Security operations LoRA adapter fine-tuned on Qwen 2.5 7B. This is the lightweight adapter variant of WraithWall Core V3 — same training data, smaller footprint (616MB adapter vs 15GB merged).

What it knows

Trained on 7,000 structured Q&A pairs from 8 live intelligence feeds:

CISA KEV — 1,991 actively exploited vulnerabilities
MITRE ATT&CK — 1,103 technique mappings with detection rules
AbuseIPDB — 839 real attacker IPs with abuse attribution
Malware Intelligence — 716 entries (URLhaus, SSL Blacklist, MalwareBazaar)
Infrastructure Defense — 506 entries on SSH hardening, container security, honeypots
Cowrie Honeypot — 370 entries from live SSH/Telnet attack sessions
Threat Intelligence — 200 entries on campaign correlation, identity graphs
Phishing & BGP — 275 entries on domain analysis, route hijacks

Dataset

7,000 curated security Q&A pairs covering honeypot deployment, BGP monitoring, web app security (OWASP Top 10), LLM prompt injection, malware analysis, incident response, network forensics, and API security. Compiled from real-world production honeypot logs, incident reports, and adversarial testing. No synthetic or GPT-generated data.

Capabilities

Domain	What it does
Vulnerability triage	Classifies CVEs, maps to MITRE, recommends patch priority
Honeypot analysis	Analyzes Cowrie sessions, identifies attacker TTPs
Threat hunting	Correlates IPs and campaigns across sessions
Malware triage	Identifies malware families, extracts IOCs
Phishing detection	Analyzes domains for typosquatting
Infrastructure defense	SSH hardening, container isolation, honeypot deployment
BGP intelligence	Route hijack detection and ASN analysis

How to use

python

from peft import PeftModel
from transformers import AutoModelForCausalLM, AutoTokenizer
import torch

base_model = AutoModelForCausalLM.from_pretrained(
    "unsloth/qwen2.5-7b-instruct-unsloth-bnb-4bit",
    torch_dtype=torch.float16,
    device_map="auto"
)
model = PeftModel.from_pretrained(base_model, "NiffyHunt90/wraithcore-7b")
tokenizer = AutoTokenizer.from_pretrained("unsloth/qwen2.5-7b-instruct-unsloth-bnb-4bit")

prompt = "What is the MITRE ATT&CK framework and how do I use it?"
inputs = tokenizer(prompt, return_tensors="pt").to(model.device)
outputs = model.generate(**inputs, max_new_tokens=200)
print(tokenizer.decode(outputs[0], skip_special_tokens=True))

Training

Base model: Qwen 2.5 7B Instruct (4-bit)
Method: LoRA (r=16, alpha=16)
Adapter size: 616 MB
Hardware: 2x Tesla T4 (14.5GB VRAM)
Framework: Unsloth + HuggingFace TRL
Epochs: 3 | Loss: 3.44 → 0.11 (96.8% reduction)

Related models

WraithWall Core V3 — full merged 16-bit model
CodeGuard Security — code vulnerability detection

Author

Adewale Babalola (Niffyhunt) — Founder, WraithWall