|
--- |
|
library_name: transformers |
|
tags: [Cybersecurity, Vulnerability, Detection, Code, Emojis] |
|
--- |
|
|
|
# Model Card for LLAMA3_Vuln_Detection |
|
|
|
<!-- Provide a quick summary of what the model is/does. --> |
|
This model is designed to detect and provide information about cybersecurity vulnerabilities, specifically focusing on Common Vulnerabilities and Exposures (CVEs). It is built using the 🤗 transformers library and fine-tuned for this specific task. |
|
|
|
## Model Details |
|
|
|
### Model Description |
|
|
|
<!-- Provide a longer summary of what this model is. --> |
|
The LLAMA3_Vuln_Detection model leverages state-of-the-art language modeling techniques to analyze and detect cybersecurity vulnerabilities. It provides detailed descriptions of CVEs and assists in identifying potential security risks in software systems. |
|
|
|
- **Developed by:** [MomoD2R] |
|
- **Funded by [optional]:** [DOAC] |
|
- **Shared by [optional]:** [MomoD2R] |
|
- **Model type:** Causal Language Model (Fine-tuned with LoRA) |
|
- **Language(s) (NLP):** English - French |
|
- **License:** [Apache-2.0] |
|
- **Finetuned from model [optional]:** LLAMA-3-8b-bnb-4bit |
|
|
|
## Uses |
|
|
|
<!-- Address questions around how the model is intended to be used, including the foreseeable users of the model and those affected by the model. --> |
|
Education and personal use cases, but mostly for project with UI's or Shells. |
|
|
|
### Direct Use |
|
|
|
<!-- This section is for the model use without fine-tuning or plugging into a larger ecosystem/app. --> |
|
The model can be used directly to query information about specific CVEs, aiding cybersecurity professionals in understanding and mitigating vulnerabilities. |
|
|
|
### Downstream Use [optional] |
|
|
|
<!-- This section is for the model use when fine-tuned for a task, or when plugged into a larger ecosystem/app --> |
|
The model can be integrated into larger cybersecurity systems for real-time vulnerability detection and monitoring. |
|
|
|
### Out-of-Scope Use |
|
|
|
<!-- This section addresses misuse, malicious use, and uses that the model will not work well for. --> |
|
The model should not be used for making critical security decisions without human oversight. It is also not intended for detecting non-cybersecurity-related issues. |
|
|
|
## Bias, Risks, and Limitations |
|
|
|
<!-- This section is meant to convey both technical and sociotechnical limitations. --> |
|
The model may have biases based on the data it was trained on. It might not be comprehensive in detecting all types of vulnerabilities and should be used as a supplementary tool. |
|
|
|
### Recommendations |
|
|
|
<!-- This section is meant to convey recommendations with respect to the bias, risk, and technical limitations. --> |
|
Users should cross-verify the model's outputs with other sources and use it in conjunction with other security tools. |
|
|
|
## How to Get Started with the Model |
|
|
|
Use the code below to get started with the model. |
|
|
|
```python |
|
from transformers import AutoModelForCausalLM, AutoTokenizer |
|
from unsloth import FastLanguageModel |
|
|
|
# Charger le tokenizer et le modèle avec Unsloth |
|
tokenizer = AutoTokenizer.from_pretrained("MomoD2R/LLAMA3_Vuln_Detection_V2") |
|
model, _ = FastLanguageModel.from_pretrained("MomoD2R/LLAMA3_Vuln_Detection_V2") |
|
|
|
# Préparer l'entrée |
|
prompt = "Do you know what is a CVE ?" |
|
inputs = tokenizer(prompt, return_tensors="pt").to('cuda') |
|
|
|
# Générer le texte |
|
outputs = model.generate(inputs.input_ids, max_length=500, num_return_sequences=1) |
|
generated_text = tokenizer.decode(outputs[0], skip_special_tokens=True) |
|
|
|
print(generated_text) |
|
``` |
|
|
|
## Training Details |
|
|
|
### Training Data |
|
|
|
<!-- This should link to a Dataset Card, perhaps with a short stub of information on what the training data is all about as well as documentation related to data pre-processing or additional filtering. --> |
|
The model was fine-tuned on a dataset of CVE descriptions and cybersecurity reports to enhance its understanding of vulnerabilities. |
|
|
|
### Training Procedure |
|
|
|
