TraceLock™ — Multi-Domain RF Threat Detection Platform¶

Patent Pending · WGU BSCIA Capstone · February 2026

View on GitHub

The Problem¶

Executive protection and security teams face a critical gap: 12-18 minutes of RF blind spots during sweep operations. Existing tools monitor single domains (Wi-Fi OR Bluetooth OR SDR) without correlation, missing sophisticated threats that hop frequencies or use multiple channels.

Attack scenarios addressed:

• Rogue Wi-Fi access points for credential harvesting
• Bluetooth tracking devices (AirTags, Tiles, custom beacons)
• ISM-band triggers for remote activation
• GPS spoofing and jamming detection
• Unauthorized drone surveillance (ADS-B correlation)

Use Cases & Transferable Skills¶

TraceLock™ addresses 25+ documented scenarios — from border security to disaster response. The same detection logic applies to any domain requiring multi-sensor correlation.

What I Built Beyond the Original¶

TraceLock™ is a security-hardened fork of CYT (Chasing Your Tail). Here's what I added:

What I Built¶

Hardware Platform (Field-Deployable Rapid Response Kit)¶

Physical System Architecture¶

flowchart TB
    subgraph POWER["POWER AND CONNECTIVITY"]
        PWR["USB-C PD Power Supply"]
        ETH["Ethernet/LTE Backhaul"]
    end

    subgraph COMPUTE["COMPUTE CORE"]
        PI["Raspberry Pi 4B 8GB RAM Debian/Kismet"]
        DSP["7in IPS Touchscreen Field Interface"]
    end

    subgraph RF_SENSORS["RF SENSOR ARRAY"]
        direction TB
        subgraph WIFI["Wi-Fi Domain"]
            PANDA["Panda PAU09 2.4/5GHz Monitor"]
        end
        subgraph BLE["Bluetooth Domain"]
            BT1["StarTech BT5.3 Long-Range"]
            BT2["ASUS BT500 Dense Env"]
            UBT["Ubertooth One Protocol Analysis"]
        end
        subgraph SDR["SDR Domain"]
            RTL["RTL-SDR V4 ISM + ADS-B"]
            HRF["HackRF One 1MHz-6GHz"]
        end
        subgraph NAV["Navigation"]
            GPS["SIM7600G HAT GNSS + LTE"]
        end
    end

    subgraph OUTPUT["OUTPUT CHANNELS"]
        direction LR
        LOG["JSON Logs Forensic Grade"]
        KML["KML Export Google Earth"]
        MQTT["MQTT Alerts Real-time"]
        RPT["HTML Reports Evidence Pack"]
    end

    PWR --> PI
    ETH --> PI
    PI --> DSP
    PANDA --> PI
    BT1 --> PI
    BT2 --> PI
    UBT --> PI
    RTL --> PI
    HRF --> PI
    GPS --> PI
    PI --> LOG
    PI --> KML
    PI --> MQTT
    PI --> RPT

    style POWER fill:#fef3c7,stroke:#d97706,stroke-width:2px
    style COMPUTE fill:#dbeafe,stroke:#2563eb,stroke-width:2px
    style RF_SENSORS fill:#dcfce7,stroke:#16a34a,stroke-width:2px
    style OUTPUT fill:#f3e8ff,stroke:#9333ea,stroke-width:2px

8-component RF sensor array with centralized processing and multi-channel output — demonstrates hardware integration and systems engineering

Software Architecture¶

Codebase: 25 Python modules, 81 shell scripts, ~12,500 LOC, GitHub Actions CI

flowchart LR
    subgraph CORE["TRACELOCK CORE"]
        direction LR
        subgraph S["SENSORS"]
            S1["Kismet Wi-Fi"]
            S2["rtl_433 ISM"]
            S3["Bluetooth"]
            S4["gpsd GPS"]
            S5["dump1090 ADSB"]
            S6["HackRF SDR"]
        end
        subgraph D["DETECTION ENGINE"]
            D1["Rule Matching"]
            D2["Threshold Tuning"]
            D3["Correlation"]
            D4["Allowlisting"]
            D5["Persistence Scoring"]
        end
        subgraph O["OUTPUT"]
            O1["JSON Logs"]
            O2["Markdown Reports"]
            O3["KML Maps"]
            O4["MQTT Alerts"]
            O5["HTML Reports"]
        end
    end

    style CORE fill:#f8fafc,stroke:#334155,stroke-width:2px
    style S fill:#e8f4ea,stroke:#2e7d32,stroke-width:2px
    style D fill:#e0f2fe,stroke:#0284c7,stroke-width:2px
    style O fill:#fef3c7,stroke:#d97706,stroke-width:2px

