This is a submission for the Hacktoberfest Open-Source AI Challenge Week 2: Side Hustle
What I Built
Modern cybersecurity threats are evolving rapidly, but advanced security monitoring and Endpoint Detection and Response (EDR) solutions can be expensive and complex for independent DevOps engineers, freelancers, and small infrastructure teams. Traditional signature-based detection can also struggle with previously unseen threats for which no known signature exists.
ZeroTrace is an AI-assisted, local-first cybersecurity incident triage copilot designed to help developers and infrastructure teams investigate suspicious runtime behavior while keeping sensitive telemetry under their control.
Instead of relying entirely on external AI APIs, ZeroTrace uses a locally hosted open-weight language model to assist with incident analysis, risk assessment, and investigation workflows.
The goal is simple: make intelligent security triage more accessible, privacy-conscious, and affordable for smaller teams.
Key Features
- Behavioral Threat Analysis: Analyze suspicious execution patterns, process relationships, command-line activity, and network connection metadata to help identify potentially malicious behavior.
- AI-Assisted Incident Triage: Turn technical security signals into structured incident summaries, severity assessments, and investigation recommendations.
- SOC Dashboard: Present security events, risk scores, severity levels, and investigation details through a modern dashboard.
- Simulated Incident Response: Demonstrate suspicious activity and containment workflows in a controlled environment without risking production infrastructure.
- Incident Report Generation: Create structured Markdown post-mortems that can be adapted for GitHub Issues, Jira, Linear, and internal security documentation.
- Local-First AI Inference: Use Ollama and a compatible open-weight model to reduce dependence on third-party inference APIs.
- Self-Hosted Deployment: Use containerized deployment workflows where supported by the project configuration.
ZeroTrace is designed to support behavioral investigation, not to guarantee the detection of every zero-day vulnerability or attack. Its risk scores are triage indicators that should be evaluated alongside supporting evidence.
Who Would Pay For It?
ZeroTrace is designed around the needs of users who require practical security visibility without the complexity and cost of a large enterprise security stack.
Potential customers include:
- Independent DevOps Engineers: Freelancers managing multiple VPS instances who need better visibility into suspicious processes and network activity.
- Boutique MSPs: Small managed service providers looking for self-hosted security investigation tools for client infrastructure.
- Small Businesses and Startups: Teams that need an affordable way to investigate security alerts while maintaining greater control over their data.
- Security Consultants: Professionals who want to provide AI-assisted incident triage as part of a broader managed security service.
The Side-Hustle Opportunity
ZeroTrace could support several monetization models:
- Per-server subscriptions for managed deployments.
- Paid installation, configuration, and maintenance.
- Managed incident triage for small businesses.
- Custom integrations with alerting and monitoring platforms.
For example, a freelancer could explore a proposed $29–$49 per-server monthly package or offer a managed security service with customized pricing.
These figures are illustrative business hypotheses, not validated market demand. Actual pricing would depend on infrastructure costs, support requirements, features, and customer feedback.
Demo
ZeroTrace is intended to demonstrate how local AI can support a practical security investigation workflow through a dedicated SOC dashboard.
Example Workflow
- Generate Security Telemetry: Introduce controlled suspicious-behavior scenarios, such as an unusual child process originating from a Node.js application.
- Analyze the Event: Examine available process and network metadata for suspicious execution patterns.
- Review the Risk Assessment: Display the incident's risk score, severity classification, supporting evidence, and AI-generated explanation where implemented.
- Investigate the Incident: Review the available event details and relevant attack techniques.
- Simulate Containment: Demonstrate the containment workflow in a controlled test environment.
- Generate a Post-Mortem: Export the incident details into a Markdown report where supported.
The objective is to make security investigation easier to understand, review, and document without requiring every user to operate a complex enterprise SOC platform.
Demo resources
- GitHub Repository: https://github.com/Scafo745/Zero-Day
- Live Demo: https://zero-day-olive.vercel.app
Code
The ZeroTrace project repository contains the source code
and implementation details for exploring the application and contributing to its development.
GitHub: https://github.com/Scafo745/Zero-Day
Scafo745
/
Zero-Day
This is a project to prevent and lowers the threats the zero day attacks ................
⚡ ZeroTrace
Autonomous Zero-Day Exploit Detection & Real-Time Forensic Analyst Engine
Powered by Local Air-Gapped Gemma 4, Server-Sent Events (SSE), and a Bauhaus Constructivist SOC Dashboard.
🌐 Live Deployments
| Component | Platform | URL | Health / Status |
|---|---|---|---|
| Frontend SOC Dashboard | Vercel | https://zero-day-olive.vercel.app | Production App Router (Next.js 15) |
| Backend Telemetry API | Render | https://zero-day-cj0b.onrender.com | /api/health |
📌 Executive Summary
Traditional Security Information and Event Management (SIEM) and Endpoint Detection and Response (EDR) platforms rely on static hashes and known CVE signatures. Consequently, zero-day exploits and novel supply-chain attacks bypass legacy defenses by definition.
ZeroTrace flips the paradigm from signature scanning to pure behavioral provenance reasoning. By ingesting raw kernel and process execution telemetry (process lineage, command flags, sensitive file reads, and outbound network socket operations), ZeroTrace utilizes a locally hosted, GPU-accelerated Gemma 4 model (zerotrace-analyst) to autonomously deduce adversary intent in real time without external cloud dependency.
🚀 Key Features
- 🛡️…
Developers can explore the repository, review the architecture, report bugs, suggest improvements, and contribute to making local-first security investigation more accessible.
