Algorithms and defensive security

TraceForge

A local-first SOC workbench whose shared Rust engine indexes events, explains query plans, detects temporal attack patterns, and explores identity, host, and IP relationships in native CLI and WebAssembly builds.

Role

Architecture, algorithms, Rust, WebAssembly, frontend, testing, and documentation

Year

2026

Status

Released v0.1.0 · public demo verified

Stack

Rust · WebAssembly · React · TypeScript

The problem

Log investigation tools often hide how results were obtained or require sending event data to a remote service. The project needed to make searching, temporal correlation, and entity traversal inspectable while keeping imported files entirely on the analyst's device.

My contribution

I designed the neutral event contract and monorepo, implemented the query language and its indexes, built the graph and detection algorithms, exposed the same engine through a native CLI and typed WebAssembly boundary, and created the bilingual investigation workbench and reproducible validation pipeline.

The solution

JSONL or CSV events are validated, fingerprinted, ordered, and indexed by a Rust core. A custom parser produces an AST that combines posting lists, prefix and temporal indexes, while the graph layer correlates users, hosts, and IPs. React consumes serializable WASM results and shows both findings and the execution plan used to obtain them.

Shared-engine architecture

The same deterministic domain logic drives the native CLI and browser workbench; only the input and presentation adapters change.

Ingestion

JSONL/CSV validation, stable fingerprints, ordering, and duplicate reporting

Search engine

Lexer, parser, AST, posting lists, prefix trie, and temporal index

Correlation

Adjacency graph, Union-Find, BFS, indexed-heap Dijkstra, and temporal rules

CLI and WASM

Native commands and a typed, serializable boundary for the React workbench

Key decisions

The parser, posting-list operations, prefix trie, Union-Find, and indexed priority queue are implemented explicitly instead of delegated to search or graph libraries.
Every indexed query is testable against a linear reference scan, keeping optimisation separate from query semantics.
The browser build has no backend: imported files remain local and the same Rust rules compile to WebAssembly.
Benchmark datasets and seeds are fixed, and results are reported as observations from one documented machine rather than universal performance claims.

Privacy and defensive controls

Included datasets are deterministic and synthetic; they contain no real people, credentials, cards, or customer identifiers.
The web build enforces limits of 50 MB or 100,000 events and performs parsing, indexing, and detection inside the browser.
The production site uses a restrictive Content Security Policy and requires no account, analytics, cookies, or telemetry.
Detections are deterministic and explainable: brute force, password spraying, failure-then-success, and lateral movement.

Validation

GitHub CI passes Rust formatting, Clippy, 13 core tests, dependency audit, WASM compilation, ESLint, Vitest, production build, and eight Playwright journeys.
Property-based fixtures compare indexed results with a linear scan, including parser precedence, malformed input, duplicates, disconnected graphs, and route ties.
On the documented Windows test machine, the fixed indexed query measured 12.93×, 15.78×, 10.44×, and 244.16× faster than the linear reference at 1k, 10k, 100k, and 1M events respectively.
The public Vercel build was exercised with live queries, ES/EN persistence, WebAssembly loading, and a successful offline reload after resource caching.

Public evidence

Source, methodology, raw results, synthetic fixtures, cross-platform binaries, and the live local-only workbench are publicly reviewable.

TraceForge Open workbench

Next case studySEPE SOAP ↔ Moodle Connector

Discuss this work Download résumé