Python Module Breakdown¶

Top 10 of 25 Python modules — 6,251 LOC shown, ~8,200 total Python LOC

Security Modules (Hardened)¶

6 security modules — 1,469 LOC of hardened code

Detection Engineering Highlights¶

1. Multi-Domain Correlation¶

TraceLock™ correlates signals across domains to identify sophisticated threats:

# Simplified correlation example
def correlate_threat(wifi_event, bt_event, gps_fix):
    """
    Correlate Wi-Fi probe + BLE beacon at same location
    within 30-second window = potential tracking device
    """
    if (wifi_event.timestamp - bt_event.timestamp) < 30:
        if haversine(wifi_event.location, gps_fix) < 50:  # meters
            return ThreatAlert(
                severity="HIGH",
                type="TRACKING_DEVICE",
                evidence=[wifi_event, bt_event, gps_fix]
            )

2. Detection Rules with Tunable Thresholds¶

3. Security Hardening¶

• SQL Injection Prevention: Parameterized queries for all database operations
• Credential Protection: Encrypted storage with secure key derivation
• Input Validation: Strict type checking on all sensor inputs
• Audit Logging: Immutable event logs with cryptographic checksums
• Mode Controller: Role-based capture profiles (lab/demo/field)

Results & Metrics¶

Evidence Artifacts¶

Architecture Diagram¶

flowchart TB
    subgraph SENSORS["SENSOR LAYER"]
        direction LR
        W["Wi-Fi Kismet"]
        B["Bluetooth Ubertooth"]
        S["SDR rtl_433"]
        G["GPS Module"]
    end

    subgraph PROCESSING["PROCESSING LAYER"]
        direction TB
        N["Normalization Layer"]
        C["Correlation Engine"]
        R["Detection Rules + Allowlists"]
    end

    subgraph OUTPUT["OUTPUT LAYER"]
        direction LR
        J["JSON Logs Forensic"]
        K["KML Export Mapping"]
        M["MQTT Alerts Real-time"]
    end

    W --> N
    B --> N
    S --> N
    G --> N
    N --> C
    R --> C
    C --> J
    C --> K
    C --> M

    style SENSORS fill:#e8f4ea,stroke:#2e7d32,stroke-width:2px
    style PROCESSING fill:#e0f2fe,stroke:#0284c7,stroke-width:2px
    style OUTPUT fill:#fef3c7,stroke:#d97706,stroke-width:2px

Multi-domain sensor integration with correlation engine

Sample Detection Output¶

{
  "timestamp": "2025-12-14T14:32:07Z",
  "alert_type": "ROGUE_AP_DETECTED",
  "severity": "HIGH",
  "details": {
    "ssid": "CorpWiFi-Guest",
    "bssid": "AA:BB:CC:DD:EE:FF",
    "channel": 6,
    "signal_strength": -45,
    "reason": "BSSID not in allowlist, SSID mimics known network"
  },
  "location": {
    "lat": "[REDACTED]",
    "lon": "[REDACTED]",
    "accuracy_m": 3.2
  },
  "correlation_id": "TL-2025-1214-0847"
}

KML Visualization¶

Threat locations mapped with temporal correlation — screenshots available on request

Compliance & Ethics¶

Technical Skills Demonstrated¶

Detection Engineering¶

• Custom detection rule development
• Threshold tuning and optimization
• False positive analysis and mitigation
• Multi-source correlation logic
• Alert severity classification

Security Automation¶

• Python automation pipelines
• Real-time data processing
• Structured logging (JSON, Markdown)
• CI/CD with GitHub Actions
• Database operations (SQLite)

RF/Wireless Security¶

• Wi-Fi monitoring and analysis
• Bluetooth/BLE enumeration
• SDR signal processing
• GPS correlation
• ADS-B decoding

Security Hardening¶

• Secure coding practices
• Credential encryption
• Input validation
• Audit trail design

Project Status¶

Expected Graduation: February 2026 (BSCIA Capstone)

What This Proves¶

1. I can build detection systems — Not just use them, but architect and implement custom detection logic
2. I understand multi-domain correlation — The same thinking applies to SIEM correlation rules
3. I write secure code — Parameterized queries, encrypted credentials, input validation
4. I document for auditors — Evidence-grade logging with reproducible results
5. I ship working systems — Hardware + software integration, not just theory

Related Projects¶

• Homelab Infrastructure — The lab where TraceLock™ was developed
• Remote Access & Zero-WAN — Secure architecture for remote development
• GIAP™ — GRC automation platform using similar pipeline patterns

GitHub Repository Connect on LinkedIn Contact Me

¶