SHADOWTRACE: Catch Attackers by How They Act — Not Where They’re From

“IP 185.x.x.x failed SSH 500 times.”

“IP 185.x.x.x failed SSH 500 times.”

Useful… until that IP disappears. Proxies rotate. VPNs flip. Botnets shuffle hosts. The address changes. The operator often doesn't.

That's the gap SHADOWTRACE was built for.

The real question isn't "which IP?"

It's: Is this the same attacker?

Same scan rhythm. Same username habits. Same probing order. Same bursty SSH style. Different networks — same behavioral fingerprint.

SHADOWTRACE treats hostile activity like a signature of behavior, not a label on a packet header.

What it does

SHADOWTRACE watches live security signals and builds an attacker behavioral fingerprint from things like:

• scan timing / cadence
• port enumeration style (sequential vs random)
• protocol mix and sequencing
• username diversity
• SSH burst patterns
• HTTP path ordering
• DNS periodicity

Then it compares fingerprints across sources. When two different IPs behave the same way, it links them as a probable same operator.

That's the whole punchline:

Different IPs → same behavioral actor.

Built for real use (CLI and GUI)

Not a one-off notebook. Not a demo toy.

┌─────────────┬──────────────────────────────────┐
│ Prefer      │ Start with                       │
├─────────────┼──────────────────────────────────┤
│ Terminal    │ python3 shadowtrace.py           │
│ Dashboard   │ python3 shadowtrace_gui.py       │
└─────────────┴──────────────────────────────────┘

┌─────────────┬──────────────────────────────────┐
│ Prefer      │ Start with                       │
├─────────────┼──────────────────────────────────┤
│ Terminal    │ python3 shadowtrace.py           │
│ Dashboard   │ python3 shadowtrace_gui.py       │
└─────────────┴──────────────────────────────────┘

Same engine. Same SQLite store. Windows and Linux.

You can:

• tail auth / access logs in real time
• optionally capture traffic
• stream events over UDP / HTTP
• ingest historical logs, Zeek exports, or PCAPs
• cluster operators and compare any two IPs

The GUI gives you live feed, fingerprints, clusters, similarity graph, and SOC-style detections — updating as events arrive.

Why this feels different

Classic tools answer: "What happened from this IP?" SHADOWTRACE answers: "Who does this behavior look like?"

That matters when an attacker:

• changes IP
• changes username lists
• slows down / speeds up
• switches tools
• hops networks

The identity you're hunting is the pattern, not the address.

Under the hood (short version)

Python stack: live ingest → feature extraction → similarity + clustering → NetworkX graph → FastAPI dashboard.

Defensive by design: your logs, your lab traffic, your investigation workflow.

Try it

Repo: https://github.com/yexploit/shadowtrace

pip install -r requirements.txt
pip install -e .

# CLI
python3 shadowtrace.py monitor -p /var/log/auth.log

# GUI
python3 shadowtrace_gui.py

pip install -r requirements.txt
pip install -e .

# CLI
python3 shadowtrace.py monitor -p /var/log/auth.log

# GUI
python3 shadowtrace_gui.py

Conclusion

Attackers can rent a new IP in seconds. They can't always reinvent how they work.

SHADOWTRACE bets on that — and turns behavior into the signal that sticks.