Update checkpoint-1251/README.md

checkpoint-1251/README.md

@@ -9,202 +9,93 @@ tags:
 - transformers
 - trl
 - unsloth
+- security
+- wraithcore
 ---
 
-# Model Card for Model ID
-
-<!-- Provide a quick summary of what the model is/does. -->
-
+# WraithCore-7B
 
+Security intelligence model fine-tuned for attacker classification, phishing detection, and CVE scoring.
 
 ## Model Details
 
-### Model Description
-
-<!-- Provide a longer summary of what this model is. -->
-
-
-
-- **Developed by:** [More Information Needed]
-- **Funded by [optional]:** [More Information Needed]
-- **Shared by [optional]:** [More Information Needed]
-- **Model type:** [More Information Needed]
-- **Language(s) (NLP):** [More Information Needed]
-- **License:** [More Information Needed]
-- **Finetuned from model [optional]:** [More Information Needed]
-
-### Model Sources [optional]
-
-<!-- Provide the basic links for the model. -->
-
-- **Repository:** [More Information Needed]
-- **Paper [optional]:** [More Information Needed]
-- **Demo [optional]:** [More Information Needed]
+- **Developed by:** Ezmcyber890
+- **Model type:** Qwen2.5-7B with LoRA adapter (4-bit)
+- **Language(s):** English, structured security data
+- **License:** MIT
+- **Finetuned from model:** unsloth/qwen2.5-7b-instruct-unsloth-bnb-4bit
 
 ## Uses
 
-<!-- Address questions around how the model is intended to be used, including the foreseeable users of the model and those affected by the model. -->
-
 ### Direct Use
 
-<!-- This section is for the model use without fine-tuning or plugging into a larger ecosystem/app. -->
-
-[More Information Needed]
-
-### Downstream Use [optional]
-
-<!-- This section is for the model use when fine-tuned for a task, or when plugged into a larger ecosystem/app -->
-
-[More Information Needed]
-
-### Out-of-Scope Use
-
-<!-- This section addresses misuse, malicious use, and uses that the model will not work well for. -->
-
-[More Information Needed]
-
-## Bias, Risks, and Limitations
+Classify SSH session logs into attacker profiles. Detect phishing URLs and emails. Score CVEs by exploitability and attack vector.
 
-<!-- This section is meant to convey both technical and sociotechnical limitations. -->
+Supported classifications:
+- **Attacker**: scanner, brute_forcer, interactive_attacker, ransomware_dropper, script_based_attacker
+- **Phishing**: credential_harvest, financial_fraud, prize_scam, delivery_fraud, account_takeover
+- **CVE**: exploited_in_wild (bool), difficulty (1-10), attack_vector (network/adjacent/local)
 
-[More Information Needed]
+## How to Get Started
 
-### Recommendations
+```python
+from peft import PeftModel
+from transformers import AutoModelForCausalLM, AutoTokenizer
 
-<!-- This section is meant to convey recommendations with respect to the bias, risk, and technical limitations. -->
+base = AutoModelForCausalLM.from_pretrained("Qwen/Qwen2.5-7B-Instruct", device_map="auto", load_in_4bit=True)
+model = PeftModel.from_pretrained(base, "Ezmcyber890/wraithcore-7b")
+tokenizer = AutoTokenizer.from_pretrained("Qwen/Qwen2.5-7B-Instruct")
 
-Users (both direct and downstream) should be made aware of the risks, biases and limitations of the model. More information needed for further recommendations.
-
-## How to Get Started with the Model
-
-Use the code below to get started with the model.
-
-[More Information Needed]
+messages = [
+    {"role": "system", "content": "Respond ONLY with valid JSON."},
+    {"role": "user", "content": "[HONEYPOT] IP=49.7.233.99 duration=0 commands=[] downloads=[]"},
+]
+prompt = tokenizer.apply_chat_template(messages, tokenize=False, add_generation_prompt=True)
+inputs = tokenizer(prompt, return_tensors="pt").to("cuda")
+outputs = model.generate(**inputs, max_new_tokens=128, temperature=0.1, do_sample=False)
+print(tokenizer.decode(outputs[0][inputs["input_ids"].shape[1]:], skip_special_tokens=True))
+```
 
 ## Training Details
 
 ### Training Data
 
-<!-- This should link to a Dataset Card, perhaps with a short stub of information on what the training data is all about as well as documentation related to data pre-processing or additional filtering. -->
+1666 examples in JSONL chat format across 3 sources:
 
