Finetuned from model : unsloth/SmolLM2-135M-Instruct
This llama model was trained 2x faster with Unsloth and Huggingface's TRL library.
SmolLM2_Cyber
Model Overview
smollm2_cyber is a lightweight domain-adapted language model fine-tuned for cybersecurity threat analysis tasks.
The model specializes in interpreting short textual descriptions of security incidents and producing structured (JSON) security insights.
Base Model: unsloth/smollm2-135m-instruct
Architecture: SmolLM2
Training Method: LoRA fine-tuning
Domain: Cyber Threat Analysis
Model Size: ~135M parameters
Capabilities
The model is trained to assist with:
Mapping incident descriptions to MITRE ATT&CK tactics and techniques
Estimating incident severity
Extracting structured insights from security event descriptions
Intended Use
Primary use cases include:
Cybersecurity research
Limitations
Small model capacity may limit reasoning in complex scenarios
Performance depends strongly on input clarity
Not intended to replace professional security analysis
Training Data
The model was trained on a curated cybersecurity datasetmadox81/mittre_severity_ds containing incident descriptions and structured labels including:
attack tactics
attack techniques
incident severity indicators
Example Prompts
Map the following security event to MITRE ATT&CK tactics and techniques.
Input: rule apt_lolbin { strings: $a = "certutil.exe" nocase; $b = "-urlfetch" nocase; condition: $a and $b }
Identify the ATT&CK tactics and techniques in this data.
Input: selection: EventName: 'UpdateDomainNameservers' AND SourceIPAddress not in ('aws-internal')
Classify this cybersecurity event into MITRE ATT&CK framework.
Input: rule apt_wasm { strings: $a = "WebAssembly.compile" nocase; $b = "fetch" nocase; condition: $a and $b }
Map the following security event to MITRE ATT&CK tactics and techniques.
Input: Incident Type: Data Breach
Target: MongoDB Instance
Vector: Weak Authentication
Assess the severity and business risk of the following incident.
Input: Incident: Phishing affecting HR Accounts.
Analyze the business risk and severity for the input below.
Input: Incident: Supply Chain Attack affecting CI/CD Pipeline.
Rate the severity (Low/Medium/High/Critical) and impact of this event.
Input: Incident: Credential Dumping affecting Windows Domain Controller.
