs nothing but electricity.
• Swappable: changing MODEL changes the ghost's brain, whether that's a bigger Gemma, a different open model, or a fine-tune later.

A closed API could write the stories, but it would mean sending your computer's secrets to someone else's server to hear a ghost story about them.

Prize Categories

• Gemma
• TabPFN