Initial CyberLog-GPT deployment

Dockerfile

@@ -0,0 +1,10 @@
+FROM python:3.11-slim
+WORKDIR /app
+COPY requirements.txt .
+RUN pip install --no-cache-dir -r requirements.txt
+COPY app.py .
+COPY ui.html .
+COPY landing.html .
+COPY cyberlog_gpt.pt .
+EXPOSE 7860
+CMD ["gunicorn", "--bind", "0.0.0.0:7860", "--workers", "1", "--timeout", "180", "app:app"]

README.md

@@ -0,0 +1,11 @@
+---
+title: CyberLog-GPT
+emoji: 🔐
+colorFrom: green
+colorTo: blue
+sdk: docker
+pinned: false
+---
+# 🔐 CyberLog-GPT
+AI-powered cybersecurity log generator. GPT transformer trained from scratch in PyTorch.
+Generates realistic syslog, firewall, SIEM, and attack logs. Max 500 lines per request.

app.py

@@ -0,0 +1,170 @@
+import os, time, json, random
+from datetime import datetime
+import torch, torch.nn as nn, torch.nn.functional as F
+from flask import Flask, request, jsonify, render_template_string
+
+app    = Flask(__name__)
+DEVICE = torch.device("cuda" if torch.cuda.is_available() else "cpu")
+MAX_LINES = 500
+MODEL, ENCODE, DECODE, CKPT, BLOCK_SIZE = None, None, None, None, 256
+
+ATTACK_PROMPTS = {
+    "random":"","ssh":"2024-01-15 03:22:11 auth-server sshd",
+    "portscan":"2024-01-15 02:11:04 SNORT[3]: [1:1000001:1] PORT SCAN",
+    "firewall":"2024-01-15 14:33:07 FW01 kernel: [BLOCK] IN=eth0",
+    "webattack":"2024-01-15 11:44:22 web01 apache2:",
+    "malware":"THREAT_INTEL: C2_BEACON_DETECTED",
+    "privesc":"2024-01-15 04:12:09 db01 sudo:",
+    "exfil":"DLP_ALERT: [CRITICAL] Large data transfer",
+    "ransomware":"SIEM_ALERT: [CRITICAL] RANSOMWARE",
+    "exploit":"IDS_ALERT: [HIGH] Exploit attempt detected",
+    "siem":"SIEM_ALERT: [HIGH]",
+}
+RANDOM_POOL = [("ssh",.15),("portscan",.12),("firewall",.18),("webattack",.15),
+               ("malware",.10),("privesc",.07),("exfil",.06),("ransomware",.05),
+               ("exploit",.08),("siem",.04)]
+
+def get_random_prompt():
+    types,weights = zip(*RANDOM_POOL)
+    t = random.choices(types, weights=weights, k=1)[0]
+    return ATTACK_PROMPTS[t], t
+
+def build_model(vocab_size, n_embd, n_head, n_layer, block_size):
+    class Head(nn.Module):
+        def __init__(self,hs):
+            super().__init__()
+            self.q=nn.Linear(n_embd,hs,bias=False)
+            self.k=nn.Linear(n_embd,hs,bias=False)
+            self.v=nn.Linear(n_embd,hs,bias=False)
+            self.register_buffer("tril",torch.tril(torch.ones(block_size,block_size)))
+            self.drop=nn.Dropout(0)
+        def forward(self,x):
+            B,T,C=x.shape
+            q,k,v=self.q(x),self.k(x),self.v(x)
+            w=q@k.transpose(-2,-1)*(k.shape[-1]**-.5)
+            w=w.masked_fill(self.tril[:T,:T]==0,float("-inf"))
+            return self.drop(F.softmax(w,dim=-1))@v
+    class MHA(nn.Module):
+        def __init__(self,nh,hs):
+            super().__init__()
+            self.heads=nn.ModuleList([Head(hs) for _ in range(nh)])
+            self.proj=nn.Linear(hs*nh,n_embd)
+            self.drop=nn.Dropout(0)
+        def forward(self,x): return self.drop(self.proj(torch.cat([h(x) for h in self.heads],dim=-1)))
+    class FF(nn.Module):
+        def __init__(self,n):
+            super().__init__()
+            self.net=nn.Sequential(nn.Linear(n,4*n),nn.GELU(),nn.Linear(4*n,n),nn.Dropout(0))
+        def forward(self,x): return self.net(x)
+    class Block(nn.Module):
+        def __init__(self):
+            super().__init__()
+            hs=n_embd//n_head
+            self.sa=MHA(n_head,hs);self.ff=FF(n_embd)
+            self.ln1=nn.LayerNorm(n_embd);self.ln2=nn.LayerNorm(n_embd)
+        def forward(self,x):
+            x=x+self.sa(self.ln1(x)); return x+self.ff(self.ln2(x))
+    class GPT(nn.Module):
+        def __init__(self):
+            super().__init__()
+            self.te=nn.Embedding(vocab_size,n_embd)
+            self.pe=nn.Embedding(block_size,n_embd)
+            self.blocks=nn.Sequential(*[Block() for _ in range(n_layer)])
+            self.ln=nn.LayerNorm(n_embd)
+            self.head=nn.Linear(n_embd,vocab_size)
+        def forward(self,idx,targets=None):
+            B,T=idx.shape
+            x=self.te(idx)+self.pe(torch.arange(T,device=DEVICE))
+            logits=self.head(self.ln(self.blocks(x)))
+            if targets is None: return logits,None
+            B,T,C=logits.shape
+            return logits,F.cross_entropy(logits.view(B*T,C),targets.view(B*T))
+        @torch.no_grad()
