Update README.md

README.md

@@ -13,33 +13,36 @@ base_model:
 - Qwen/Qwen2.5-0.5B
 ---
 
-# 🛡️ MCMA — Malware Cybersecurity Malware Analyzer
+# 📊 SMITH — Static Malware Interpreter & Threat Heuristic
 
-**Model:** `zeltera/mcma`  
-**Task:** Static malware analysis and interpretation  
-**Domain:** Cybersecurity & Threat Intelligence  
-**Hosted on:** Hugging Face Models
+**SMITH (Static Malware Interpreter & Threat Heuristic)** is a transformer-based artificial intelligence model designed for structured and interpretable static malware analysis. Built through parameter-efficient fine-tuning (LoRA) on top of a Qwen2.5 backbone and augmented with retrieval-based threat context, SMITH generates JSON-formatted output that includes reasoning, identified indicators, confidence scores, actionable recommendations, and MITRE ATT&CK technique mappings. This makes SMITH a valuable tool for cybersecurity analysts, automation systems, and threat intelligence pipelines.
 
 ---
 
-## 🧠 Model Overview
+## 🧠 Model Description
 
-**MCMA** (Malware Cybersecurity Malware Analyzer) is a custom fine-tuned language model built to analyze malware artifacts and descriptions. It was trained using parameter-efficient fine-tuning (LoRA) on top of a Qwen2.5 base model using curated cybersecurity instruction data. Its outputs are **structured JSON**, including reasoning, indicators, confidence, recommendations, and mapped MITRE ATT&CK techniques.
+SMITH is a domain-specialized large language model tailored for static analysis of malware artifacts and descriptions. It interprets features such as permissions, API calls, imported functions, and known Indicators of Compromise (IoC), and produces structured, machine-readable assessments that can be integrated into analysis workflows or SOC automation.
 
-MCMA is optimized for **static analysis scenarios**—it interprets textual malware features, permissions, string indicators, and other static traits to produce analyst-friendly assessments.
+The model combines:
+- **Fine-tuned transformer intelligence** for reasoning over static features
+- **Retrieval-augmented context** from a curated threat corpus
+- **Structured output** for easy integration with tools and scripts
+
+SMITH is optimized to run on practical hardware while delivering interpretable cybersecurity insights.
 
 ---
 
 ## 🎯 Intended Use Cases
 
-MCMA is useful for:
-- Analyzing static malware artifacts (e.g., APK or PE strings/permissions)
-- Extracting structured threat intelligence
-- Mapping behaviors to MITRE ATT&CK
-- Integrating into analysis pipelines (SIEM, CTI platforms)
-- Supporting SOC analysts with natural language reasoning
+SMITH is intended for **defensive cybersecurity applications**, including:
+
+- Interpreting static malware artifacts (e.g., APK metadata, PE strings)
+- Producing structured JSON analysis suitable for automation
+- Mapping malware behavior to MITRE ATT&CK techniques
+- Assisting security analysts with context-aware reasoning
+- Generating YARA rules based on detected indicators
 
-> ⚠️ **Important:** This model does *not* execute binaries or perform dynamic analysis.
+> ⚠️ **Static analysis only — SMITH does NOT execute malware or perform dynamic analysis.**
 
 ---
 
@@ -49,9 +52,9 @@ MCMA is useful for:
 from transformers import AutoTokenizer, AutoModelForCausalLM
 import torch
 
-model_id = "zeltera/mcma"
+model_id = "zeltera/mcma"  # or "zeltera/smith" if renamed
 
-tokenizer = AutoTokenizer.from_pretrained(model_id, local_files_only=True)
+tokenizer = AutoTokenizer.from_pretrained(model_id)
 model = AutoModelForCausalLM.from_pretrained(
     model_id,
     device_map="auto",
@@ -60,7 +63,7 @@ model = AutoModelForCausalLM.from_pretrained(
 
 prompt = """
 You are a cybersecurity malware analysis assistant.
-Respond ONLY in valid JSON with these keys:
+Respond ONLY in valid JSON with these fields:
 - reasoning
 - indicators
 - confidence
@@ -72,43 +75,42 @@ APK requests READ_SMS and communicates with api.telegram.org
 """
 
 inputs = tokenizer(prompt, return_tensors="pt").to(model.device)
-
 outputs = model.generate(**inputs, max_new_tokens=300)
+
 print(tokenizer.decode(outputs[0], skip_special_tokens=True))
+```
+🧠 Model Architecture and Training
 
-📦 Model Details
+Base Model: Qwen2.5 family (compact, efficient)
 
-Architecture: Qwen2.5-based
-Fine-tuning: LoRA on cybersecurity datasets
-Output: Structured JSON
-Usage: Python / Transformers
+Fine-Tuning: LoRA with domain-specific malware analysis examples
+
+Output Format: Structured JSON
+
+Hardware: Designed for inference on commodity GPUs and CPU environments
 
 ⚠️ Limitations
 
-Designed for static analysis only
+SMITH is strictly for static analysis of malware descriptions.
 
-Outputs should be reviewed by trained analysts
+Does not execute or sandbox any executable or mobile binary.
 
-Confidence scores are heuristic, not absolute
+Analysis should be reviewed by qualified security staff.
 
-Not a sandbox, emulator, or malware execution platform
+Confidence scores are heuristic and not absolute.
 
-🧪 Safety & Ethical Use
+📚 Ethical and Safe Use
 
-MCMA is intended for defensive cybersecurity use, including malware forensic and threat analysis. It must not be used to assist in creating malware or harmful software. Users should operate within legal and ethical frameworks relevant to their jurisdiction.
+SMITH is intended for defensive cybersecurity and threat intelligence purposes. It should not be used to generate or assist in creating malware, malicious code, or harmful artifacts. Users should comply with all relevant laws and organizational policies.
 
-📚 Citation
+📜 Citation
 
-If you use this model in research or production:
+If you use this model in research or deployment:
 
-@misc{mcma2025,
-  title={MCMA — Malware Cybersecurity Malware Analyzer LLM},
+@misc{smith2025,
+  title={SMITH — Static Malware Interpreter & Threat Heuristic},
   author={Zeltera},
   year={2025},
   howpublished={Hugging Face Model},
-  note={https://huggingface.co/zeltera/mcma}
-}
-
-🧠 About
-
-MCMA was developed to bridge language modeling with cybersecurity domain expertise. It combines transformer-based reasoning with structured static malware feature interpretation to assist analysts in real-world threat environments.
+  note={\url{https://huggingface.co/zeltera/SMITH}}
+}