license: apache-2.0
language:
- en
library_name: transformers
tags:
- cybersecurity
- soc
- siem
- mitre-attack
- incident-response
- threat-detection
- security-operations
- fine-tuned
- qlora
- unsloth
- gguf
- ollama
base_model: openai/gpt-oss-20b
model-index:
- name: rhythmai-cybersec-20b
results:
- task:
type: text-generation
name: Cybersecurity Q&A
metrics:
- type: eval_loss
value: 0.5773
name: Validation Loss
- type: train_loss
value: 0.4873
name: Training Loss
datasets:
- AlicanKiraz0/Cybersecurity-Dataset-Fenrir-v2.0
- Trendyol/Trendyol-Cybersecurity-Instruction-Tuning-Dataset
pipeline_tag: text-generation
RhythmAI Cybersec 20B
A cybersecurity-specialized language model fine-tuned from OpenAI GPT-OSS-20B for Security Operations Center (SOC) tasks including alarm investigation, threat analysis, MITRE ATT&CK mapping, incident response, and log analysis.
Built for RhythmAI -- an AI-powered SOC platform that integrates with LogRhythm SIEM.
Model Details
| Property | Value |
|---|---|
| Base Model | openai/gpt-oss-20b (MoE, 21B total / 3.6B active params) |
| Architecture | Mixture of Experts (MoE) with MXFP4 native quantization |
| Fine-tuning Method | QLoRA (4-bit) via Unsloth |
| LoRA Rank | 32 |
| LoRA Alpha | 64 |
| LoRA Dropout | 0.05 |
| Target Modules | q_proj, k_proj, v_proj, o_proj, gate_proj, up_proj, down_proj |
| Training Precision | 4-bit QLoRA with BF16 compute |
| Context Length | 4,096 tokens |
| GGUF Format | MXFP4 (13 GB) |
| License | Apache 2.0 (inherited from GPT-OSS) |
Training Data
Fine-tuned on 9,702 curated cybersecurity examples from public datasets, filtered for SOC/SIEM relevance:
| Source | Original Size | After Filtering | Description |
|---|---|---|---|
| Fenrir v2.0 | 83,920 | ~5,000 | General cybersecurity Q&A |
| Trendyol Cybersecurity | 53,202 | ~5,000 | Instruction-tuned cybersecurity |
Filtering criteria: Keyword relevance scoring (minimum 2 matches from 60+ SOC-relevant terms including SIEM, MITRE ATT&CK, incident response, threat detection, log analysis, etc.), response length between 50-15,000 characters, MD5-based deduplication.
Split: 9,217 train (95%) / 485 validation (5%)
Format: OpenAI-compatible chat format:
{"messages": [{"role": "system", "content": "..."}, {"role": "user", "content": "..."}, {"role": "assistant", "content": "..."}]}
Training Details
| Parameter | Value |
|---|---|
| GPU | NVIDIA RTX PRO 6000 Blackwell (96 GB VRAM) |
| Framework | Unsloth 2026.3.3 + Transformers 5.2.0 |
| Epochs | 3 |
| Effective Batch Size | 8 (2 per device x 4 gradient accumulation) |
| Learning Rate | 2e-4 (cosine schedule, 5% warmup) |
| Optimizer | AdamW 8-bit |
| Weight Decay | 0.01 |
| Max Sequence Length | 4,096 |
| Packing | Enabled (short examples packed together) |
| Gradient Checkpointing | Unsloth optimized (30% VRAM savings) |
| Total Steps | 3,459 |
| Training Time | ~12.5 hours |
| Trainable Parameters | 67M / 21B (0.32%) |
Training Metrics
| Metric | Value |
|---|---|
| Final Training Loss | 0.4873 |
| Final Validation Loss | 0.5774 |
| Best Validation Loss | 0.5773 (step 3,000) |
| Initial Validation Loss | 0.7866 (step 100) |
The model shows consistent improvement across training with no signs of overfitting (validation loss closely tracks training loss).
