// Project case study
TraceSphere
A security operations and digital-forensics platform built on ASP.NET Web Forms — SOC dashboard, incident management, log analysis with threat scoring, an evidence vault with SHA-256 integrity checks, threat graphs and printable forensic reports.
- Role
- Developer (academic project)
- Duration
- Oct – Nov 2026
- Stack
- C#ASP.NET Web Forms.NET 4.8ADO.NETChart.jsCytoscape.js
The Problem
Forensics tooling is scattered across utilities, so incidents, evidence and reports drift apart.
The Approach
One ASP.NET workspace: SOC dashboard, incidents, log scoring, evidence vault with SHA-256, threat graph and report generator.
The Outcome
A clean build (0 warnings, 0 errors) with OWASP-aligned authentication and parameterised data access.
Who it's for
Students and analysts learning how a security operations centre organises incidents, evidence and investigation workflows end to end.
The challenge
Forensics tooling is usually scattered across separate utilities. The goal was one coherent workspace where an incident, its logs, its evidence and its final report stay connected — built to a strict security baseline on a classic .NET stack.
What I built
TraceSphere pairs a SOC command centre (Chart.js telemetry) with incident management, a multi-format log parser using regex extraction and automated threat scoring, a Cytoscape.js relationship graph, attack-timeline reconstruction, an evidence vault with SHA-256 hashing and file-integrity verification, and a report generator. It also hosts an isolated academic portal for coursework submissions.
Why it matters
It demonstrates security-first engineering on an older platform: credentials are hashed with PBKDF2-HMAC-SHA256 (600,000 iterations, 256-bit random salt, constant-time comparison), every query is parameterised, and there are no hard-coded secrets.
How it works
- 01Open an incident and track it through the SOC command centre.
- 02Parse raw logs, extract indicators with regex rules and score the threat automatically.
- 03Store evidence with SHA-256 fingerprints and verify file integrity at any point.
- 04Reconstruct the attack timeline, explore relationships in the threat graph, and compile a printable forensic report.
Scope note
TraceSphere was built as an academic project and runs locally; it is not a hosted product.
System Architecture
- 01
Analysts
Role-based access
- 02
Web Forms UI
Chart.js · Cytoscape.js
- 03
Services
C# · log parser · hashing
- 04
Database
ADO.NET · parameterised SQL
- ASP.NET Web Forms on .NET Framework 4.8, C# 7.3, built cleanly in Visual Studio 2019 (0 warnings, 0 errors).
- OWASP-aligned authentication: PBKDF2-HMAC-SHA256, 600k iterations, constant-time comparison, parameterised ADO.NET queries.
- Chart.js telemetry and Cytoscape.js threat graphs on a custom dark design system.
- Dual-portal architecture separating the security platform from an academic submission portal.
// Learnings
What this project taught me
- 01Security baselines apply to every stack, old or new.
- 02Hash evidence on ingest, not at report time.
// Related work
Next project
K.A.L.K.I.