Upload README.md with huggingface_hub

README.md

@@ -0,0 +1,215 @@
+---
+license: apache-2.0
+language:
+  - en
+library_name: transformers
+tags:
+  - cybersecurity
+  - soc
+  - siem
+  - mitre-attack
+  - incident-response
+  - threat-detection
+  - security-operations
+  - fine-tuned
+  - qlora
+  - unsloth
+  - gguf
+  - ollama
+base_model: openai/gpt-oss-20b
+model-index:
+  - name: rhythmai-cybersec-20b
+    results:
+      - task:
+          type: text-generation
+          name: Cybersecurity Q&A
+        metrics:
+          - type: eval_loss
+            value: 0.5773
+            name: Validation Loss
+          - type: train_loss
+            value: 0.4873
+            name: Training Loss
+datasets:
+  - AlicanKiraz0/Cybersecurity-Dataset-Fenrir-v2.0
+  - Trendyol/Trendyol-Cybersecurity-Instruction-Tuning-Dataset
+pipeline_tag: text-generation
+---
+
+# RhythmAI Cybersec 20B
+
+A cybersecurity-specialized language model fine-tuned from [OpenAI GPT-OSS-20B](https://huggingface.co/openai/gpt-oss-20b) for Security Operations Center (SOC) tasks including alarm investigation, threat analysis, MITRE ATT&CK mapping, incident response, and log analysis.
+
+Built for [RhythmAI](https://github.com/SyedCode01) -- an AI-powered SOC platform that integrates with LogRhythm SIEM.
+
+## Model Details
+
+| Property | Value |
+|----------|-------|
+| **Base Model** | [openai/gpt-oss-20b](https://huggingface.co/openai/gpt-oss-20b) (MoE, 21B total / 3.6B active params) |
+| **Architecture** | Mixture of Experts (MoE) with MXFP4 native quantization |
+| **Fine-tuning Method** | QLoRA (4-bit) via [Unsloth](https://github.com/unslothai/unsloth) |
+| **LoRA Rank** | 32 |
+| **LoRA Alpha** | 64 |
+| **LoRA Dropout** | 0.05 |
+| **Target Modules** | q_proj, k_proj, v_proj, o_proj, gate_proj, up_proj, down_proj |
+| **Training Precision** | 4-bit QLoRA with BF16 compute |
+| **Context Length** | 4,096 tokens |
+| **GGUF Format** | MXFP4 (13 GB) |
+| **License** | Apache 2.0 (inherited from GPT-OSS) |
+
+## Training Data
+
+Fine-tuned on **9,702 curated cybersecurity examples** from public datasets, filtered for SOC/SIEM relevance:
+
+| Source | Original Size | After Filtering | Description |
+|--------|--------------|-----------------|-------------|
+| [Fenrir v2.0](https://huggingface.co/datasets/AlicanKiraz0/Cybersecurity-Dataset-Fenrir-v2.0) | 83,920 | ~5,000 | General cybersecurity Q&A |
+| [Trendyol Cybersecurity](https://huggingface.co/datasets/Trendyol/Trendyol-Cybersecurity-Instruction-Tuning-Dataset) | 53,202 | ~5,000 | Instruction-tuned cybersecurity |
+
+**Filtering criteria**: Keyword relevance scoring (minimum 2 matches from 60+ SOC-relevant terms including SIEM, MITRE ATT&CK, incident response, threat detection, log analysis, etc.), response length between 50-15,000 characters, MD5-based deduplication.
+
+**Split**: 9,217 train (95%) / 485 validation (5%)
+
+**Format**: OpenAI-compatible chat format:
+```json
+{"messages": [{"role": "system", "content": "..."}, {"role": "user", "content": "..."}, {"role": "assistant", "content": "..."}]}
+```
+
+## Training Details
+
+| Parameter | Value |
+|-----------|-------|
+| **GPU** | NVIDIA RTX PRO 6000 Blackwell (96 GB VRAM) |
+| **Framework** | Unsloth 2026.3.3 + Transformers 5.2.0 |
+| **Epochs** | 3 |
+| **Effective Batch Size** | 8 (2 per device x 4 gradient accumulation) |
+| **Learning Rate** | 2e-4 (cosine schedule, 5% warmup) |
+| **Optimizer** | AdamW 8-bit |
+| **Weight Decay** | 0.01 |
+| **Max Sequence Length** | 4,096 |
+| **Packing** | Enabled (short examples packed together) |
+| **Gradient Checkpointing** | Unsloth optimized (30% VRAM savings) |
+| **Total Steps** | 3,459 |
+| **Training Time** | ~12.5 hours |
+| **Trainable Parameters** | 67M / 21B (0.32%) |
+
+## Training Metrics
+
+| Metric | Value |
+|--------|-------|
+| **Final Training Loss** | 0.4873 |
+| **Final Validation Loss** | 0.5774 |
+| **Best Validation Loss** | 0.5773 (step 3,000) |
+| **Initial Validation Loss** | 0.7866 (step 100) |
+
+The model shows consistent improvement across training with no signs of overfitting (validation loss closely tracks training loss).
