Aegis-Cyber-Guard (Qwen2.5-7B)

A blue-team cybersecurity analyst assistant, fine-tuned from Qwen2.5-7B-Instruct with QLoRA. Part of the Aegis-CyberSec-Guard project: a defensive SOC-oriented system where specialized detectors produce verifiable signals and this model reasons over them to write incident analysis and remediation guidance.

Role

Acts as a defensive security analyst / SOC assistant. It analyzes logs, network events, and vulnerability context, explains findings, and cites MITRE ATT&CK techniques and CVEs where relevant. It does not generate exploit code, malware, or offensive tooling.

Training

• Base model: Qwen2.5-7B-Instruct
• Method: QLoRA (4-bit), rank 64, alpha 64, via Unsloth
• Objective: supervised fine-tuning, train-on-responses-only
• Checkpoint: step 1200, validation loss 0.824
• Datasets: a curated instruction mix of
  • Cybersecurity-Dataset-Fenrir-v2.1 (defensive reasoning)
  • Cybersecurity-Dataset-Heimdall-v1.1 (threat hunting)
  • All-CVE-Records (vulnerability analysis, filtered)
  • a phishing-email classification set (second task)
• Each task is tagged with a distinct system prompt so the model conditions its output format on the role it is playing.

Known limitation — read before using

This model is a reasoning and language layer, not a knowledge base. It should not be trusted to recall specific CVE facts from memory. When asked about a specific CVE by ID, it will confidently produce a plausible-looking but frequently incorrect record — wrong CVSS, wrong affected products, invented reference URLs. This is expected: a 7B model cannot memorize a vulnerability database, and forcing it to try produces hallucination.

The intended architecture supplies the real CVE record via retrieval (RAG) and has the model summarize that record, never recall it. A VulnLookup retrieval component is planned for a future release. Until then, do not rely on this model's CVE-specific output as fact.

Where the model is strong: reasoning about attack patterns, log/event interpretation, defensive remediation, MITRE ATT&CK framing, and producing well-structured analyst-style writeups — as long as the specific facts it reasons over are supplied to it.

We are pending to add CyberSec RAG in version v2 for better reasoning.

Intended use

Research and portfolio demonstration of a defensive security agent architecture. Not a substitute for a professional security team or an authoritative vulnerability database yet.