commit f10d3442374777f3d6f9da96d0cd58026377edbe Author: ModelHub XC Date: Mon Oct 5 09:01:17 2026 +0800 初始化项目，由ModelHub XC社区提供模型 Model: radheneev/socpilot-0.5b Source: Original Platform diff --git a/.gitattributes b/.gitattributes new file mode 100644 index 0000000..52373fe --- /dev/null +++ b/.gitattributes @@ -0,0 +1,36 @@ +*.7z filter=lfs diff=lfs merge=lfs -text +*.arrow filter=lfs diff=lfs merge=lfs -text +*.bin filter=lfs diff=lfs merge=lfs -text +*.bz2 filter=lfs diff=lfs merge=lfs -text +*.ckpt filter=lfs diff=lfs merge=lfs -text +*.ftz filter=lfs diff=lfs merge=lfs -text +*.gz filter=lfs diff=lfs merge=lfs -text +*.h5 filter=lfs diff=lfs merge=lfs -text +*.joblib filter=lfs diff=lfs merge=lfs -text +*.lfs.* filter=lfs diff=lfs merge=lfs -text +*.mlmodel filter=lfs diff=lfs merge=lfs -text +*.model filter=lfs diff=lfs merge=lfs -text +*.msgpack filter=lfs diff=lfs merge=lfs -text +*.npy filter=lfs diff=lfs merge=lfs -text +*.npz filter=lfs diff=lfs merge=lfs -text +*.onnx filter=lfs diff=lfs merge=lfs -text +*.ot filter=lfs diff=lfs merge=lfs -text +*.parquet filter=lfs diff=lfs merge=lfs -text +*.pb filter=lfs diff=lfs merge=lfs -text +*.pickle filter=lfs diff=lfs merge=lfs -text +*.pkl filter=lfs diff=lfs merge=lfs -text +*.pt filter=lfs diff=lfs merge=lfs -text +*.pth filter=lfs diff=lfs merge=lfs -text +*.rar filter=lfs diff=lfs merge=lfs -text +*.safetensors filter=lfs diff=lfs merge=lfs -text +saved_model/**/* filter=lfs diff=lfs merge=lfs -text +*.tar.* filter=lfs diff=lfs merge=lfs -text +*.tar filter=lfs diff=lfs merge=lfs -text +*.tflite filter=lfs diff=lfs merge=lfs -text +*.tgz filter=lfs diff=lfs merge=lfs -text +*.wasm filter=lfs diff=lfs merge=lfs -text +*.xz filter=lfs diff=lfs merge=lfs -text +*.zip filter=lfs diff=lfs merge=lfs -text +*.zst filter=lfs diff=lfs merge=lfs -text +*tfevents* filter=lfs diff=lfs merge=lfs -text +tokenizer.json filter=lfs diff=lfs merge=lfs -text diff --git a/README.md b/README.md new file mode 100644 index 0000000..fbf0685 --- /dev/null +++ b/README.md @@ -0,0 +1,117 @@ +--- +license: apache-2.0 +language: +- en +library_name: transformers +tags: +- cybersecurity +- soc-automation +- siem +- suricata +- security-operations +- threat-detection +- alert-triage +- lora +- qwen2.5 +pipeline_tag: text-generation +metrics: +- accuracy +model-index: +- name: socpilot-0.5b + results: + - task: + type: text-generation + name: Security Alert Triage + metrics: + - type: accuracy + value: 99.99 + name: Priority Classification +base_model: +- Qwen/Qwen2.5-0.5B-Instruct +--- +# SOCPilot-0.5B: Your AI Copilot for Security Operations + +**Open-source SIEM-specialized AI model** | **Production ready** + +[![Model](https://img.shields.io/badge/🤗-Model-yellow)](https://huggingface.co/radherackbank/socpilot-0.5b) +[![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](LICENSE) +[![Accuracy](https://img.shields.io/badge/accuracy-99.99%25-green)]() + +## Overview + +SOCPilot is the **open-source AI model specialized for SIEM alert triage**. Built on Qwen2.5-0.5B and fine-tuned on 100,000 real security alerts, it automates Security Operations Center workflows with production-grade accuracy. + +## Use Cases + +### Current (v1.0) +- Automated Suricata IDS/IPS alert triage +- Reduce alert fatigue by 70-80% +- Speed up incident response +- Identify critical threats vs noise +- SOC analyst training and validation + +## Basic Usage + +The model can be loaded using Hugging Face Transformers: +``` +AutoModelForCausalLM.from_pretrained("radherackbank/socpilot-0.5b") +AutoTokenizer.from_pretrained("radherackbank/socpilot-0.5b") +``` + +## Technical Details + +### Model Architecture +- **Base Model:** Qwen2.5-0.5B-Instruct (494M parameters) +- **Fine-tuning