CyberTrace AI

• 

  CyberTrace AI

Inspiration

I've always been interested in cybersecurity and how security analysts investigate cyber incidents. During my learning journey, I realized that analysts often have to manually examine Windows logs, firewall logs, network traffic, and email evidence before understanding what actually happened.

That process is time-consuming and can delay incident response when every minute matters. This inspired me to build CyberTrace AI, a platform that automatically correlates forensic evidence, reconstructs attack timelines, and generates actionable response recommendations, allowing analysts to focus on responding to threats instead of manually piecing together evidence.

What it does

CyberTrace AI is an AI-powered cyber investigation platform that transforms fragmented forensic evidence into a complete, explainable cyber investigation.

The platform allows analysts to upload multiple evidence sources, including Windows logs, firewall logs, network traffic, and email evidence. It automatically correlates events across those sources, detects suspicious behaviors, reconstructs the attack timeline, calculates threat severity and confidence, maps attacker behavior to the MITRE ATT&CK framework, and generates prioritized remediation recommendations.

Rather than simply detecting threats, CyberTrace AI explains how the attack unfolded and provides analysts with the context needed to respond quickly and effectively.

How we built it

CyberTrace AI was built as a full-stack web application using Next.js, React, TypeScript, and Tailwind CSS for the frontend, and FastAPI with Python for the backend. The backend performs multi-source evidence correlation, threat detection, dynamic threat scoring, confidence calculation, MITRE ATT&CK mapping, attack timeline reconstruction, and recommendation generation.

Throughout development, GPT-5.6 through Codex was used as an AI software engineering assistant to design the application architecture, implement frontend and backend components, improve the investigation workflow, debug issues, and accelerate development while ensuring the investigation engine itself operates locally during runtime.

Challenges we ran into

One of the biggest challenges was designing a realistic investigation workflow that correlated multiple evidence sources into a single, easy-to-understand investigation. We also worked on seamlessly integrating the frontend and backend so the dashboard always reflected the uploaded evidence instead of static results.

Accomplishments that we're proud of

Some of the accomplishments I'm most proud of include:

• Multi-source forensic evidence correlation
• Dynamic threat severity and confidence scoring
• MITRE ATT&CK technique mapping
• Interactive attack timeline reconstruction
• AI-generated response and remediation recommendations
• A professional SOC-inspired investigation interface
• A full-stack architecture built with Next.js, React, FastAPI, and Python
• Seamless frontend and backend integration with real-time investigation results

What we learned

I learned how cybersecurity investigations are performed, how different evidence sources complement one another, how the MITRE ATT&CK framework helps standardize attacker behavior, and how AI can assist analysts by explaining investigations rather than simply detecting threats.

I also gained valuable experience using GPT-5.6 through Codex as a development assistant to accelerate software development, improve code quality, and iterate on both the user experience and backend investigation engine.

What's next for CyberTrace AI

Future improvements include support for additional forensic formats such as EVTX, PCAP, and EML, advanced threat detection for web application attacks, real-time log ingestion, threat intelligence integration, cloud deployment, and support for larger enterprise investigation workflows.

Our long-term goal is to evolve CyberTrace AI into a comprehensive AI-assisted cyber investigation platform capable of supporting real-world incident response teams.

Built With

• codex
• css
• fastapi
• gpt-5.6
• next.js
• python
• react
• render
• tailwind
• typescript
• vercel