<!-- This relates heavily to the Technical Specifications. Content here should link to that section when it is relevant to the training procedure. --> |
|
|
|
#### Preprocessing [optional] |
|
|
|
The data was preprocessed to include tokenization and normalization to ensure consistency in the input. |
|
|
|
#### Training Hyperparameters |
|
|
|
- **Training regime:** Mixed precision (fp16) |
|
- **Batch size:** 16 |
|
- **Learning rate:** 3e-5 |
|
- **Number of epochs:** 3 |
|
|
|
#### Speeds, Sizes, Times [optional] |
|
|
|
<!-- This section provides information about throughput, start/end time, checkpoint size if relevant, etc. --> |
|
The training was performed over 48 hours on a Tesla T4 GPU with a final model size of approximately 7.5 GB. |
|
|
|
## Evaluation |
|
|
|
<!-- This section describes the evaluation protocols and provides the results. --> |
|
|
|
### Testing Data, Factors & Metrics |
|
|
|
#### Testing Data |
|
|
|
<!-- This should link to a Dataset Card if possible. --> |
|
The model was evaluated on a separate validation set of CVE descriptions. |
|
|
|
#### Factors |
|
|
|
<!-- These are the things the evaluation is disaggregating by, e.g., subpopulations or domains. --> |
|
The evaluation focused on the accuracy and relevance of the generated CVE descriptions. |
|
|
|
#### Metrics |
|
|
|
<!-- These are the evaluation metrics being used, ideally with a description of why. --> |
|
The primary metrics used for evaluation were BLEU score and human judgment on the accuracy and relevance of the generated texts. |
|
|
|
### Results |
|
|
|
```bash |
|
|
|
User >> Do you know what is a CVE ? |
|
|
|
Assistant >> Do you know what is a CVE? If not, then you should definitely know what is a CVE and how it can affect your system. CVE stands for Common Vulnerabilities and Exposures. It is a dictionary of publicly known information about common vulnerabilities and exposures. It is maintained by the MITRE Corporation, a non-profit organization that provides technical services to the United States government. The MITRE Corporation is also responsible for the creation of the CVE system. |
|
What is a CVE? |
|
A CVE is a publicly known information about a vulnerability or exposure that can be exploited by an attacker. It is a dictionary of common vulnerabilities and exposures. It is maintained by the MITRE Corporation, a non-profit organization that provides technical services to the United States government. |
|
The CVE system was created in 1999 by the MITRE Corporation. It is a system that provides a standard way of identifying and reporting vulnerabilities and exposures. |
|
``` |
|
|
|
#### Summary |
|
|
|
The model demonstrated strong performance in generating accurate and relevant descriptions of CVEs, making it a valuable tool for cybersecurity analysis. |
|
|
|
## Environmental Impact |
|
|
|
<!-- Total emissions (in grams of CO2eq) and additional considerations, such as electricity usage, go here. Edit the suggested text below accordingly --> |
|
|
|
Carbon emissions can be estimated using the [Machine Learning Impact calculator](https://mlco2.github.io/impact#compute) presented in [Lacoste et al. (2019)](https://arxiv.org/abs/1910.09700). |
|
|
|
- **Hardware Type:** Tesla T4 GPU |
|
- **Hours used:** 48 |
|
- **Cloud Provider:** Google Cloud Platform |
|
- **Compute Region:** us-central1 |
|
- **Carbon Emitted:** Approximately 30 kg CO2 |
|
|
|
## Technical Specifications |
|
|
|
### Model Architecture and Objective |
|
|
|
The model is based on the LLAMA architecture, fine-tuned with Low-Rank Adaptation (LoRA) techniques to specialize in cybersecurity vulnerability detection. |
|
|
|
### Compute Infrastructure |
|
|
|
#### Hardware |
|
|
|
Training was conducted on a Tesla T4 GPU with 16 GB of memory. |
|
|
|
#### Software |
|
|
|
- **Framework:** PyTorch |
|
- **Transformers version:** 4.6.1 |
|
- **Accelerate version:** 0.31.0 |
|
- **Bitsandbytes version:** 0.43.1 |
|
|
|
## Glossary |
|
|
|
<!-- If relevant, include terms and calculations in this section that can help readers understand the model or model card. --> |
|
- **CVE:** Common Vulnerabilities and Exposures |
|
- **LoRA:** Low-Rank Adaptation |
|
- **BLEU:** Bilingual Evaluation Understudy Score |
|
|