-[More Information Needed]
+| Source | Count | Type |
+|--------|-------|------|
+| Honeypot (WraithWall Cowrie) | 500 | Real SSH session logs from 1958+ attacks |
+| Phishing (OpenPhish + URLhaus) | 500 | Real active phishing URLs |
+| Benign (negative samples) | 166 | Legitimate emails/URLs |
+| CISA KEV | 500 | Real CVEs from known exploited catalog |
 
 ### Training Procedure
 
-<!-- This relates heavily to the Technical Specifications. Content here should link to that section when it is relevant to the training procedure. -->
-
-#### Preprocessing [optional]
-
-[More Information Needed]
-
-
-#### Training Hyperparameters
-
-- **Training regime:** [More Information Needed] <!--fp32, fp16 mixed precision, bf16 mixed precision, bf16 non-mixed precision, fp16 non-mixed precision, fp8 mixed precision -->
-
-#### Speeds, Sizes, Times [optional]
+- **Hardware:** T4 GPU (16GB VRAM)
+- **Framework:** Unsloth + PEFT + TRL SFTTrainer
+- **LoRA r:** 16 | **LoRA alpha:** 16 | **LoRA dropout:** 0
+- **Target modules:** q_proj, k_proj, v_proj, o_proj
+- **Batch size:** 2 (gradient accumulation: 4)
+- **Learning rate:** 2e-4
+- **Epochs:** 3
+- **Sequence length:** 2048
+- **Optimizer:** AdamW 8-bit
+- **Scheduler:** linear (warmup: 5% of steps)
+- **4-bit:** nf4, double quantization
 
-<!-- This section provides information about throughput, start/end time, checkpoint size if relevant, etc. -->
+### Speeds, Sizes, Times
 
-[More Information Needed]
+- Training time: ~3 hours on Colab T4
+- Adapter size: ~50 MB (LoRA weights only)
+- Inference: ~2-3s per query on T4 (4-bit)
 
 ## Evaluation
 
-<!-- This section describes the evaluation protocols and provides the results. -->
-
-### Testing Data, Factors & Metrics
-
-#### Testing Data
-
-<!-- This should link to a Dataset Card if possible. -->
-
-[More Information Needed]
-
-#### Factors
-
-<!-- These are the things the evaluation is disaggregating by, e.g., subpopulations or domains. -->
-
-[More Information Needed]
-
-#### Metrics
-
-<!-- These are the evaluation metrics being used, ideally with a description of why. -->
-
-[More Information Needed]
-
-### Results
-
-[More Information Needed]
-
-#### Summary
-
-
-
-## Model Examination [optional]
-
-<!-- Relevant interpretability work for the model goes here -->
-
-[More Information Needed]
-
-## Environmental Impact
-
-<!-- Total emissions (in grams of CO2eq) and additional considerations, such as electricity usage, go here. Edit the suggested text below accordingly -->
-
-Carbon emissions can be estimated using the [Machine Learning Impact calculator](https://mlco2.github.io/impact#compute) presented in [Lacoste et al. (2019)](https://arxiv.org/abs/1910.09700).
-
-- **Hardware Type:** [More Information Needed]
-- **Hours used:** [More Information Needed]
-- **Cloud Provider:** [More Information Needed]
-- **Compute Region:** [More Information Needed]
-- **Carbon Emitted:** [More Information Needed]
-
-## Technical Specifications [optional]
-
-### Model Architecture and Objective
-
-[More Information Needed]
-
-### Compute Infrastructure
-
-[More Information Needed]
-
-#### Hardware
-
-[More Information Needed]
-
-#### Software
-
-[More Information Needed]
-
-## Citation [optional]
-
-<!-- If there is a paper or blog post introducing the model, the APA and Bibtex information for that should go in this section. -->
-
-**BibTeX:**
-
-[More Information Needed]
-
-**APA:**
-
-[More Information Needed]
-
-## Glossary [optional]
-
-<!-- If relevant, include terms and calculations in this section that can help readers understand the model or model card. -->
-
-[More Information Needed]
-
-## More Information [optional]
-
-[More Information Needed]
-
-## Model Card Authors [optional]
-
-[More Information Needed]
-
-## Model Card Contact
+Tested against held-out examples from each source category with >90% accuracy on attacker classification and phishing detection.
 
-[More Information Needed]
-### Framework versions
+## Framework versions
 
-- PEFT 0.19.1
+- PEFT 0.19.1
+- Transformers 5.14.1
+- TRL
+- Unsloth