What if the most important activity on your computer is happening where you cannot see it?
Every Windows system has hundreds of processes running in the background, network connections opening and closing, and applications interacting with system resources. Most of this activity is legitimate. But sometimes, suspicious behaviour hides among ordinary operations.
I wanted to build something that could look deeper into that activity without depending on sending sensitive endpoint information to an external AI service.
That's how PHANTOM — The Ghost in Your System came to life.
I'm excited to share PHANTOM 9.0, my submission for the Hacktoberfest Open-Source AI Challenge Week 4: Ghost in the Machine.
What I Built
PHANTOM is a local-first, AI-assisted Windows endpoint security monitoring and investigation platform.
I interpreted Ghost in the Machine as the invisible activity happening inside our computers: processes, network connections, executable files and behaviours that users rarely get to see or understand.
PHANTOM brings that activity into one investigation workspace.
Its main capabilities include:
- Endpoint monitoring
Live Windows process monitoring.
Network connection visibility.
Process information and executable paths.
SHA-256 file integrity inspection and Windows Authenticode signature information.
- Behavioural detection
Local heuristic analysis of suspicious command-line patterns.
Process parent-child relationship analysis.
Suspicious executable location checks.
Evidence-based severity scoring.
MITRE ATT&CK technique references.
- Threat intelligence
Local IOC register for IP addresses, domains, SHA-256 hashes and process names.
Exact matching against supported endpoint telemetry.
Local match results with process context.
- Automated security operations
Background monitoring after the PHANTOM server starts.
Automatic behavioural monitoring every 90 seconds.
Local IOC scans every 300 seconds.
Persistent security alerts with timestamps and occurrence counts.
Alert acknowledgement and incident tracking.
- AI investigation
Local Qwen-powered security explanations.
Evidence correlation across alerts, incidents and security events.
Downloadable JSON and HTML investigation reports.
The important design decision is that PHANTOM does not automatically terminate processes, delete files or modify firewall rules. It collects evidence, explains what it observes and helps the user investigate.
A detection is an investigation lead, not automatically proof of malware.
Demo
Project repository:
https://github.com/YogeshReddydev/PHANTOM
The repository includes the application source code, setup instructions, architecture overview and actual application screenshots.
The dashboard runs locally at:
There is no public hosted endpoint because PHANTOM is designed to inspect local Windows telemetry, which I wanted to keep on the user's own machine.
Screenshots and walkthrough: See the PHANTOM in Action section in the GitHub README.
[Add your short screen-recorded demo video link here before publishing, if available.]
Code
GitHub repository:
https://github.com/YogeshReddydev/PHANTOM
The project is published under the MIT License.
The repository contains:
app/main.py — FastAPI application and API routes.
app/detection_engine.py — behavioural detection logic.
app/phantom7.py — local threat intelligence and incident management.
app/phantom8.py — automated monitoring and alert management.
app/phantom9.py — evidence correlation.
app/static/ — PHANTOM dashboard interface.
data/ — local threat indicator configuration.
How I Built It
The central idea was to make open-weight AI a meaningful part of the product rather than simply adding an AI chatbot to a dashboard.
The AI model: Qwen 2.5 3B
I used Qwen 2.5 3B through Ollama for local inference.
The model runs on the user's machine and receives a bounded context containing relevant PHANTOM investigation evidence.
This allows the AI analyst to:
Explain behavioural findings.
Summarise investigation evidence.
Identify relationships between alerts and incidents.
Suggest safe next investigation steps.
Technology stack
Python for endpoint monitoring and detection.
FastAPI for the backend and API endpoints.
psutil for process and network telemetry.
SQLite for local alert, incident and event storage.
Ollama and Qwen 2.5 3B for local AI inference.
HTML, CSS and JavaScript for the dashboard.
MITRE ATT&CK references for detection context.
I built PHANTOM iteratively, improving its endpoint visibility, detection logic, dashboard, IOC matching, incident management, automatic monitoring and AI investigation capabilities.
The interface design was also refined using principles inspired by Nutlope's Hallmark project, with credit provided in the repository.
The key architectural choice: endpoint collection, behavioural detection, local IOC matching and evidence storage do not depend on a cloud AI API. Local AI analysis is optional and requires the model to be installed.
Why Does Open Innovation Matter?
This is probably the most important part of PHANTOM.
Cybersecurity software often deals with extremely sensitive information: running processes, file locations, network connections, user activity and system behaviour.
I wanted to explore a different approach.
With an open-weight model and local inference, PHANTOM can analyse relevant security evidence without sending it to an external AI provider.
Open innovation gave me several advantages:
Privacy and control: The endpoint data and investigation records remain on the user's machine by default.
Model flexibility: The local model can be replaced or upgraded without rebuilding the entire application around a proprietary AI API.
Transparency: The detection rules are visible, and AI-generated explanations can be compared with the underlying evidence.
Accessibility: A small model such as Qwen 2.5 3B can run on a personal computer, including CPU-based systems, although response times depend on available hardware.
Independence: The main monitoring and detection functions can continue without an external AI service once the required software and model have been installed.
For me, open innovation is not simply about accessing a model for free. It is about having control over where the data goes, which model analyses it and how the system behaves.
The Spirit of It
The idea behind PHANTOM is simple:
Your computer is constantly doing things you never see.
A process starts. A connection opens. An application launches another process. A file gets accessed. Most of these actions are normal, but understanding the context matters.
I wanted to give those invisible operations a voice.
PHANTOM is my attempt to make the hidden activity inside a Windows system easier to observe, investigate and understand.
The AI is not there to create fear or declare everything malicious. It is there to help explain what happened, why it deserves attention and what should be checked next.
The ghost is not the AI. The ghost is the activity happening inside the machine that we usually never notice.
Prize Categories
I am submitting PHANTOM for the overall Hacktoberfest Open-Source AI Challenge Week 4: Ghost in the Machine consideration.
I am not selecting a partner prize category because PHANTOM does not currently integrate the listed partner technologies in a way that qualifies for those categories.
Acknowledgements
Qwen for the open-weight language model.
Ollama for local model execution.
FastAPI for the backend framework.
psutil for system monitoring.
MITRE ATT&CK for adversarial technique references.
Nutlope/Hallmark for design inspiration.
Thanks to the DEV and Hacktoberfest community for creating a challenge that encourages builders to explore open-source AI beyond conventional chatbot applications.
Project: PHANTOM 9.0
Repository: https://github.com/YogeshReddydev/PHANTOM
Theme: Ghost in the Machine
Model: Qwen 2.5 3B
Inference: Local through Ollama
Demo Video :https://youtu.be/donbr4cMFVs
Top comments (0)