TraceLock™ — Multi-Domain RF Threat Detection Platform¶

WGU BSCSIA Capstone · Degree Conferred March 2026

Role: Sole developer | Security-hardened fork | ~12,500 LOC (25 Python modules, 81 shell scripts) | 6 RF domains

View TraceLock Public Public Artifacts

Case summary¶

The Problem¶

Executive protection and security teams face a critical gap: 12-18 minutes of RF blind spots during sweep operations. Existing tools monitor single domains (Wi-Fi OR Bluetooth OR SDR) without correlation, missing sophisticated threats that hop frequencies or use multiple channels.

Attack scenarios addressed:

• Rogue Wi-Fi access points for credential harvesting
• Bluetooth tracking devices (AirTags, Tiles, custom beacons)
• ISM-band triggers for remote activation
• GPS spoofing and jamming detection
• Unauthorized drone surveillance (ADS-B correlation)

TraceLock vs. Traditional Wireless IDS¶

Use Cases & Transferable Skills¶

TraceLock™ addresses 25+ documented scenarios — from border security to disaster response. The same detection logic applies to any domain requiring multi-sensor correlation.

What I Built Beyond the Original¶

TraceLock™ is a security-hardened fork of CYT (Chasing Your Tail). Here's what I added:

What I Built¶

Hardware Platform (Field-Deployable Rapid Response Kit)¶

Physical System Architecture¶

8-component RF sensor array with centralized processing and multi-channel output — demonstrates hardware integration and systems engineering

Software Architecture¶

TraceLock's detection architecture depends on the Agentic Infrastructure layer for reproducibility: the same detection rules must produce consistent output on every deployment. Hook-driven context loading and canonical install standards — established by the Agentic Infrastructure Audit — ensure that the agents operating TraceLock sessions produce audit-comparable results across machines.

Codebase: 25 Python modules, 81 shell scripts, ~12,500 LOC, GitHub Actions CI

Software architecture diagram withheld — the system processes data from 6 sensor domains through a detection engine to multiple output formats including structured logs, geospatial exports, and real-time alerts.

Python Modules¶

25 Python modules covering GPS tracking, persistence detection, RF analysis, BLE enumeration, ISM signal classification, surveillance detection, and operator interface — ~8,200 total Python LOC.

Module names and detailed breakdown withheld.

Security Modules (Hardened)¶

6 security modules — 1,469 LOC of hardened code

Detection Engineering Highlights¶

1. Multi-Domain Correlation¶

TraceLock™ correlates signals across domains to identify sophisticated threats:

TraceLock™ correlates events across multiple sensor domains to identify compound threats that single-domain tools miss. When signals from multiple domains converge, the system elevates the combined observation into a structured threat alert with full evidence chain.

Implementation details withheld.

2. Detection Rules with Tunable Thresholds¶

Specific threshold values and trigger parameters are proprietary.

3. Security Hardening¶

• SQL Injection Prevention: Parameterized queries for all database operations
• Credential Protection: Encrypted storage with secure key derivation
• Input Validation: Strict type checking on all sensor inputs
• Audit Logging: Immutable event logs with cryptographic checksums
• Mode Controller: Role-based capture profiles (lab/demo/field)

Results & Metrics¶

Evidence Artifacts¶

Architecture Overview¶

TraceLock™ uses a three-layer architecture: Sensor Layer (multi-domain RF inputs) → Processing Layer (normalization, correlation, detection) → Output Layer (forensic logs, geospatial exports, real-time alerts).

Detailed architecture diagrams are proprietary.

Sample Detection Output¶

TraceLock™ produces structured JSON alerts with timestamp, alert classification, severity rating, sensor evidence, geolocation, and correlation identifiers. Output is designed for forensic chain-of-custody requirements and downstream SIEM ingestion.

Sample output schema is proprietary. Synthetic examples available in the public repository.

KML Visualization¶

Threat locations mapped with temporal correlation — screenshots available on request

Compliance & Ethics¶

Technical Skills Demonstrated¶

Detection Engineering¶

• Custom detection rule development
• Threshold tuning and optimization
• False positive analysis and mitigation
• Multi-source correlation logic
• Alert severity classification

Security Automation¶

• Python automation pipelines
• Real-time data processing
• Structured logging (JSON, Markdown)
• CI/CD with GitHub Actions
• Database operations (SQLite)

RF/Wireless Security¶

• Wi-Fi monitoring and analysis
• Bluetooth/BLE enumeration
• SDR signal processing
• GPS correlation
• ADS-B decoding

Security Hardening¶

• Secure coding practices
• Credential encryption
• Input validation
• Audit trail design

Project Status¶

Degree Conferred: March 2026 (B.S. Cybersecurity & Information Assurance)

What This Demonstrates (Agentic Detection & Adversarial Validation Capabilities)¶

1. I can build detection systems — Not just use them, but architect and implement custom detection logic
2. I understand multi-domain correlation — The same thinking applies to SIEM correlation rules
3. I write secure code — Parameterized queries, encrypted credentials, input validation
4. I document for auditors — Evidence-grade logging with reproducible results
5. I ship working systems — Hardware + software integration, not just theory

Related Projects¶

• Governed Security Architecture — TraceLock's role in the integrated security model
• Security Telemetry → Governance → Decision Architecture — capstone architecture flow
• Security Decision Architecture (SDA) — technical decision pipeline integrating detection, governance, and automation
• Homelab Infrastructure — The lab where TraceLock™ was developed
• Remote Access & Zero-WAN — Secure architecture for remote development
• GIAP™ — GRC automation platform using similar pipeline patterns

TraceLock™ demonstrates how adversarial signal detection can be governed as an architectural layer — not merely implemented as a collection of monitoring scripts.

TraceLock Public Repo Artifacts (Synthetic) Connect on LinkedIn Contact Me

Frequently Asked Questions¶

What is TraceLock? TraceLock is a multi-domain RF threat detection platform that monitors 6 wireless domains simultaneously — Wi-Fi, Bluetooth Low Energy, SDR (ISM band), GPS, ADS-B, and cellular — correlating threats across sensors to produce forensic-grade evidence logs.

How is TraceLock different from a traditional wireless IDS? Traditional WIDS monitors Wi-Fi only using signature-based detection. TraceLock correlates activity across 6 RF domains with behavioral analysis, runs on a ~$200 Raspberry Pi instead of $10K+ enterprise appliances, and produces chain-of-custody-ready evidence logs.

What hardware does TraceLock require? A Raspberry Pi ⅘, RTL-SDR dongle, HackRF One (optional), BLE-capable adapter, and GPS receiver. Total hardware cost is approximately $200, compared to $10,000+ for enterprise wireless security appliances.

What detection engineering skills does TraceLock demonstrate? Multi-source correlation, custom detection rule authoring with tunable thresholds, false positive reduction through pattern extraction, real-time alerting, structured logging pipelines, and security hardening (parameterized queries, encrypted credentials, input validation).

¶