README.md

---
language:
- en
license: apache-2.0
tags:
- security
- cybersecurity
- http
- qwen2.5
- lora
- fine-tuned
base_model: Qwen/Qwen2.5-3B-Instruct
datasets:
- custom
model-index:
- name: qwen2.5-3b-security
  results:
  - task:
      type: text-classification
      name: HTTP Request Classification
    metrics:
    - type: accuracy
      value: 93.33
      name: Overall Accuracy
    - type: accuracy
      value: 86.7
      name: Malicious Detection
    - type: accuracy
      value: 100.0
      name: Benign Detection
---

# Qwen2.5-3B HTTP Security Classifier

## Model Description

This is a fine-tuned version of [Qwen/Qwen2.5-3B-Instruct](https://huggingface.co/Qwen/Qwen2.5-3B-Instruct) specialized for HTTP request security classification. The model can detect 11 different types of web attacks with 93.33% accuracy.

## Model Details

- **Base Model:** Qwen/Qwen2.5-3B-Instruct
- **Fine-tuning Method:** LoRA (Low-Rank Adaptation)
- **Training Data:** 2,000+ labeled HTTP requests from 6 months of production traffic
- **Parameters:** 3B (59.8M trainable)
- **Quantization:** bfloat16
- **Context Length:** 1024 tokens

## Performance Metrics

### Test Suite Results
- **Overall Accuracy:** 93.33% (28/30 test cases)
- **Malicious Detection:** 86.7% (13/15)
- **Benign Detection:** 100% (15/15)
- **False Positives:** 0
- **False Negatives:** 2
- **Avg Inference Time:** 3.1s (CPU) / 150ms (GPU)

### Attack Types Detected
1. SQL Injection
2. XSS (Cross-Site Scripting)
3. Path Traversal
4. Command Injection
5. Information Disclosure
6. Reconnaissance
7. Authentication Attacks
8. Web Application Attacks
9. Protocol Attacks
10. Injection Attacks
11. Malware

## Intended Use

### Primary Use Cases
- Real-time HTTP request filtering
- WAF (Web Application Firewall) enhancement
- Security log analysis
- Attack pattern detection
- Threat intelligence

### Out of Scope
- Network-level attacks (DDoS, port scanning without HTTP context)
- Binary protocol analysis
- Encrypted traffic analysis (pre-decryption)

## Usage

### Quick Start
```python
from transformers import AutoTokenizer, AutoModelForCausalLM
import torch

model_path = "gachara/my-security-classifier"
tokenizer = AutoTokenizer.from_pretrained(model_path)
model = AutoModelForCausalLM.from_pretrained(
    model_path,
    torch_dtype=torch.bfloat16,
    device_map="auto"
)

def classify_request(method, url, status, query, user_agent):
    input_text = f"""HTTP Request Analysis Required:

Method: {method}
URL: {url}
Status: {status}
Query: {query}
User-Agent: {user_agent}

Task: Determine if this request is malicious and identify the attack type."""

    messages = [
        {"role": "system", "content": "You are a senior cybersecurity analyst..."},
        {"role": "user", "content": input_text}
    ]
    
    text = tokenizer.apply_chat_template(messages, tokenize=False, add_generation_prompt=True)
    inputs = tokenizer([text], return_tensors="pt").to(model.device)
    
    outputs = model.generate(**inputs, max_new_tokens=512, temperature=0.1)
    response = tokenizer.decode(outputs[0][len(inputs.input_ids[0]):], skip_special_tokens=True)
    
    return response

# Example
result = classify_request(
    "GET", 
    "/admin/config.php", 
    200, 
    "id=1' OR '1'='1", 
    "sqlmap/1.0"
)
print(result)
```

### Example Output
Classification: malicious
Confidence Score: 0.80
Attack Type: SQL_Injection
Analysis:
The request contains a classic SQL injection payload in the query parameter.
The pattern "' OR '1'='1" is a boolean-based blind SQL injection attempt
designed to bypass authentication or extract data. The user agent "sqlmap/1.0"
is a known automated SQL injection tool, further confirming malicious intent.
## Training Details

### Training Data
- **Total Samples:** 2,000 (1,000 benign + 1,000 malicious)
- **Data Sources:** Production HTTP logs from web applications
- **Attack Distribution:**
  - Information_Disclosure: 37.9%
  - Command_Injection: 18.0%
  - Reconnaissance: 14.0%
  - Path_Traversal: 9.0%
  - Authentication_Attack: 7.6%
  - Web_Application_Attack: 5.5%
  - SQL_Injection: 5.4%
  - Malware: 1.7%

### Training Procedure
- **Framework:** LLaMA Factory
- **Method:** LoRA fine-tuning
- **LoRA Rank:** 32
- **LoRA Alpha:** 64
- **Epochs:** 3
- **Batch Size:** 32 (4 per device × 8 accumulation)
- **Learning Rate:** 2e-4
- **Warmup Ratio:** 0.1
- **Optimizer:** AdamW
- **Training Time:** ~35 minutes on single GPU

### Hardware
- **GPU:** NVIDIA A100 (40GB) / RTX 4090 (24GB)
- **Memory Usage:** ~18GB VRAM during training

## Limitations

### Known Issues
1. **Server-Side Template Injection (SSTI):** Model sometimes misclassifies legitimate template syntax as benign
2. **GraphQL Introspection:** May not detect GraphQL schema dumping attacks
3. **Obfuscated Payloads:** Performance degrades with heavily encoded attacks
4. **Context Length:** Limited to 1024 tokens (very long URLs may be truncated)

### Bias Considerations
- Training data primarily from English-language web applications
- May underperform on non-HTTP protocols
- Biased toward common attack patterns (rare attacks may be missed)

## Ethical Considerations

### Responsible Use
- ✅ Use for defensive security purposes
- ✅ Integrate as part of defense-in-depth strategy
- ✅ Monitor for false positives in production
- ❌ Do not use for offensive security without authorization
- ❌ Do not rely solely on this model for critical security decisions

### Privacy
- Model does not store or transmit data
- All inference happens locally
- No sensitive data was used in training (IPs/credentials removed)

## Citation

If you use this model in your research or production systems, please cite:
```bibtex
@misc{qwen25-3b-security,
  author = {John gachara},
  title = {Qwen2.5-3B HTTP Security Classifier},
  year = {2024},
  publisher = {HuggingFace},
  url = {https://huggingface.co/gachara/my-security-classifier}
}
```

## License

This model is released under the Apache 2.0 license. The base model Qwen2.5-3B-Instruct is also Apache 2.0.

## Acknowledgments

- Base model: [Qwen Team](https://github.com/QwenLM/Qwen2.5)
- Fine-tuning framework: [LLaMA Factory](https://github.com/hiyouga/LLaMA-Factory)
- Training data: Collected from production web applications over 6 months

## Contact


---


**Model Version:** 1.0.0