File size: 3,245 Bytes
8bd96da | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 | # ModernBERT-IDS
A fine-tuned ModernBERT-based multi-class classifier for detecting DDoS and related attack categories directly from raw network log strings. This model is part of the ModernBERT-DoS/IDS project, focused on high-accuracy intrusion detection using transformer-based architectures.
---
## Model Summary
- **Model Type:** Transformer-based multi-class text classifier
- **Base Model:** answerdotai/ModernBERT-base
- **Task:** Intrusion Detection / Log Classification
- **Input:** Raw network log text (e.g., packet captures converted to text format)
- **Output:** Predicted attack class label
- **Training Objective:** Weighted cross-entropy (handles class imbalance)
This model was trained to identify several traffic types present in datasets such as CIC-DDoS2019 and custom SSL logs.
---
## Intended Use
### Primary Use Cases
- Intrusion Detection Systems (IDS)
- DDoS and attack pattern classification
- Network monitoring and security research
- Automated analysis of raw pcap-derived logs
- Multi-class traffic categorization in SOC workflows
### Not Intended For
- Real-time blocking without further validation
- Use on unprocessed binary packet captures (requires conversion to text logs)
- Detection of malware not represented in the training data
---
## Training Details
### Training Pipeline
The model was trained using:
- ModernBERT fine-tuning with mean pooling
- 3× dropout layers for regularization
- Two fully-connected layers with GELU activation
- LayerNorm for stable optimization
- Tokenization up to 512 tokens to support large logs
### Data Handling
- Strict train/validation/test split with no data leakage
- No manual feature removal required; model learns directly from raw logs
- Stratified sampling to preserve class distribution
### Baselines (for comparison)
The training repository includes benchmarks against:
- Random Forest
- Linear SVM
- Logistic Regression
- CNN
- BiLSTM with Attention
ModernBERT-IDS consistently outperformed all baselines in macro-F1 scoring.
---
## Evaluation Metrics
The following metrics were computed on the test split (unseen logs):
- Accuracy
- Macro F1
- Weighted F1
- Per-class F1
- Precision/Recall
- Confusion matrix
This model achieved macro-F1 performance in the 0.95–0.97 range depending on dataset variation.
---
## Supported Attack Classes
The model dynamically adapts to classes found in the training dataset, typically including:
- DDoS
- BENIGN
- LDAP
- NetBIOS
- MSSQL
- Portmap
- UDP
- SSL
Additional classes may be present depending on the uploaded dataset.
---
## Example Usage
```python
from transformers import AutoTokenizer, AutoModelForSequenceClassification
import torch
model_name = "ccaug/modernbert-IDS"
tokenizer = AutoTokenizer.from_pretrained(model_name)
model = AutoModelForSequenceClassification.from_pretrained(model_name)
log_line = "Frame 144: 98 bytes on wire (784 bits), 98 bytes captured ..."
inputs = tokenizer(log_line, return_tensors="pt", truncation=True, max_length=512)
with torch.no_grad():
outputs = model(**inputs)
predicted_class = outputs.logits.argmax(dim=1).item()
print("Predicted class:", predicted_class) |