Trace AI-Powered Digital Artifacts & IoC Collector for Rapid Incident Response
Trace는 침해 사고 발생 시 시스템에 남겨진 공격자의 흔적(Digital Artifacts)을 신속하게 수집하고, LLM을 활용해 위협 수준을 분석하는 초동 대응(Incident Response) 도구입니다.
Key Features
- Multi-OS Artifact Collection Windows: Registry Run keys, Scheduled Tasks, Network Connections, Process Trees 수집
Linux & macOS: Crontab, Systemd/Launchd, Volatile Network/Process data 추출
- Smart Detection Logic Suspicious Path Analysis: /tmp, /dev/shm, Temp 등 비정상적인 경로에서 실행되는 프로세스 식별
Persistence Monitoring: 최근 7일 이내에 수정된 지속성 유지 메커니즘 탐지
- Trace-Analyzer (AI Analysis) GPT-4 Based Analysis: 수집된 JSON 리포트를 요약하여 핵심 브리핑 제공
Response Priority: 탐지된 위협에 따른 보안 담당자의 대응 우선순위 제안
Project Structure Plaintext Trace/ ├── main.py # Entry point (Privilege check & OS Detection) ├── core/ # Core Logic (Collector, Analyzer, Reporter) ├── modules/ # OS-specific scripts (Windows/Linux) └── reports/ # Result storage (Excluded by .gitignore) Quick Start Installation Bash git clone https://github.com/paperbit7/Trace.git cd Trace python3 -m venv .venv source .venv/bin/activate # Windows: .venv\Scripts\activate pip install -r requirements.txt Usage Bash
sudo python3 main.py
export OPENAI_API_KEY='your-api-key-here' sudo python3 main.py Technical Stack Language: Python 3.x
Core Libraries: psutil, openai, json, subprocess
Domain: Digital Forensics, Incident Response (DFIR), AI Security
Author Yoon Hyun-woo (paperbit7)
Information Security Researcher
Awarded by Ministry of Education (Vulnerability Reporting)
KVE-2025-2794 Issuer
License This project is licensed under the MIT License.