| --- |
| base_model: unsloth/qwen2.5-7b-instruct-unsloth-bnb-4bit |
| library_name: peft |
| pipeline_tag: text-generation |
| tags: |
| - base_model:adapter:unsloth/qwen2.5-7b-instruct-unsloth-bnb-4bit |
| - lora |
| - sft |
| - transformers |
| - trl |
| - unsloth |
| - cybersecurity |
| - threat-intelligence |
| - honeypot |
| - cisa-kev |
| - mitre-attack |
| license: mit |
| language: |
| - en |
| metrics: |
| - accuracy |
| --- |
| |
| # WraithCore 7B |
|
|
| Security operations LoRA adapter fine-tuned on Qwen 2.5 7B. This is the lightweight adapter variant of WraithWall Core V3 — same training data, smaller footprint (616MB adapter vs 15GB merged). |
|
|
| ## What it knows |
|
|
| Trained on 7,000 structured Q&A pairs from 8 live intelligence feeds: |
|
|
| - **CISA KEV** — 1,991 actively exploited vulnerabilities |
| - **MITRE ATT&CK** — 1,103 technique mappings with detection rules |
| - **AbuseIPDB** — 839 real attacker IPs with abuse attribution |
| - **Malware Intelligence** — 716 entries (URLhaus, SSL Blacklist, MalwareBazaar) |
| - **Infrastructure Defense** — 506 entries on SSH hardening, container security, honeypots |
| - **Cowrie Honeypot** — 370 entries from live SSH/Telnet attack sessions |
| - **Threat Intelligence** — 200 entries on campaign correlation, identity graphs |
| - **Phishing & BGP** — 275 entries on domain analysis, route hijacks |
|
|
| ## Dataset |
|
|
| 7,000 curated security Q&A pairs covering honeypot deployment, BGP monitoring, web app security (OWASP Top 10), LLM prompt injection, malware analysis, incident response, network forensics, and API security. Compiled from real-world production honeypot logs, incident reports, and adversarial testing. No synthetic or GPT-generated data. |
|
|
| ## Capabilities |
|
|
| | Domain | What it does | |
| |---|---| |
| | Vulnerability triage | Classifies CVEs, maps to MITRE, recommends patch priority | |
| | Honeypot analysis | Analyzes Cowrie sessions, identifies attacker TTPs | |
| | Threat hunting | Correlates IPs and campaigns across sessions | |
| | Malware triage | Identifies malware families, extracts IOCs | |
| | Phishing detection | Analyzes domains for typosquatting | |
| | Infrastructure defense | SSH hardening, container isolation, honeypot deployment | |
| | BGP intelligence | Route hijack detection and ASN analysis | |
|
|
| ## How to use |
|
|
| ```python |
| from peft import PeftModel |
| from transformers import AutoModelForCausalLM, AutoTokenizer |
| import torch |
| |
| base_model = AutoModelForCausalLM.from_pretrained( |
| "unsloth/qwen2.5-7b-instruct-unsloth-bnb-4bit", |
| torch_dtype=torch.float16, |
| device_map="auto" |
| ) |
| model = PeftModel.from_pretrained(base_model, "NiffyHunt90/wraithcore-7b") |
| tokenizer = AutoTokenizer.from_pretrained("unsloth/qwen2.5-7b-instruct-unsloth-bnb-4bit") |
| |
| prompt = "What is the MITRE ATT&CK framework and how do I use it?" |
| inputs = tokenizer(prompt, return_tensors="pt").to(model.device) |
| outputs = model.generate(**inputs, max_new_tokens=200) |
| print(tokenizer.decode(outputs[0], skip_special_tokens=True)) |
| ``` |
|
|
| ## Training |
|
|
| - **Base model:** Qwen 2.5 7B Instruct (4-bit) |
| - **Method:** LoRA (r=16, alpha=16) |
| - **Adapter size:** 616 MB |
| - **Hardware:** 2x Tesla T4 (14.5GB VRAM) |
| - **Framework:** Unsloth + HuggingFace TRL |
| - **Epochs:** 3 | **Loss:** 3.44 → 0.11 (96.8% reduction) |
|
|
| ## Related models |
|
|
| - [WraithWall Core V3](https://huggingface.co/NiffyHunt90/wraithwall-core-v3) — full merged 16-bit model |
| - [CodeGuard Security](https://huggingface.co/NiffyHunt90/codeguard-security-7b) — code vulnerability detection |
|
|
| ## Author |
|
|
| **Adewale Babalola (Niffyhunt)** — Founder, WraithWall |
| - [niffyhunt.online](https://niffyhunt.online) |
| - [wraithwall.online](https://wraithwall.online) |
|
|
