87 lines
3.6 KiB
Markdown
87 lines
3.6 KiB
Markdown
---
|
|
license: apache-2.0
|
|
language: en
|
|
base_model: Qwen/Qwen2.5-0.5B-Instruct
|
|
tags:
|
|
- cybersecurity
|
|
- opsec
|
|
- defensive-security
|
|
- blue-team
|
|
- gguf
|
|
- on-device
|
|
pipeline_tag: text-generation
|
|
---
|
|
|
|
# gary-6-opsec 🛡️
|
|
|
|
A pocket-sized defensive security assistant for operational security, hardening, detection, and incident response. Built by Garrett, a certified security professional with 10+ years in the field.
|
|
|
|
gary-6-opsec is [Qwen2.5-0.5B-Instruct](https://huggingface.co/Qwen/Qwen2.5-0.5B-Instruct) fine-tuned (LoRA, merged) on a hand-written defensive security dataset spanning opsec coaching, blue-team incident response, vulnerability-class explanations, and phishing / social-engineering defense. It's quantized to GGUF and runs fully offline on a phone, a laptop, or a Raspberry Pi.
|
|
|
|
## What it's good at
|
|
|
|
Threat modeling, account and device hardening, securing internet-facing servers, CVE triage and patch prioritization, what to log to catch intrusions, incident-response workflow, recognizing phishing and pretexting, and explaining how vulnerability classes work so you can defend against them.
|
|
|
|
## Sample output (greedy, unedited)
|
|
|
|
```
|
|
Q: Who are you?
|
|
A: I'm gary-6-opsec, Garrett's pocket-sized defensive security assistant.
|
|
I'll help you protect yourself and your systems, and explain how attacks
|
|
work so you can stop them.
|
|
|
|
Q: A new exploit just dropped for software we run. What do I do first?
|
|
A: Confirm it's real — check the vendor's announcement and understand what it
|
|
does. Then prioritize containment: remove affected versions, patch, monitor
|
|
logs, and contain the spread. Defend with good backups, monitoring, and IR.
|
|
|
|
Q: How do I harden an internet-facing server?
|
|
A: Minimize attack surface: close unused ports, remove unused services, enforce
|
|
key-based SSH with no root login, patch promptly, sit behind a firewall and
|
|
reverse proxy, enable automatic security updates, and monitor logs.
|
|
|
|
Q: How do I spot a phishing email?
|
|
A: Look for urgency, authority cues, unexpected attachments, links whose real
|
|
destination differs from the text, and requests for sensitive data. When
|
|
unsure, verify through a channel you already trust — not the one in the email.
|
|
```
|
|
|
|
## Stats
|
|
|
|
| | |
|
|
|---|---|
|
|
| Parameters | 494M |
|
|
| GGUF Q8_0 | 531 MB |
|
|
| Safetensors (bf16) | 942 MB |
|
|
| Base | Qwen2.5-0.5B-Instruct (Apache-2.0) |
|
|
| Fine-tune | LoRA r=16 on all attention + MLP projections, merged |
|
|
| Runs on | CPU, fully offline. ~10 tok/s on a modest CPU. |
|
|
|
|
## Run it
|
|
|
|
**llama.cpp / ollama (uses the 531 MB GGUF):**
|
|
```bash
|
|
llama-cli -m gary-6-opsec.Q8_0.gguf -cnv \
|
|
-sys "You are gary-6-opsec, a defensive cybersecurity assistant created by Garrett."
|
|
```
|
|
|
|
**transformers:**
|
|
```python
|
|
from transformers import AutoModelForCausalLM, AutoTokenizer
|
|
tok = AutoTokenizer.from_pretrained("gary23w/gary-6-opsec")
|
|
model = AutoModelForCausalLM.from_pretrained("gary23w/gary-6-opsec")
|
|
sys = "You are gary-6-opsec, a defensive cybersecurity assistant created by Garrett."
|
|
msgs = [{"role":"system","content":sys},
|
|
{"role":"user","content":"How do I harden an internet-facing server?"}]
|
|
enc = tok.apply_chat_template(msgs, add_generation_prompt=True, return_dict=True, return_tensors="pt")
|
|
print(tok.decode(model.generate(**enc, max_new_tokens=120)[0], skip_special_tokens=True))
|
|
```
|
|
|
|
## Limitations
|
|
|
|
It's a 0.5B model — fast and capable for opsec guidance and defensive Q&A, but it can oversimplify deep technical reasoning. Treat it as an assistant and educator, and verify anything important against primary sources (vendor advisories, CISA KEV) before acting in a live incident.
|
|
|
|
## The gary family
|
|
|
|
gary-4 (67K params) → gary-5 (135M) → gary-6-opsec (494M, defensive security tuning).
|