Capabilities
This model is specialized for:
- Alarm Investigation: Analyzing security alarms from SIEM platforms with contextual threat assessment
- MITRE ATT&CK Mapping: Identifying tactics, techniques, and procedures (TTPs) from security events
- Incident Response: Generating structured incident response playbooks and triage recommendations
- Threat Analysis: Assessing threat severity, identifying indicators of compromise (IOCs)
- Log Analysis: Interpreting Windows Event Logs, firewall logs, IDS/IPS alerts, and authentication logs
- Detection Engineering: Suggesting detection rules and correlation logic
- Compliance Guidance: NIST, PCI-DSS, HIPAA, GDPR security control recommendations
Usage
With Ollama (Recommended)
# Create the model from GGUF
ollama create rhythmai-cybersec-20b -f Modelfile
# Run interactively
ollama run rhythmai-cybersec-20b "Analyze this security event: Multiple failed RDP login attempts from IP 203.0.113.45 targeting the domain controller, followed by a successful login and immediate PowerShell execution."
# Use via API
curl http://localhost:11434/api/chat -d '{
"model": "rhythmai-cybersec-20b",
"messages": [
{"role": "system", "content": "You are a senior SOC analyst. Analyze security events and provide actionable recommendations."},
{"role": "user", "content": "What MITRE ATT&CK techniques are associated with credential dumping?"}
]
}'
With Transformers + PEFT (Adapter)
from peft import PeftModel
from transformers import AutoModelForCausalLM, AutoTokenizer
base_model = AutoModelForCausalLM.from_pretrained("openai/gpt-oss-20b", device_map="auto")
model = PeftModel.from_pretrained(base_model, "SyedCode01/rhythmai-cybersec-20b", subfolder="adapter")
tokenizer = AutoTokenizer.from_pretrained("SyedCode01/rhythmai-cybersec-20b", subfolder="adapter")
messages = [
{"role": "system", "content": "You are a cybersecurity expert specializing in SOC operations."},
{"role": "user", "content": "Explain lateral movement in the context of MITRE ATT&CK."}
]
inputs = tokenizer.apply_chat_template(messages, return_tensors="pt").to(model.device)
outputs = model.generate(inputs, max_new_tokens=512, temperature=0.7)
print(tokenizer.decode(outputs[0], skip_special_tokens=True))
Example Output
Prompt: "What is lateral movement in cybersecurity?"
Response: Lateral movement in cybersecurity refers to the techniques attackers use to navigate through a network or system after gaining initial access. Once an attacker compromises a single device or account -- often with relatively low privileges -- they employ lateral movement to expand their reach, elevate their access levels, and ultimately achieve broader objectives such as data exfiltration or system control. This process involves moving from one compromised asset to another, leveraging existing network paths, user credentials, and administrative tools. Attackers might use legitimate remote management protocols (e.g., RDP, SSH), stolen passwords, or exploit vulnerabilities in software to traverse the environment. It's a critical phase in advanced persistent threat (APT) campaigns, as it enables attackers to remain stealthy over extended periods by using normal administrative functions and legitimate credentials.
File Structure
rhythmai-cybersec-20b/
adapter/ # LoRA adapter weights (PEFT)
adapter_config.json
adapter_model.safetensors
tokenizer.json
tokenizer_config.json
gguf-q4_k_m_gguf/ # GGUF for Ollama deployment
gpt-oss-20b.MXFP4.gguf # 13 GB quantized model
Modelfile # Ollama model definition
README.md # This model card
Intended Use
This model is designed for cybersecurity professionals, SOC analysts, and security teams who need AI assistance with:
- Security alarm triage and investigation
- Threat intelligence analysis
- Incident response planning
- Security posture assessment
- MITRE ATT&CK framework mapping
Limitations
- Domain-specific: Optimized for cybersecurity tasks; general knowledge may be less reliable than the base model
- Not a replacement for human analysts: Outputs should be validated by qualified security professionals
- Training data bias: Performance may vary for threats or attack patterns not well-represented in the training data
- Context window: Limited to 4,096 tokens; very long log files or reports may need to be chunked
- No real-time data: The model does not have access to real-time threat intelligence feeds
Citation
@misc{rhythmai-cybersec-20b,
title={RhythmAI Cybersec 20B: A Fine-Tuned Cybersecurity Language Model},
author={Syed Hasan Iqbal},
year={2026},
url={https://huggingface.co/SyedCode01/rhythmai-cybersec-20b},
note={Fine-tuned from OpenAI GPT-OSS-20B for SOC operations}
}
Acknowledgments
- OpenAI for the GPT-OSS-20B base model (Apache 2.0)
- Unsloth for efficient QLoRA fine-tuning
- AlicanKiraz0 for the Fenrir v2.0 cybersecurity dataset
- Trendyol for the cybersecurity instruction tuning dataset