vibesecurityguy
/

veris-classifier-v1

@@ -1,199 +1,113 @@
 ---
-library_name: transformers
-tags: []
 ---
-# Model Card for Model ID
-<!-- Provide a quick summary of what the model is/does. -->
-## Model Details
-### Model Description
-<!-- Provide a longer summary of what this model is. -->
-This is the model card of a 🤗 transformers model that has been pushed on the Hub. This model card has been automatically generated.
-- **Developed by:** [More Information Needed]
-- **Funded by [optional]:** [More Information Needed]
-- **Shared by [optional]:** [More Information Needed]
-- **Model type:** [More Information Needed]
-- **Language(s) (NLP):** [More Information Needed]
-- **License:** [More Information Needed]
-- **Finetuned from model [optional]:** [More Information Needed]
-### Model Sources [optional]
-<!-- Provide the basic links for the model. -->
-- **Repository:** [More Information Needed]
-- **Paper [optional]:** [More Information Needed]
-- **Demo [optional]:** [More Information Needed]
-## Uses
-<!-- Address questions around how the model is intended to be used, including the foreseeable users of the model and those affected by the model. -->
-### Direct Use
-<!-- This section is for the model use without fine-tuning or plugging into a larger ecosystem/app. -->
-[More Information Needed]
-### Downstream Use [optional]
-<!-- This section is for the model use when fine-tuned for a task, or when plugged into a larger ecosystem/app -->
-[More Information Needed]
-### Out-of-Scope Use
-<!-- This section addresses misuse, malicious use, and uses that the model will not work well for. -->
-[More Information Needed]
-## Bias, Risks, and Limitations
-<!-- This section is meant to convey both technical and sociotechnical limitations. -->
-[More Information Needed]
-### Recommendations
-<!-- This section is meant to convey recommendations with respect to the bias, risk, and technical limitations. -->
-Users (both direct and downstream) should be made aware of the risks, biases and limitations of the model. More information needed for further recommendations.
-## How to Get Started with the Model
-Use the code below to get started with the model.
-[More Information Needed]
 ## Training Details
-### Training Data
-<!-- This should link to a Dataset Card, perhaps with a short stub of information on what the training data is all about as well as documentation related to data pre-processing or additional filtering. -->
-[More Information Needed]
-### Training Procedure
-<!-- This relates heavily to the Technical Specifications. Content here should link to that section when it is relevant to the training procedure. -->
-#### Preprocessing [optional]
-[More Information Needed]
-#### Training Hyperparameters
-- **Training regime:** [More Information Needed] <!--fp32, fp16 mixed precision, bf16 mixed precision, bf16 non-mixed precision, fp16 non-mixed precision, fp8 mixed precision -->
-#### Speeds, Sizes, Times [optional]
-<!-- This section provides information about throughput, start/end time, checkpoint size if relevant, etc. -->
-[More Information Needed]
-## Evaluation
-<!-- This section describes the evaluation protocols and provides the results. -->
-### Testing Data, Factors & Metrics
-#### Testing Data
-<!-- This should link to a Dataset Card if possible. -->
-[More Information Needed]
-#### Factors
-<!-- These are the things the evaluation is disaggregating by, e.g., subpopulations or domains. -->
-[More Information Needed]
-#### Metrics
-<!-- These are the evaluation metrics being used, ideally with a description of why. -->
-[More Information Needed]
-### Results
-[More Information Needed]
-#### Summary
-## Model Examination [optional]
-<!-- Relevant interpretability work for the model goes here -->
-[More Information Needed]
-## Environmental Impact
-<!-- Total emissions (in grams of CO2eq) and additional considerations, such as electricity usage, go here. Edit the suggested text below accordingly -->
-Carbon emissions can be estimated using the [Machine Learning Impact calculator](https://mlco2.github.io/impact#compute) presented in [Lacoste et al. (2019)](https://arxiv.org/abs/1910.09700).
-- **Hardware Type:** [More Information Needed]
-- **Hours used:** [More Information Needed]
-- **Cloud Provider:** [More Information Needed]
-- **Compute Region:** [More Information Needed]
-- **Carbon Emitted:** [More Information Needed]
-## Technical Specifications [optional]
-### Model Architecture and Objective
-[More Information Needed]
-### Compute Infrastructure
-[More Information Needed]
-#### Hardware
-[More Information Needed]
-#### Software
-[More Information Needed]
-## Citation [optional]
-<!-- If there is a paper or blog post introducing the model, the APA and Bibtex information for that should go in this section. -->
-**BibTeX:**
-[More Information Needed]
-**APA:**
-[More Information Needed]
-## Glossary [optional]
-<!-- If relevant, include terms and calculations in this section that can help readers understand the model or model card. -->
-[More Information Needed]
-## More Information [optional]
-[More Information Needed]
-## Model Card Authors [optional]
-[More Information Needed]
-## Model Card Contact
-[More Information Needed]

