diff --git "a/landing.html" "b/landing.html" new file mode 100644--- /dev/null +++ "b/landing.html" @@ -0,0 +1,1011 @@ + + + + + +CyberLog-GPT — AI Security Log Generator + + + + + + + +
+
+ + + + + +
+
+
+
+
+
+ +
GPT transformer · trained from scratch · pytorch
+ +

+ Generate
+ realistic
+ security logs +

+ +

+ A custom GPT transformer trained on 9 attack patterns. + Generates authentic syslog, firewall, SIEM, and IDS events + for security testing, SOC training, and SIEM rule validation. +

+ +
+ + ⚡ Launch Generator + + How it works +
+ + +
+
+
+
+
+
cyberlog-gpt — generating 10 lines · temperature 0.7
+
+
+
$ cyberlog-gpt generate --attack random --lines 10
+
Loading model [5.2M params] ████████████ done
+
 
+
2024-03-17 02:14:33 auth-server sshd[4821]: Failed password for admin from 185.220.101.34
+
SIEM_ALERT: [HIGH] BRUTE_FORCE src=185.220.101.34 attempts=847 MITRE=T1110
+
2024-03-17 02:14:41 FW01 kernel: [BLOCK] IN=eth0 SRC=45.33.32.156 DST=10.0.1.22 PROTO=TCP DPT=22
+
EDR_ALERT: [CRITICAL] C2_BEACON host=web01 c2=91.108.4.1 family=Cobalt Strike interval=300s
+
2024-03-17 02:15:02 web01 modsecurity: SQLi Attack Detected src=194.165.16.11 rule=942100
+
THREAT_INTEL: PORTSCAN src=103.214.109.65 ports_scanned=8192 open=[22,80,443,3389]
+
 
+
✓ Generated 10 lines · 847 tokens · 312ms █
+
+
+
+ + +
+
+
0
+
Attack Types
+
+
+
0
+
Max Lines / Request
+
+
+
0
+
Million Parameters
+
+
+
0
+
Export Formats
+
+
+ + +
+
Process
+

How it works

+

A GPT transformer trained from scratch on synthetic security log data. No pre-trained models. No API wrappers. Pure PyTorch.

+ +
+
+
01
+
+
Training Data
+

3,000 synthetic log events generated

+

Nine attack generators produce realistic syslog, firewall, SIEM, EDR, and network security events with real IP patterns, hostnames, CVE references, and MITRE ATT&CK technique IDs.

+
gen_ssh_bruteforce() → gen_malware_c2() → gen_ransomware() → ...
+
+
+ +
+
02
+
+
Tokenization
+

Character-level vocabulary of ~95 tokens

+

Every unique character becomes an integer. No BPE, no WordPiece — the same core concept as GPT-4's tokenizer, just at character level. The model learns IP addresses, timestamps, and port numbers as character sequences.

+
encode("Failed password") → [38,23,18,21,22,9,...]
+
+
+ +
+
03
+
+
Architecture
+

6-layer GPT transformer trained for 5,000 steps

+

Multi-head self-attention (8 heads), feed-forward network, residual connections, layer normalization. The exact same architecture as GPT-2 — just smaller. Trained on a single T4 GPU in ~15 minutes.

+
6 layers × 8 heads × 256 dim = 5.2M parameters
+
+
+ +
+
04
+
+
Inference
+

Autoregressive generation with temperature sampling

+

The model predicts one character at a time, sampling from the probability distribution. Temperature controls randomness. Top-K limits the sampling pool. You get realistic, varied logs every time.

+
context → logits → softmax(T) → top_k → sample → next_char
+
+
+
+
+ + +
+
+
Coverage
+

9 attack patterns

+

Each type generates realistic log sequences with proper IP addresses, hostnames, ports, MITRE ATT&CK IDs, and severity levels.

+ +
+
+
🔑
+
SSH Brute Force
+
Failed authentication sequences, PAM messages, source IP patterns
+
MITRE T1110
+
+
+
🔍
+
Port Scan
+
Snort IDS alerts, UFW blocks, scan type detection logs
+
MITRE T1595
+
+
+
🔥
+
Firewall Blocks
+
iptables / UFW kernel messages, country codes, rule IDs
+
POLICY VIOLATION
+
+
+
🌐
+
Web Attacks
+
SQLi, XSS, LFI, RCE, SSRF — Apache + ModSecurity logs
+
OWASP TOP 10
+
+
+
🦠
+
Malware C2
+
Beacon intervals, C2 IP attribution, malware family names
+
MITRE T1071
+
+
+
⬆️
+
Privilege Escalation
+
sudo abuse, SUID exploitation, kernel exploit signatures
+
MITRE T1068
+
+
+
📤
+
Data Exfiltration
+
DLP alerts, NetFlow anomalies, large outbound transfers
+
MITRE T1048
+
+
+
💀
+
Ransomware
+
Mass file modification, VSS deletion, auto-isolation triggers
+
MITRE T1486
+
+
+
💥
+
Vuln Exploits
+
CVE references, IDS signatures, service crash signatures
+
CVSS 7.0–10.0
+
+
+
+
+ + +
+
Under the hood
+

