---
base_model: unsloth/qwen2.5-7b-instruct-unsloth-bnb-4bit
library_name: peft
pipeline_tag: text-generation
tags:
- base_model:adapter:unsloth/qwen2.5-7b-instruct-unsloth-bnb-4bit
- lora
- sft
- transformers
- trl
- unsloth
- cybersecurity
- threat-intelligence
- honeypot
- cisa-kev
- mitre-attack
license: mit
language:
- en
metrics:
- accuracy
---

# WraithCore 7B

Security operations LoRA adapter fine-tuned on Qwen 2.5 7B. This is the lightweight adapter variant of WraithWall Core V3 — same training data, smaller footprint (616MB adapter vs 15GB merged).

## What it knows

Trained on 7,000 structured Q&A pairs from 8 live intelligence feeds:

- **CISA KEV** — 1,991 actively exploited vulnerabilities
- **MITRE ATT&CK** — 1,103 technique mappings with detection rules
- **AbuseIPDB** — 839 real attacker IPs with abuse attribution
- **Malware Intelligence** — 716 entries (URLhaus, SSL Blacklist, MalwareBazaar)
- **Infrastructure Defense** — 506 entries on SSH hardening, container security, honeypots
- **Cowrie Honeypot** — 370 entries from live SSH/Telnet attack sessions
- **Threat Intelligence** — 200 entries on campaign correlation, identity graphs
- **Phishing & BGP** — 275 entries on domain analysis, route hijacks

## Dataset

7,000 curated security Q&A pairs covering honeypot deployment, BGP monitoring, web app security (OWASP Top 10), LLM prompt injection, malware analysis, incident response, network forensics, and API security. Compiled from real-world production honeypot logs, incident reports, and adversarial testing. No synthetic or GPT-generated data.

## Capabilities

| Domain | What it does |
|---|---|
| Vulnerability triage | Classifies CVEs, maps to MITRE, recommends patch priority |
| Honeypot analysis | Analyzes Cowrie sessions, identifies attacker TTPs |
| Threat hunting | Correlates IPs and campaigns across sessions |
| Malware triage | Identifies malware families, extracts IOCs |
| Phishing detection | Analyzes domains for typosquatting |
| Infrastructure defense | SSH hardening, container isolation, honeypot deployment |
| BGP intelligence | Route hijack detection and ASN analysis |

## How to use

```python
from peft import PeftModel
from transformers import AutoModelForCausalLM, AutoTokenizer
import torch

base_model = AutoModelForCausalLM.from_pretrained(
    "unsloth/qwen2.5-7b-instruct-unsloth-bnb-4bit",
    torch_dtype=torch.float16,
    device_map="auto"
)
model = PeftModel.from_pretrained(base_model, "NiffyHunt90/wraithcore-7b")
tokenizer = AutoTokenizer.from_pretrained("unsloth/qwen2.5-7b-instruct-unsloth-bnb-4bit")

prompt = "What is the MITRE ATT&CK framework and how do I use it?"
inputs = tokenizer(prompt, return_tensors="pt").to(model.device)
outputs = model.generate(**inputs, max_new_tokens=200)
print(tokenizer.decode(outputs[0], skip_special_tokens=True))
```

## Training

- **Base model:** Qwen 2.5 7B Instruct (4-bit)
- **Method:** LoRA (r=16, alpha=16)
- **Adapter size:** 616 MB
- **Hardware:** 2x Tesla T4 (14.5GB VRAM)
- **Framework:** Unsloth + HuggingFace TRL
- **Epochs:** 3 | **Loss:** 3.44 → 0.11 (96.8% reduction)

## Related models

- [WraithWall Core V3](https://huggingface.co/NiffyHunt90/wraithwall-core-v3) — full merged 16-bit model
- [CodeGuard Security](https://huggingface.co/NiffyHunt90/codeguard-security-7b) — code vulnerability detection

## Author

**Adewale Babalola (Niffyhunt)** — Founder, WraithWall
- [niffyhunt.online](https://niffyhunt.online)
- [wraithwall.online](https://wraithwall.online)