 ---
+library_name: peft
+license: apache-2.0
+base_model: Qwen/Qwen2.5-7B-Instruct
+tags:
+  - veris
+  - cybersecurity
+  - incident-classification
+  - lora
+  - qlora
+  - qwen2
+datasets:
+  - vibesecurityguy/veris-classifier-training
+  - vibesecurityguy/veris-incident-classifications
+language:
+  - en
+pipeline_tag: text-generation
 ---
+# VERIS Classifier v1
+A fine-tuned [Qwen2.5-7B-Instruct](https://huggingface.co/Qwen/Qwen2.5-7B-Instruct) model that classifies cybersecurity incident descriptions into the [VERIS](http://veriscommunity.net/) (Vocabulary for Event Recording and Incident Sharing) framework.
+Given a plain-English incident description, the model outputs structured JSON with the correct VERIS categories for **action**, **actor**, **asset**, and **attribute**.
+## Example
+**Input:**
+> An employee at a hospital clicked a phishing email, which installed ransomware that encrypted patient records.
+**Output:**
+```json
+{
+  "action": {"hacking": {"variety": ["Ransomware"]}, "social": {"variety": ["Phishing"]}},
+  "actor": {"external": {"variety": ["Unaffiliated"], "motive": ["Financial"]}},
+  "asset": {"assets": [{"variety": "S - Database"}]},
+  "attribute": {"availability": {"variety": ["Obscuration"]}}
+}
+```
 ## Training Details
+| Parameter | Value |
+|-----------|-------|
+| **Base model** | Qwen/Qwen2.5-7B-Instruct |
+| **Method** | QLoRA (4-bit NF4 quantization + LoRA) |
+| **LoRA rank (r)** | 16 |
+| **LoRA alpha** | 32 |
+| **LoRA dropout** | 0.05 |
+| **Target modules** | All linear (q, k, v, o, gate, up, down) |
+| **Trainable parameters** | 40.4M / 4.4B (0.92%) |
+| **Training examples** | 9,813 train / 517 eval |
+| **Epochs** | 3 |
+| **Batch size** | 2 x 4 gradient accumulation = 8 effective |
+| **Learning rate** | 2e-4 (cosine schedule, 10% warmup) |
+| **Precision** | bf16 |
+| **Optimizer** | AdamW |
+| **Max sequence length** | 2,048 tokens |
+| **Hardware** | NVIDIA A10G (24GB VRAM) |
+| **Adapter size** | 162 MB |
+## Training Data
+Fine-tuned on [vibesecurityguy/veris-classifier-training](https://huggingface.co/datasets/vibesecurityguy/veris-classifier-training), which contains:
+- **10,019 classification examples** — synthetic incident descriptions generated from real [VCDB](https://github.com/vz-risk/VCDB) (Verizon Community Database) records, paired with their ground-truth VERIS classifications
+- **311 Q&A pairs** — questions and answers about the VERIS framework itself
+The source classifications come from 8,559 real-world incidents in VCDB, spanning healthcare, finance, retail, government, and other industries.
+## How to Use
+### With Transformers + PEFT
+```python
+from transformers import AutoModelForCausalLM, AutoTokenizer
+from peft import PeftModel
+base_model = "Qwen/Qwen2.5-7B-Instruct"
+adapter = "vibesecurityguy/veris-classifier-v1"
+tokenizer = AutoTokenizer.from_pretrained(base_model)
+model = AutoModelForCausalLM.from_pretrained(base_model, device_map="auto")
+model = PeftModel.from_pretrained(model, adapter)
+messages = [
+    {"role": "system", "content": "You are a VERIS classification expert..."},
+    {"role": "user", "content": "Classify this incident: An employee lost a laptop containing unencrypted customer data."}
+]
+text = tokenizer.apply_chat_template(messages, tokenize=False, add_generation_prompt=True)
+inputs = tokenizer(text, return_tensors="pt").to(model.device)
+outputs = model.generate(**inputs, max_new_tokens=512)
+print(tokenizer.decode(outputs[0], skip_special_tokens=True))
+```
+## Intended Use
+This model is designed for:
+- Classifying cybersecurity incidents into the VERIS framework
+- Answering questions about VERIS categories and taxonomy
+- Assisting incident response teams with structured data entry
+## Limitations
+- **VCDB bias**: Training data over-represents healthcare (HIPAA mandatory disclosure) and US-based incidents
+- **Schema version**: Trained primarily on VERIS 1.3.x schema; may not cover all 1.4 additions
+- **Not a replacement for human analysis**: Output should be reviewed by a security analyst
+- **English only**: Trained on English-language incident descriptions
+## Model Card Authors
+Peter Shamoon ([@vibesecurityguy](https://huggingface.co/vibesecurityguy))