This is a fine-tuned version of Qwen/Qwen2.5-3B-Instruct specialized for HTTP request security classification. The model can detect 11 different types of web attacks with 93.33% accuracy.

Model Details

Base Model: Qwen/Qwen2.5-3B-Instruct
Fine-tuning Method: LoRA (Low-Rank Adaptation)
Training Data: 2,000+ labeled HTTP requests from 6 months of production traffic
Parameters: 3B (59.8M trainable)
Quantization: bfloat16
Context Length: 1024 tokens

Performance Metrics

Test Suite Results

Overall Accuracy: 93.33% (28/30 test cases)
Malicious Detection: 86.7% (13/15)
Benign Detection: 100% (15/15)
False Positives: 0
False Negatives: 2
Avg Inference Time: 3.1s (CPU) / 150ms (GPU)

Attack Types Detected

SQL Injection
XSS (Cross-Site Scripting)
Path Traversal
Command Injection
Information Disclosure
Reconnaissance
Authentication Attacks
Web Application Attacks
Protocol Attacks
Injection Attacks
Malware

Intended Use

Primary Use Cases

Real-time HTTP request filtering
WAF (Web Application Firewall) enhancement
Security log analysis
Attack pattern detection
Threat intelligence

Out of Scope

Network-level attacks (DDoS, port scanning without HTTP context)
Binary protocol analysis
Encrypted traffic analysis (pre-decryption)

Usage

Quick Start

python

from transformers import AutoTokenizer, AutoModelForCausalLM
import torch

model_path = "gachara/my-security-classifier"
tokenizer = AutoTokenizer.from_pretrained(model_path)
model = AutoModelForCausalLM.from_pretrained(
    model_path,
    torch_dtype=torch.bfloat16,
    device_map="auto"
)

def classify_request(method, url, status, query, user_agent):
    input_text = f"""HTTP Request Analysis Required:

Method: {method}
URL: {url}
Status: {status}
Query: {query}
User-Agent: {user_agent}

Task: Determine if this request is malicious and identify the attack type."""

    messages = [
        {"role": "system", "content": "You are a senior cybersecurity analyst..."},
        {"role": "user", "content": input_text}
    ]
    
    text = tokenizer.apply_chat_template(messages, tokenize=False, add_generation_prompt=True)
    inputs = tokenizer([text], return_tensors="pt").to(model.device)
    
    outputs = model.generate(**inputs, max_new_tokens=512, temperature=0.1)
    response = tokenizer.decode(outputs[0][len(inputs.input_ids[0]):], skip_special_tokens=True)
    
    return response

# Example
result = classify_request(
    "GET", 
    "/admin/config.php", 
    200, 
    "id=1' OR '1'='1", 
    "sqlmap/1.0"
)
print(result)

Example Output

Classification: malicious Confidence Score: 0.80 Attack Type: SQL_Injection Analysis: The request contains a classic SQL injection payload in the query parameter. The pattern "' OR '1'='1" is a boolean-based blind SQL injection attempt designed to bypass authentication or extract data. The user agent "sqlmap/1.0" is a known automated SQL injection tool, further confirming malicious intent.

Training Details

Training Data

Total Samples: 2,000 (1,000 benign + 1,000 malicious)
Data Sources: Production HTTP logs from web applications
Attack Distribution:
- Information_Disclosure: 37.9%
- Command_Injection: 18.0%
- Reconnaissance: 14.0%
- Path_Traversal: 9.0%
- Authentication_Attack: 7.6%
- Web_Application_Attack: 5.5%
- SQL_Injection: 5.4%
- Malware: 1.7%

Training Procedure

Framework: LLaMA Factory
Method: LoRA fine-tuning
LoRA Rank: 32
LoRA Alpha: 64
Epochs: 3
Batch Size: 32 (4 per device × 8 accumulation)
Learning Rate: 2e-4
Warmup Ratio: 0.1
Optimizer: AdamW
Training Time: ~35 minutes on single GPU

Hardware

GPU: NVIDIA A100 (40GB) / RTX 4090 (24GB)
Memory Usage: ~18GB VRAM during training

Limitations

Known Issues

Server-Side Template Injection (SSTI): Model sometimes misclassifies legitimate template syntax as benign
GraphQL Introspection: May not detect GraphQL schema dumping attacks
Obfuscated Payloads: Performance degrades with heavily encoded attacks
Context Length: Limited to 1024 tokens (very long URLs may be truncated)

Bias Considerations

Training data primarily from English-language web applications
May underperform on non-HTTP protocols
Biased toward common attack patterns (rare attacks may be missed)

Ethical Considerations

Responsible Use

✅ Use for defensive security purposes
✅ Integrate as part of defense-in-depth strategy
✅ Monitor for false positives in production
❌ Do not use for offensive security without authorization
❌ Do not rely solely on this model for critical security decisions

Privacy

Model does not store or transmit data
All inference happens locally
No sensitive data was used in training (IPs/credentials removed)

Citation

If you use this model in your research or production systems, please cite:

bibtex

@misc{qwen25-3b-security,
  author = {John gachara},
  title = {Qwen2.5-3B HTTP Security Classifier},
  year = {2024},
  publisher = {HuggingFace},
  url = {https://huggingface.co/gachara/my-security-classifier}
}

License

This model is released under the Apache 2.0 license. The base model Qwen2.5-3B-Instruct is also Apache 2.0.

Acknowledgments

Base model: Qwen Team
Fine-tuning framework: LLaMA Factory
Training data: Collected from production web applications over 6 months

Contact

Model Version: 1.0.0