+
+## Capabilities
+
+This model is specialized for:
+
+- **Alarm Investigation**: Analyzing security alarms from SIEM platforms with contextual threat assessment
+- **MITRE ATT&CK Mapping**: Identifying tactics, techniques, and procedures (TTPs) from security events
+- **Incident Response**: Generating structured incident response playbooks and triage recommendations
+- **Threat Analysis**: Assessing threat severity, identifying indicators of compromise (IOCs)
+- **Log Analysis**: Interpreting Windows Event Logs, firewall logs, IDS/IPS alerts, and authentication logs
+- **Detection Engineering**: Suggesting detection rules and correlation logic
+- **Compliance Guidance**: NIST, PCI-DSS, HIPAA, GDPR security control recommendations
+
+## Usage
+
+### With Ollama (Recommended)
+
+```bash
+# Create the model from GGUF
+ollama create rhythmai-cybersec-20b -f Modelfile
+
+# Run interactively
+ollama run rhythmai-cybersec-20b "Analyze this security event: Multiple failed RDP login attempts from IP 203.0.113.45 targeting the domain controller, followed by a successful login and immediate PowerShell execution."
+
+# Use via API
+curl http://localhost:11434/api/chat -d '{
+  "model": "rhythmai-cybersec-20b",
+  "messages": [
+    {"role": "system", "content": "You are a senior SOC analyst. Analyze security events and provide actionable recommendations."},
+    {"role": "user", "content": "What MITRE ATT&CK techniques are associated with credential dumping?"}
+  ]
+}'
+```
+
+### With Transformers + PEFT (Adapter)
+
+```python
+from peft import PeftModel
+from transformers import AutoModelForCausalLM, AutoTokenizer
+
+base_model = AutoModelForCausalLM.from_pretrained("openai/gpt-oss-20b", device_map="auto")
+model = PeftModel.from_pretrained(base_model, "SyedCode01/rhythmai-cybersec-20b", subfolder="adapter")
+tokenizer = AutoTokenizer.from_pretrained("SyedCode01/rhythmai-cybersec-20b", subfolder="adapter")
+
+messages = [
+    {"role": "system", "content": "You are a cybersecurity expert specializing in SOC operations."},
+    {"role": "user", "content": "Explain lateral movement in the context of MITRE ATT&CK."}
+]
+inputs = tokenizer.apply_chat_template(messages, return_tensors="pt").to(model.device)
+outputs = model.generate(inputs, max_new_tokens=512, temperature=0.7)
+print(tokenizer.decode(outputs[0], skip_special_tokens=True))
+```
+
+## Example Output
+
+**Prompt**: "What is lateral movement in cybersecurity?"
+
+**Response**: Lateral movement in cybersecurity refers to the techniques attackers use to navigate through a network or system after gaining initial access. Once an attacker compromises a single device or account -- often with relatively low privileges -- they employ lateral movement to expand their reach, elevate their access levels, and ultimately achieve broader objectives such as data exfiltration or system control. This process involves moving from one compromised asset to another, leveraging existing network paths, user credentials, and administrative tools. Attackers might use legitimate remote management protocols (e.g., RDP, SSH), stolen passwords, or exploit vulnerabilities in software to traverse the environment. It's a critical phase in advanced persistent threat (APT) campaigns, as it enables attackers to remain stealthy over extended periods by using normal administrative functions and legitimate credentials.
+
+## File Structure
+
+```
+rhythmai-cybersec-20b/
+  adapter/                    # LoRA adapter weights (PEFT)
+    adapter_config.json
+    adapter_model.safetensors
+    tokenizer.json
+    tokenizer_config.json
+  gguf-q4_k_m_gguf/          # GGUF for Ollama deployment
+    gpt-oss-20b.MXFP4.gguf   # 13 GB quantized model
+    Modelfile                 # Ollama model definition
+  README.md                   # This model card
+```
+
+## Intended Use
+
+This model is designed for cybersecurity professionals, SOC analysts, and security teams who need AI assistance with:
+- Security alarm triage and investigation
+- Threat intelligence analysis
+- Incident response planning
+- Security posture assessment
+- MITRE ATT&CK framework mapping
+
+## Limitations
+
+- **Domain-specific**: Optimized for cybersecurity tasks; general knowledge may be less reliable than the base model
+- **Not a replacement for human analysts**: Outputs should be validated by qualified security professionals
+- **Training data bias**: Performance may vary for threats or attack patterns not well-represented in the training data
+- **Context window**: Limited to 4,096 tokens; very long log files or reports may need to be chunked
+- **No real-time data**: The model does not have access to real-time threat intelligence feeds
+
+## Citation
+
+```bibtex
+@misc{rhythmai-cybersec-20b,
+  title={RhythmAI Cybersec 20B: A Fine-Tuned Cybersecurity Language Model},
+  author={Syed Hasan Iqbal},
+  year={2026},
+  url={https://huggingface.co/SyedCode01/rhythmai-cybersec-20b},
+  note={Fine-tuned from OpenAI GPT-OSS-20B for SOC operations}
+}
+```
+
+## Acknowledgments
+
+- [OpenAI](https://openai.com) for the GPT-OSS-20B base model (Apache 2.0)
+- [Unsloth](https://github.com/unslothai/unsloth) for efficient QLoRA fine-tuning
+- [AlicanKiraz0](https://huggingface.co/AlicanKiraz0) for the Fenrir v2.0 cybersecurity dataset
+- [Trendyol](https://huggingface.co/Trendyol) for the cybersecurity instruction tuning dataset