Create README.md
Browse files
README.md
ADDED
|
@@ -0,0 +1,72 @@
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| 1 |
+
---
|
| 2 |
+
datasets:
|
| 3 |
+
- sarahwei/cyber_MITRE_tactic_CTI_dataset_v16
|
| 4 |
+
language:
|
| 5 |
+
- en
|
| 6 |
+
metrics:
|
| 7 |
+
- accuracy
|
| 8 |
+
base_model:
|
| 9 |
+
- bencyc1129/mitre-bert-base-cased
|
| 10 |
+
pipeline_tag: text-classification
|
| 11 |
+
library_name: transformers
|
| 12 |
+
---
|
| 13 |
+
## MITRE-v16-tactic-bert-case-based
|
| 14 |
+
|
| 15 |
+
It's a fine-tuned model from [mitre-bert-base-cased](https://huggingface.co/bencyc1129/mitre-bert-base-cased) on the MITRE ATT&CK version 16 procedure dataset.
|
| 16 |
+
|
| 17 |
+
|
| 18 |
+
## Intended uses & limitations
|
| 19 |
+
You can use the fine-tuned model for text classification. It aims to identify the tactic that the sentence belongs to in MITRE ATT&CK framework.
|
| 20 |
+
A sentence or an attack may fall into several tactics.
|
| 21 |
+
|
| 22 |
+
Note that this model is primarily fine-tuned on text classification for cybersecurity.
|
| 23 |
+
It may not perform well if the sentence is not related to attacks.
|
| 24 |
+
|
| 25 |
+
## How to use
|
| 26 |
+
You can use the model with Tensorflow.
|
| 27 |
+
```python
|
| 28 |
+
from transformers import AutoTokenizer, AutoModelForSequenceClassification
|
| 29 |
+
import torch
|
| 30 |
+
model_id = "sarahwei/MITRE-v16-tactic-bert-case-based"
|
| 31 |
+
|
| 32 |
+
tokenizer = AutoTokenizer.from_pretrained(model_id)
|
| 33 |
+
model = AutoModelForSequenceClassification.from_pretrained(
|
| 34 |
+
model_id,
|
| 35 |
+
torch_dtype=torch.bfloat16,
|
| 36 |
+
)
|
| 37 |
+
question = 'An attacker performs a SQL injection.'
|
| 38 |
+
input_ids = tokenizer(question,return_tensors="pt")
|
| 39 |
+
outputs = model(**input_ids)
|
| 40 |
+
logits = outputs.logits
|
| 41 |
+
sigmoid = torch.nn.Sigmoid()
|
| 42 |
+
probs = sigmoid(logits.squeeze().cpu())
|
| 43 |
+
predictions = np.zeros(probs.shape)
|
| 44 |
+
predictions[np.where(probs >= 0.5)] = 1
|
| 45 |
+
predicted_labels = [model.config.id2label[idx] for idx, label in enumerate(predictions) if label == 1.0]
|
| 46 |
+
```
|
| 47 |
+
|
| 48 |
+
## Training procedure
|
| 49 |
+
### Training parameter
|
| 50 |
+
- learning_rate: 2e-5
|
| 51 |
+
- train_batch_size: 32
|
| 52 |
+
- eval_batch_size: 32
|
| 53 |
+
- seed: 0
|
| 54 |
+
- num_epochs: 5
|
| 55 |
+
- warmup_ratio: 0.01
|
| 56 |
+
- weight_decay: 0.001
|
| 57 |
+
- optim: adamw_8bit
|
| 58 |
+
|
| 59 |
+
### Training results
|
| 60 |
+
- global_step=1755
|
| 61 |
+
- train_runtime: 315.2685
|
| 62 |
+
- train_samples_per_second: 177.722
|
| 63 |
+
- train_steps_per_second: 5.567
|
| 64 |
+
- total_flos: 7371850396784640.0
|
| 65 |
+
- train_loss: 0.06630994546787013
|
| 66 |
+
|
| 67 |
+
|
| 68 |
+
|Step| Training Loss| Validation Loss| Accuracy |
|
| 69 |
+
|:--------:| :------------:|:----------:|:------------:|
|
| 70 |
+
|500| 0.149800| 0.061355| 0.986081|
|
| 71 |
+
1000| 0.043700| 0.046901| 0.988223|
|
| 72 |
+
1500| 0.027700| 0.043031| 0.988707|
|