Yomi Triage System: Autonomous DFIR Engine

Autonomous DFIR engine for SIFT. Combines Ring-0 eBPF for sub-second containment with an air-gapped MCP Vault to physically block LLM hallucinations and preserve evidence integrity.

Comment

The 60-Second AI Problem (Why Yomi Was Created)

AI-powered adversaries (offensive AI) can breach and gain full domain control of a network in under 60 seconds. Meanwhile, a human incident responder is still busy looking up command-line flags in the documentation. We cannot fight machine-speed threats with human-speed responses.

KuroTech Yomi was created to directly obliterate this time gap. Built natively for the SANS SIFT Workstation, Yomi is an autonomous DFIR engine that merges Kernel-level (Ring-0) sensors with an isolated (air-gapped) Model Context Protocol (MCP). Yomi responds in 3 seconds, not 3 minutes.

What Yomi Does (Multi-Layer Architecture)

Yomi does not merely send prompts to an LLM. Yomi acts as a full EDR (Endpoint Detection and Response) solution:

  • Sub-Second Containment: An eBPF sensor monitors system call anomalies (openat, execve). When a critical threat is detected, Yomi autonomously freezes the target process (SIGSTOP) at microsecond speed, even before the LLM finishes thinking.
  • The Persistent Learning Loop: Yomi's agent evaluates the extraction outputs of forensic tools. If the AI experiences uncertainty (Epistemic Doubt > 40%), it will refuse to act, perform self-correction, and reroute its investigation path (Criterion 1).
  • The Omni-Library: Threat intelligence does not rely on LLM guesswork. Yomi matches anomalies in O(1) time against a local memory CVE database to ensure zero intelligence hallucination.

Architectural vs. Prompt-Based Matrix (Criterion 4)

We specifically designed Yomi to answer the SANS Judging evaluation challenges regarding security boundaries. We do not believe in using prompt engineering to secure an OS.

Threat / Issue Standard Prompt-Based EDR Yomi's Architectural Defense (Hardcoded)
LLM Hallucination Freezing the OS Prompt: "Never touch PID 1" Aegis VETO Harness: If the LLM targets a critical process, Yomi's Python logic gate absolutely blocks it (VETO_ENGAGED).
Context Window OOM Crash Prompt: "Please summarize this memory output" Vault Context Shield: A 4GB output from Volatility is physically truncated at the OS level to 100KB before touching the LLM context.
Infinite LLM Loop / Spiral Prompt: "Stop if it fails 3 times" Max-Iterations Cap: A deterministic cycle termination at the code level if iterations exceed the limit, triggering a forced fallback to the Shadow Net.

Honesty Over Perfection (Documented Failures)

In accordance with SANS guidelines, we prioritize absolute forensic honesty. During the testing phase, we documented the following system limitations and failures:

  1. Human Dossier Bias: Our final PDF report generator (weaver.py) carries a regex bias that frequently overlooks the cognitive psychological insights of the MINDREADER agent. However, we do not hide this. The true court-ready evidence is not that PDF, but rather our yomi_chain_of_custody.jsonl ledger sealed with HMAC-SHA256, which flawlessly preserves the entire AI execution and token trail.

  2. Plaso Resilience (Self-Correction): When encountering unsupported partitions, raw SIFT utilities occasionally throw spatial errors. The Yomi agent does not crash. It parses the failure message, discards the failed tactic, and searches for an alternative extraction path (Real proof of self-correction resilience).

  3. Volatility Extraction Failure (I/O & VMware Symlink Issues): During live testing using memory dumps in .raw or .001 format, Volatility failed to extract data due to symlink path issues and cross-OS shared folder mounting constraints from Windows to the VMware SIFT environment. Instead of triggering a kernel panic or crashing, the MCP Vault detected this file access error, prevented the LLM agent from hallucinating based on empty output, logged the tool failure into the ledger, and autonomously pivoted its investigation to the Shadow Net (eBPF) to keep the triage cycle running.

What I Learned (From Zero to Ring-0)

Entering this hackathon, I was actually just a 3-year vocational college (Diploma III/Associate Degree's) Applied Software Engineering student at the very end of my second semester, right in the middle of facing final exam week. I had absolutely zero background in professional cybersecurity, and I only discovered the existence of the SANS SIFT Workstation through this competition!

However, as a developer who is used to building things from scratch and utilizing AI as a pair-programming partner ("Vibe Coding"), the pressure of this competition forced me to learn at an exponential rate. Within a matter of weeks, I dove deep into the inner workings of the Linux OS at the lowest level with eBPF, understood how MCP can safely bridge AI reasoning with ancient C binaries, and dissected advanced forensic tool documentation. This hackathon was not just a competition; it was the most intensive digital forensics accelerator class I have ever experienced.

Next Steps for Yomi

  1. The Ephemeral Docker Bridge (Cross-OS): Expanding the OSBridge so that Yomi running on Windows/Mac can automatically spin up single-use SIFT Docker containers to process memory dumps, extract intel, and destroy the container without a trace.
  2. Dossier Cognitive Evolution: Rewriting the PDF generation engine to intelligently summarize suspicious LLM processes, rather than just printing repetitive iterations of swarm actions.
  3. Plaso & TSK Improvements: Strengthening the MCP parsers to handle file system edge-cases more deterministically for low-level disk searching tools.
  4. Interactive TUI (Zero-Delay): Upgrading the Terminal UI to make live real-time monitoring (with read-only forensic access) more interactive and fluid without compromising telemetry speed.

Built With

Share this project:

Updates