Method:** LoRA (Low-Rank Adaptation) + - Rank: 16 + - Alpha: 32 + - Target modules: q_proj, k_proj, v_proj, o_proj, gate_proj, up_proj, down_proj + - Trainable parameters: 8.8M (1.78% of total) +- **Quantization:** 4-bit NF4 +- **Precision:** BFloat16 mixed precision + +### Training Details +- **Dataset:** 100,000 real Suricata eve.json alerts +- **Split:** 90,000 training, 10,000 validation +- **Framework:** HuggingFace Transformers + PEFT +- **Optimizer:** PagedAdamW (8-bit) + +## Limitations + +- Trained specifically on Suricata eve.json format +- May not generalize to other SIEM formats +- Small model size (0.5B parameters) - larger versions planned +- Requires GPU for optimal performance +- May hallucinate on very rare or novel attack patterns +- Accuracy is reported on an internal validation dataset and should not be interpreted as a guarantee of performance in all environments. + +## License + +Apache License 2.0 - Free for commercial and research use + +This license includes an explicit grant of patent rights from contributors. + +## Acknowledgments + +- Built on **Qwen2.5-0.5B-Instruct** (Apache 2.0) +- Fine-tuned on 100K real security alerts + +## Contributing + +Interested in contributing? We welcome: +- Additional SIEM format support +- Evaluation datasets and benchmarks +- Bug reports and fixes +- Documentation improvements +- Integration examples + +--- +## Intended Use + + This model is intended to assist SOC analysts with alert triage and prioritization. + It is designed as a decision-support tool. + +## Not Intended Use + This model is not intended to replace human analysts or perform autonomous incident response. + +**Making SOC operations intelligent, one alert at a time** diff --git a/chat_template.jinja b/chat_template.jinja new file mode 100644 index 0000000..bdf7919 --- /dev/null +++ b/chat_template.jinja @@ -0,0 +1,54 @@ +{%- if tools %} + {{- '<|im_start|>system\n' }} + {%- if messages[0]['role'] == 'system' %} + {{- messages[0]['content'] }} + {%- else %} + {{- 'You are Qwen, created by Alibaba Cloud. You are a helpful assistant.' }} + {%- endif %} + {{- "\n\n# Tools\n\nYou may call one or more functions to assist with the user query.\n\nYou are provided with function signatures within XML tags:\n" }} + {%- for tool in tools %} + {{- "\n" }} + {{- tool | tojson }} + {%- endfor %} + {{- "\n\n\nFor each function call, return a json object with function name and arguments within XML tags:\n\n{\"name\": , \"arguments\": }\n<|im_end|>\n" }} +{%- else %} + {%- if messages[0]['role'] == 'system' %} + {{- '<|im_start|>system\n' + messages[0]['content'] + '<|im_end|>\n' }} + {%- else %} + {{- '<|im_start|>system\nYou are Qwen, created by Alibaba Cloud. You are a helpful assistant.<|im_end|>\n' }} + {%- endif %} +{%- endif %} +{%- for message in messages %} + {%- if (message.role == "user") or (message.role == "system" and not loop.first) or (message.role == "assistant" and not message.tool_calls) %} + {{- '<|im_start|>' + message.role + '\n' + message.content + '<|im_end|>' + '\n' }} + {%- elif message.role == "assistant" %} + {{- '<|im_start|>' + message.role }} + {%- if message.content %} + {{- '\n' + message.content }} + {%- endif %} + {%- for tool_call in message.tool_calls %} + {%- if tool_call.function is defined %} + {%- set tool_call = tool_call.function %} + {%- endif %} + {{- '\n\n{"name": "' }} + {{- tool_call.name }} + {{- '", "arguments": ' }} + {{- tool_call.arguments | tojson }} + {{- '}\n' }} + {%- endfor %} + {{- '<|im_end|>\n' }} + {%- elif message.role == "tool" %} + {%- if (loop.index0 == 0) or (messages[loop.index0 - 1].role != "tool") %} + {{- '<|im_start|>user' }} + {%- endif %} + {{- '\n\n' }} + {{- message.content }} + {{- '\n' }} + {%- if loop.last