CyberAttackDetection

Overview

The CyberAttackDetection model is a fine-tuned BERT-based sequence classification model designed to identify cyberattacks in textual descriptions. It classifies input data into two categories:

Attack (1): The text describes a cybersecurity threat or attack.
Non-Attack (0): The text does not describe a cybersecurity threat.

Model Details

License: MIT License
Datasets:
- Custom cybersecurity datasets:
  - Canstralian/pentesting_dataset
  - Canstralian/Wordlists
  - Canstralian/ShellCommands
  - Canstralian/CyberExploitDB
  - Chemically-motivated/CyberSecurityDataset
  - Chemically-motivated/AI-Agent-Generating-Tool-Debugging-Prompt-Library
Language: English
Metrics:
- Accuracy: 85%
- F1 Score: 0.83
- Precision: 0.80
- Recall: 0.87
Base Model: WhiteRabbitNeo/WhiteRabbitNeo-33B-v1.5
Pipeline Tag: text-classification
Library Name: transformers
Tags: cybersecurity, text-classification, attack-detection, BERT
New Version: v1.0.0
Auto-Detected Features: True

Model Usage

Installation

Before using the model, ensure the necessary dependencies are installed:

pip install transformers torch

Example Code

Use the following Python code to load the model and classify a sample text:

from transformers import AutoModelForSequenceClassification, AutoTokenizer

# Load the fine-tuned model and tokenizer
model = AutoModelForSequenceClassification.from_pretrained("Canstralian/CyberAttackDetection")
tokenizer = AutoTokenizer.from_pretrained("Canstralian/CyberAttackDetection")

# Example input: Cyberattack description
text = "A vulnerability was discovered in the server software."

# Tokenize the input
inputs = tokenizer(text, return_tensors="pt")

# Get model predictions
outputs = model(**inputs)

# Predict the label (1 = attack, 0 = non-attack)
prediction = outputs.logits.argmax(dim=-1)
print(f"Prediction: {'Attack' if prediction.item() == 1 else 'Non-Attack'}")

Prompts:

Open Ports: "Analyze the following network scan report and identify open ports and their associated vulnerabilities. Suggest best practices to secure these ports: [Insert network scan report]."
Outdated Software or Services: "Given this list of installed software and services, identify outdated versions and known vulnerabilities. Provide recommendations for updates or patches to mitigate risks: [Insert software and service list]."
Default Credentials: "Scan the following system configurations for any use of default credentials. Provide a list of affected services and recommendations for securing these credentials: [Insert system configuration details]."
Misconfigurations: "Evaluate the provided system configuration for potential misconfigurations. Highlight risks and provide recommendations for secure setup: [Insert system configuration details]."
Injection Flaws: "Review the given web application code or request logs and identify potential injection vulnerabilities such as SQL injection, command injection, or XSS. Provide remediation steps: [Insert code or logs]."
Unencrypted Services: "Analyze the following network configuration and identify services that are transmitting data without encryption. Suggest strategies to enforce secure transmission: [Insert network configuration details]."
Known Software Vulnerabilities: "Review the provided software inventory and cross-reference it with known vulnerabilities in the National Vulnerability Database (NVD). Recommend patches or workarounds: [Insert software inventory]."
Cross-Site Request Forgery (CSRF): "Examine the provided web application code for potential CSRF vulnerabilities. Suggest specific coding or configuration techniques to prevent these attacks: [Insert code]."
Insecure Direct Object References (IDOR): "Analyze the provided API endpoints and their associated access controls. Identify any IDOR vulnerabilities and suggest secure implementation strategies: [Insert API endpoint details]."
Security Misconfigurations in Web Servers/Applications: "Assess the given web server configuration for security misconfigurations, such as improper HTTP headers or verbose error messages. Recommend changes to harden the server: [Insert server configuration]."
Broken Authentication and Session Management: "Review the provided authentication and session management implementation. Identify weaknesses and recommend strategies to prevent compromise: [Insert authentication/session management details]."
Sensitive Data Exposure: "Analyze the system's data handling processes and storage practices to identify potential sensitive data exposure. Recommend measures to protect sensitive information: [Insert system details]."
API Vulnerabilities: "Examine the following API documentation and implementation for vulnerabilities, including insecure endpoints and data leakage. Provide recommendations for securing the API: [Insert API documentation]."
Denial of Service (DoS) Vulnerabilities: "Review the system's architecture and configuration for potential vulnerabilities to DoS attacks. Suggest mitigation strategies such as rate limiting and load balancing: [Insert system architecture]."
Buffer Overflows: "Analyze the provided code or application for buffer overflow vulnerabilities. Highlight potential weak points and recommend secure coding practices to prevent exploitation: [Insert code]."

Model Training Details

Training Objective

The model was fine-tuned to classify descriptive text as either an attack or non-attack event. It uses a binary classification approach.

Training Data

The training data includes cybersecurity-related attack descriptions and non-attack examples from curated datasets.

Evaluation

The model was evaluated on a balanced test set using the following metrics:

Accuracy: 85%
F1 Score: 0.83
Precision: 0.80
Recall: 0.87

These results indicate strong performance in detecting cyberattacks from text.

License

This project is licensed under the MIT License. Refer to the LICENSE file for details.

How to Contribute

We welcome contributions!

Submit Issues: If you encounter problems, open an issue on the repository.
Pull Requests: Feel free to contribute code improvements or documentation updates.

Contact

For further information or inquiries, contact: [email protected]

Canstralian
/

CyberAttackDetection