GPT architecture,
built from scratch

+ +
+
+
Model Stack
+ +
+ Token + Position Embeddings + vocab_size × 256 +
+
+ +
+
× 6 TRANSFORMER BLOCKS
+
+ Multi-Head Attention + 8 heads · 32 dim each +
+
+ Feed-Forward Network + 256 → 1024 → 256 +
+
+
+ +
+ Layer Norm + LM Head + → vocab_size logits +
+
+ +
+ Softmax + Sampling + temperature · top-k +
+ +
+ 5,234,688 total parameters
+ 256 context length (chars)
+ ~84% cross-val accuracy
+ 15 min training time (T4 GPU) +
+
+ +
+
+
🎯
+
+

Same architecture as GPT-2

+

Attention mechanism, residual connections, layer norm — identical to OpenAI's GPT-2. Just smaller scale. The difference is data and compute, not architecture.

+
+
+
+
🔬
+
+

Character-level tokenization

+

No BPE, no vocabulary file. Every character is a token. This makes the model learn IP address patterns, port numbers, and log formats as raw character sequences.

+
+
+
+
⚡
+
+

Trained end-to-end in PyTorch

+

Zero dependencies beyond PyTorch. No Hugging Face Transformers, no pre-trained weights. Every weight initialized from scratch and trained on the security log dataset.

+
+
+
+
🧠
+
+

Causal self-attention

+

The model can only attend to previous characters — never the future. This is what makes it a language model. The triangular mask enforces this constraint at every layer.

+
+
+
+
+
+ + +
+
+
Export
+

3 output formats

+

Every generation can be exported in the format your toolchain expects. Max 500 lines per request.

+ +
+
+
.log
+
Plain Syslog
+
Raw log lines exactly as they would appear in /var/log/. Drop directly into any SIEM or log analyzer.
+
+
Splunk / Elastic SIEM
+
Detection rule testing
+
SOC analyst training
+
+
2024-03-17 02:14:33 web01 sshd[4821]: Failed password for admin from 185.220.101.34 port 52847 ssh2
+
+ +
+
.json
+
Structured JSON
+
Each log line wrapped in a structured object with metadata — ID, attack type, timestamp, and model attribution.
+
+
API / pipeline ingestion
+
ML dataset creation
+
Custom parsers
+
+
{"id":1,"raw":"Failed password...","attack_type":"ssh","generated_at":"2024-03-17T02:14:33Z"}
+
+ +
+
.csv
+
CSV Spreadsheet
+
Comma-separated with id, timestamp, raw log, and attack type columns. Ready for Excel, pandas, or Splunk import.
+
+
Spreadsheet analysis
+
Splunk batch import
+
pandas / data science
+
+
id,timestamp,raw_log,attack_type
1,2024-03-17 02:14:33,"Failed password...",ssh
+
+
+
+
+ + + +
+
+ +
+ // Proof of Training +
+

+ Trained from scratch.
Not a wrapper. +

+

+ Every weight initialized from random noise. 5,000 training steps later — + 94% loss reduction from baseline. Here's the proof. +

+ + +
+
+
0.24
+
Final Loss
+
started at 4.41
+
+
+
94%
+
Reduction
+
from random baseline
+
+
+
5.2M
+
Parameters
+
trained end-to-end
+
+
+
~15m
+
Train Time
+
single T4 GPU
+
+
+ + +
+ +
+
+ Loss Curve + 4.41 → 0.24 +
+ Training Loss Curve +
+ Train loss (blue) and val loss (red) nearly identical — zero overfitting. + Model converged by step 2000 and held steady. +
+
+ +
+
+ Attention Weights — Layer 0 + 8 heads +
+ Attention Heatmaps +
+ Each heatmap = one attention head. Diagonal pattern = local character attention. + Different heads learned different log structure rules simultaneously. +
+
+ +
+ + +
+ 6 transformer layers + 8 attention heads + 256 embedding dim + 256 char context + character-level tokenizer + same architecture as GPT-2 +
+ +
+
+ + +
+
+
Ready
+

Start generating
security logs

+

Free, permanent hosting on Hugging Face Spaces. No signup required. Up to 500 log lines per request.

+
+ ⚡ Launch Generator + View on GitHub +
+
+ + + + + + + \ No newline at end of file