How I Built It
ZeroTrace brings together modern web technologies, security telemetry workflows, and locally hosted AI to explore a privacy-conscious approach to incident investigation.
Open-Weight AI and Local Inference
The project uses a local-model architecture based on Ollama, allowing compatible open-weight models to run on the host machine rather than requiring an external inference API for every analysis request.
This approach can reduce recurring inference costs and limit the exposure of sensitive security telemetry to third-party AI providers.
Behavioral Analysis and Incident Triage
The core workflow focuses on turning technical events into information that an operator can investigate.
A conceptual pipeline looks like this:
Runtime Telemetry → Event Normalization → Behavioral Analysis → AI-Assisted Triage → Structured Incident → SOC Dashboard
The quality of each assessment depends on the telemetry available, the analysis logic, and the model's output. Any automated conclusions should remain reviewable by a human operator.
Frontend and Backend
The project is designed around a modern web application architecture.
- Frontend: Next.js, React, and Tailwind CSS for the dashboard interface, where implemented in the repository.
- Backend: Node.js and Express for application services and event processing, where implemented.
- Streaming: Server-Sent Events (SSE) for delivering live updates where configured.
- AI Orchestration: Ollama for local inference with a compatible open-weight model.
- Deployment: Docker and Docker Compose for reproducible deployment where supported.
The repository is the source of truth for the exact versions, available integrations, and completed implementation details.
Reliability and Safe Investigation
Security tooling must remain useful even when the AI component is unavailable.
A deterministic fallback strategy is a valuable design direction because it can preserve basic event handling when model inference fails. Similarly, containment actions should be protected by authorization, validation, audit logging, and safeguards against disrupting legitimate processes.
ZeroTrace's long-term goal is to combine useful AI-assisted explanations with transparent evidence and predictable incident-handling workflows.
Why Does Open Innovation Matter?
Open innovation is central to the ZeroTrace concept because security infrastructure requires control, adaptability, and careful handling of sensitive information.
1. Privacy and Data Sovereignty
Security telemetry can contain command-line arguments, internal IP addresses, file paths, process information, and other sensitive operational details.
A local-first architecture can reduce the need to transmit this information to external AI services. However, achieving a genuinely air-gapped deployment also requires controlling application networking, dependency downloads, model distribution, updates, and external integrations.
Local inference is a privacy advantage, not an automatic guarantee of regulatory compliance.
2. Sustainable Economics for Independent Developers
Per-request inference charges can become an additional operating expense for a security service that processes frequent events.
Using a locally hosted open-weight model can eliminate external API inference fees, although it still requires suitable hardware, electricity, storage, configuration, and maintenance.
For freelancers and small service providers, this creates an opportunity to experiment with security automation without making every analysis dependent on a paid external API.
3. Customization and Reduced Vendor Lock-In
Open-weight models and self-hosted components offer opportunities to customize analysis workflows, control model selection, and adapt integrations to specific infrastructure requirements.
They also provide greater flexibility when building tools for specialized cybersecurity workflows.
Model licenses, hardware requirements, security controls, and operational limitations still need to be evaluated before deployment.
4. Making Security Tooling More Accessible
Open-source development allows independent developers, students, infrastructure engineers, and security researchers to inspect implementations, suggest improvements, and contribute new capabilities.
ZeroTrace aims to explore how these collaborative advantages can make AI-assisted incident investigation more approachable for teams that cannot justify a complex enterprise security stack.
Early Validation and Next Steps
ZeroTrace is being developed around a practical question:
Can locally hosted AI make suspicious-event investigation more accessible to small infrastructure teams without unnecessarily exposing their operational data?
The next step is to validate this idea with independent DevOps engineers, sysadmins, and small managed service providers.
Important questions include:
- Which telemetry sources provide the most useful investigation context?
- How much explanation and supporting evidence does an operator need before trusting an AI-assisted assessment?
- Which deployment model is easiest to maintain across multiple client servers?
- Would users prefer a self-hosted subscription, installation service, or managed security package?
- Which alerting integrations would deliver the most immediate value?
Potential future improvements include Slack and PagerDuty webhook alerts, improved incident correlation, configurable risk thresholds, additional telemetry sources, and stronger deployment hardening.
These are future directions rather than claims that every integration is already available.
Feedback from real users will help determine which capabilities should be prioritized and whether the proposed business model solves a sufficiently valuable problem.
What's Next?
The next phase of ZeroTrace focuses on improving the usefulness, reliability, and accessibility of local-first security triage.
Potential areas of development include:
- More behavioral detection rules and investigation context.
- Better incident correlation and evidence presentation.
- Configurable alerting thresholds and webhook integrations.
- Improved containerized deployment and operational documentation.
- More extensive testing of local inference performance.
- Safer, auditable incident response workflows.
The long-term vision is to make AI-assisted security investigation more practical for independent infrastructure operators without treating an AI-generated verdict as a substitute for evidence or human judgment.
Prize Categories
Hacktoberfest Open-Source AI Challenge — Week 2: Side Hustle
ZeroTrace explores the intersection of open-source AI, cybersecurity, privacy-conscious infrastructure, and a potential sustainable business model for independent developers.
If you're interested in local AI, DevSecOps, threat detection, or open-source security tooling, check out the repository and share your feedback.
GitHub: https://github.com/Scafo745/Zero-Day
Let's make security investigation more accessible, transparent, and privacy-conscious. 🚀
Top comments (0)