-
-
landing
-
investigating
JunctionTrace: Investigate Before You Contain
Inspiration
Not every traffic surge is a cyberattack.
In intelligent transportation systems, a sudden increase in network traffic can resemble a denial-of-service attack. However, similar patterns may occur during rush-hour congestion, major events, or temporary changes in roadside infrastructure.
A traditional detection system may identify an anomaly and immediately recommend blocking or rate-limiting traffic. But what if the suspicious traffic is legitimate? Acting too quickly could disrupt essential transportation services.
This inspired JunctionTrace, an AI-powered investigation assistant for Intelligent Transportation System (ITS) operators and Security Operations Center (SOC) analysts.
Our central question was simple:
Can an AI agent investigate the evidence before recommending a potentially disruptive security action?
What It Does
JunctionTrace helps operators investigate suspicious network activity using NVIDIA Nemotron through Nebius Token Factory.
Instead of making a decision from a single anomaly label, the system performs a multi-step investigation:
- Detect the concern: Receive an incident involving suspicious network activity.
- Identify uncertainty: Determine which evidence is missing or contradictory.
- Select investigation tools: Use Nemotron to choose relevant tools for network telemetry, physical-context metadata, temporal comparisons, and evidence-quality checks.
- Evaluate the evidence: Combine returned observations and produce an explanation.
- Apply a deterministic safety gate: Validate whether the recommendation is supported by sufficient evidence.
- Assist the operator: Recommend actions such as observing, preserving service, or considering limited containment.
The application includes four representative incident scenarios covering legitimate congestion, suspicious activity, stale evidence, and contradictory signals.
Operators can compare a traditional rule-only recommendation with an evidence-aware investigation.
JunctionTrace offers two clearly labeled execution modes:
- Safe Offline: A deterministic investigation planner for reproducible demonstrations.
- Real Nebius: A live NVIDIA Nemotron investigation using Nebius Token Factory inference.
The offline mode is never presented as live AI inference.
How We Built It
JunctionTrace combines a Python/Flask backend, an interactive web interface, a multi-step investigation agent, and a deterministic policy layer.
We integrated NVIDIA Nemotron 3 Nano 30B-A3B through the OpenAI-compatible Nebius Token Factory API.
Nemotron participates in selecting investigation tools and generating structured conclusions. Available tools include network telemetry retrieval, synthetic camera-context inspection, evidence-quality assessment, temporal comparison, and contradiction detection.
The application validates structured outputs against an expected schema before using them. Missing or unreliable information can trigger fallback behavior instead of an unsupported high-confidence decision.
We also implemented:
- A dedicated operator-facing JunctionTrace interface.
- Side-by-side rule-only and investigation comparisons.
- Auditable investigation traces and evidence provenance.
- Input validation and structured-response repair.
- Token-protected judge access.
- Application-level rate, concurrency, and spending controls.
- A Docker-based deployment package with Caddy HTTPS support.
The system builds on an earlier SDN-ITS cybersecurity research prototype. During this hackathon, we developed the new Nebius integration, Nemotron investigation agent, operator interface, safety controls, evaluation scenarios, and judge-ready deployment workflow.
Challenges We Faced
1. Avoiding unnecessary containment
An anomaly score does not explain why traffic increased. We needed an investigation workflow that considers context before recommending potentially disruptive actions.
2. Making LLM output reliable
An AI model can return malformed JSON, incomplete tool arguments, or unsupported conclusions. We added schema validation, bounded repair attempts, explicit fallback behavior, and a deterministic policy gate.
3. Balancing reasoning quality, latency, and cost
A multi-step investigation requires multiple model interactions. We selected Nemotron Nano to balance useful structured reasoning with practical API cost and latency.
4. Separating real evidence from simulation
Our current competition demonstration uses synthetic physical-context metadata and a mock OpenFlow backend. We explicitly distinguish these from real camera feeds and production traffic-switch control.
Accomplishments
We built a functioning end-to-end investigation workflow that integrates real Nebius Token Factory inference with an operator-facing application.
In our small blind live evaluation, Nemotron produced 3 correct outcomes out of 4 cases against a scenario-defined reference, with approximately 17.2 seconds mean investigation latency. This is exploratory evidence, not a claim of real-world cybersecurity detection accuracy.
A separate offline deterministic-planner evaluation produced approximately 92% agreement on 25 synthetic cases. This figure is not a Nemotron accuracy measurement.
Most importantly, JunctionTrace demonstrates how an AI-driven investigation can lead to a different recommendation than a rule-only response when additional physical-context evidence matters.
What We Learned
We learned that the most valuable part of an agent is not necessarily its ability to act autonomously. It is its ability to identify missing evidence, choose the next useful investigation step, and recognize when an action requires stronger justification.
NVIDIA Nemotron on Nebius Token Factory made it possible to experiment with structured, multi-step investigation without deploying and maintaining our own inference infrastructure.
We also learned that deterministic safeguards remain essential around AI-generated recommendations.
What's Next
Our next steps are to evaluate JunctionTrace against larger independent incident datasets, integrate validated real-world camera and network telemetry, and investigate deployment alongside production ITS monitoring systems.
Real OpenFlow control would require separate hardware-in-the-loop testing, operator authorization, and safety validation.
JunctionTrace is currently an advisory research prototype, not an autonomous production traffic controller.
Our long-term vision is an AI-assisted security system that asks the right questions before taking the wrong action.
Log in or sign up for Devpost to join the conversation.