or (messages[loop.index0 + 1].role != "tool") %} + {{- '<|im_end|>\n' }} + {%- endif %} + {%- endif %} +{%- endfor %} +{%- if add_generation_prompt %} + {{- '<|im_start|>assistant\n' }} +{%- endif %} diff --git a/config.json b/config.json new file mode 100644 index 0000000..a8bd744 --- /dev/null +++ b/config.json @@ -0,0 +1,72 @@ +{ + "architectures": [ + "Qwen2ForCausalLM" + ], + "attention_dropout": 0.0, + "bos_token_id": 151643, + "dtype": "float32", + "eos_token_id": 151645, + "hidden_act": "silu", + "hidden_size": 896, + "initializer_range": 0.02, + "intermediate_size": 4864, + "layer_types": [ + "full_attention", + "full_attention", + "full_attention", + "full_attention", + "full_attention", + "full_attention", + "full_attention", + "full_attention", + "full_attention", + "full_attention", + "full_attention", + "full_attention", + "full_attention", + "full_attention", + "full_attention", + "full_attention", + "full_attention", + "full_attention", + "full_attention", + "full_attention", + "full_attention", + "full_attention", + "full_attention", + "full_attention" + ], + "max_position_embeddings": 32768, + "max_window_layers": 21, + "model_type": "qwen2", + "num_attention_heads": 14, + "num_hidden_layers": 24, + "num_key_value_heads": 2, + "pad_token_id": null, + "quantization_config": { + "_load_in_4bit": true, + "_load_in_8bit": false, + "bnb_4bit_compute_dtype": "bfloat16", + "bnb_4bit_quant_storage": "uint8", + "bnb_4bit_quant_type": "nf4", + "bnb_4bit_use_double_quant": true, + "llm_int8_enable_fp32_cpu_offload": false, + "llm_int8_has_fp16_weight": false, + "llm_int8_skip_modules": null, + "llm_int8_threshold": 6.0, + "load_in_4bit": true, + "load_in_8bit": false, + "quant_method": "bitsandbytes" + }, + "rms_norm_eps": 1e-06, + "rope_parameters": { + "rope_theta": 1000000.0, + "rope_type": "default" + }, + "sliding_window": null, + "tie_word_embeddings": true, + "transformers_version": "5.1.0", + "use_cache": false, + "use_sliding_window": false, + "vocab_size": 151936 +} diff --git a/generation_config.json b/generation_config.json new file mode 100644 index 0000000..a5689f5 --- /dev/null +++ b/generation_config.json @@ -0,0 +1,14 @@ +{ + "bos_token_id": 151643, + "do_sample": true, + "eos_token_id": [ + 151645, + 151643 + ], + "pad_token_id": 151643, + "repetition_penalty": 1.1, + "temperature": 0.7, + "top_k": 20, + "top_p": 0.8, + "transformers_version": "5.1.0" +} diff --git a/model.safetensors b/model.safetensors new file mode 100644 index 0000000..804c343 --- /dev/null +++ b/model.safetensors @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:19f8be5c53e1718114ef6ded55fae5986a84a27b3738dd5d5b539608d775b945 +size 729762360 diff --git a/tokenizer.json b/tokenizer.json new file mode 100644 index 0000000..5609294 --- /dev/null +++ b/tokenizer.json @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:c47a17a5ec1c2cdadb68a727e1fa12b6ff89fd89a67b136eda88b4c91d267714 +size 11422172 diff --git a/tokenizer_config.json b/tokenizer_config.json new file mode 100644 index 0000000..7d75d3b --- /dev/null +++ b/tokenizer_config.json @@ -0,0 +1,29 @@ +{ + "add_prefix_space": false, + "backend": "tokenizers", + "bos_token": null, + "clean_up_tokenization_spaces": false, + "eos_token": "<|im_end|>", + "errors": "replace", + "extra_special_tokens": [ + "<|im_start|>", + "<|im_end|>", + "<|object_ref_start|>", + "<|object_ref_end|>", + "<|box_start|>", + "<|box_end|>", + "<|quad_start|>", + "<|quad_end|>", + "<|vision_start|>", + "<|vision_end|>", + "<|vision_pad|>", + "<|image_pad|>", + "<|video_pad|>" + ], + "is_local": false, + "model_max_length": 131072, + "pad_token": "<|endoftext|>", + "split_special_tokens": false, + "tokenizer_class": "Qwen2Tokenizer", + "unk_token": null +}