+        def generate(self,idx,n,temperature=1.0,top_k=None):
+            for _ in range(n):
+                ic=idx[:,-block_size:]
+                logits,_=self(ic)
+                logits=logits[:,-1,:]/temperature
+                if top_k:
+                    v,_=torch.topk(logits,min(top_k,logits.size(-1)))
+                    logits[logits<v[:,[-1]]]=float("-inf")
+                idx=torch.cat((idx,torch.multinomial(F.softmax(logits,-1),1)),dim=1)
+            return idx
+    return GPT()
+
+def load_model():
+    global MODEL,ENCODE,DECODE,CKPT,BLOCK_SIZE
+    if not os.path.exists("cyberlog_gpt.pt"): return False
+    try:
+        ckpt=torch.load("cyberlog_gpt.pt",map_location=DEVICE)
+        cfg=ckpt["config"]
+        stoi,itos=ckpt["stoi"],ckpt["itos"]
+        BLOCK_SIZE=cfg["block_size"]
+        ENCODE=lambda s:[stoi[c] for c in s if c in stoi]
+        DECODE=lambda l:"".join([itos[i] for i in l])
+        m=build_model(ckpt["vocab_size"],cfg["n_embd"],cfg["n_head"],cfg["n_layer"],cfg["block_size"]).to(DEVICE)
+        m.load_state_dict(ckpt["model_state_dict"])
+        m.eval()
+        MODEL,CKPT=m,ckpt
+        print(f"Model loaded: {sum(p.numel() for p in m.parameters())/1e6:.2f}M params")
+        return True
+    except Exception as e:
+        print(f"Load error: {e}"); return False
+
+load_model()
+
+@app.route("/api/generate",methods=["POST"])
+def api_generate():
+    if MODEL is None: return jsonify({"error":"Model not loaded"}),503
+    d=request.get_json(silent=True) or {}
+    attack_type=d.get("attack_type","random")
+    n_lines=max(1,min(int(d.get("n_lines",20)),MAX_LINES))
+    temperature=max(0.3,min(float(d.get("temperature",0.7)),1.5))
+    top_k=max(5,min(int(d.get("top_k",40)),100))
+    fmt=d.get("format","log")
+    custom_prompt=str(d.get("custom_prompt","")).strip()[:200]
+    actual_type=attack_type
+    if custom_prompt: prompt=custom_prompt
+    elif attack_type=="random": prompt,actual_type=get_random_prompt()
+    else: prompt=ATTACK_PROMPTS.get(attack_type,"")
+    try:
+        t0=time.time()
+        ctx=torch.tensor(ENCODE(prompt),dtype=torch.long,device=DEVICE).unsqueeze(0) if prompt else torch.zeros((1,1),dtype=torch.long,device=DEVICE)
+        ids=MODEL.generate(ctx,min(n_lines*150,75000),temperature=temperature,top_k=top_k)
+        raw=DECODE(ids[0].tolist())
+        lines=[l for l in raw.split("\n") if l.strip()][:n_lines]
+        elapsed=round((time.time()-t0)*1000)
+        if fmt=="json":
+            entries=[{"id":i+1,"raw":l,"attack_type":actual_type,"generated_at":datetime.utcnow().isoformat()+"Z"} for i,l in enumerate(lines)]
+            output=json.dumps({"logs":entries,"count":len(entries),"model":"CyberLog-GPT"},indent=2)
+        elif fmt=="csv":
+            rows=["id,timestamp,raw_log,attack_type"]
+            for i,l in enumerate(lines):
+                ts=l[:19] if len(l)>19 else datetime.utcnow().strftime("%Y-%m-%d %H:%M:%S")
+                rows.append(f\'{i+1},{ts},"{l.replace(",",";").replace(chr(34),chr(92)+chr(34))}",{actual_type}\')
+            output="\n".join(rows)
+        else: output="\n".join(lines)
+        return jsonify({"logs":output,"lines_count":len(lines),"chars_count":len(output),"tokens_used":len(ids[0]),"elapsed_ms":elapsed,"attack_type":actual_type,"format":fmt})
+    except Exception as e:
+        return jsonify({"error":str(e)}),500
+
+@app.route("/api/info")
+def api_info():
+    if MODEL is None: return jsonify({"status":"not_loaded"}),503
+    total=sum(p.numel() for p in MODEL.parameters())
+    return jsonify({"status":"ready","parameters_M":round(total/1e6,2),"train_loss":round(CKPT["final_train_loss"],4),"val_loss":round(CKPT["final_val_loss"],4),"vocab_size":CKPT["vocab_size"],"block_size":BLOCK_SIZE,"device":str(DEVICE),"max_lines":MAX_LINES})
+
+@app.route("/api/health")
+def health(): return jsonify({"status":"ok","model_loaded":MODEL is not None})
+
+@app.route("/")
+def landing():
+    if os.path.exists("landing.html"): return open("landing.html").read()
+    return open("ui.html").read() if os.path.exists("ui.html") else "<h1>CyberLog-GPT</h1>"
+
+@app.route("/app")
+def index():
+    return open("ui.html").read() if os.path.exists("ui.html") else "<h1>App UI missing</h1>"
+
+if __name__=="__main__":
+    app.run(host="0.0.0.0",port=int(os.environ.get("PORT",7860)),debug=False)

requirements.txt

@@ -0,0 +1,3 @@
+flask==3.0.0
+torch==2.1.0
+gunicorn==21.2.0