You can deploy this model and start earning money today!

harpomaxx/
qwen2.5-1.5b-slips-immune-unified-v3

Name: qwen2.5-1.5b-slips-immune-unified-v3
Availability: InStock

Views

No views yet

Qwen2.5-1.5B — Slips IDS Unified Security Analyst (v3)

Model Description

A fine-tuned version of Qwen2.5-1.5B-Instruct specialized for three complementary security analysis tasks on network incidents from Slips IDS — all in a single adapter:

Summarization — translating technical Slips DAG alert logs into clear, human-readable incident summaries with per-event severity labels (CRITICAL / HIGH / MEDIUM / LOW / INFO)
Cause Analysis — identifying the likely cause (malicious activity, misconfiguration, or legitimate behavior) with structured reasoning
Risk Assessment — producing calibrated risk level, business impact, likelihood of malicious activity, and investigation priority

Slips is a network intrusion detection system that generates DAG-structured alert logs — chains of related security events per source IP per time window. This unified model handles the full analyst pipeline in one inference call or as separate targeted queries.

This model merges the capabilities of stratosphere/qwen2.5-1.5b-slips-immune-summarization and stratosphere/qwen2.5-1.5b-slips-immune-risk into a single fine-tuned adapter trained jointly on all three tasks.

Quick Start

Ollama (Recommended)

ollama run harpomaxx/qwen2.5-1.5b-slips-immune-unified-v3

Python (Transformers)

python

from transformers import AutoTokenizer, AutoModelForCausalLM
import torch

model_id = "harpomaxx/qwen2.5-1.5b-slips-immune-unified-v3"
tokenizer = AutoTokenizer.from_pretrained(model_id)
model = AutoModelForCausalLM.from_pretrained(
    model_id, torch_dtype=torch.bfloat16, device_map="auto"
)

# --- Task 1: Summarization ---
summary_prompt = """You are a security analyst. Your task is to translate technical security events into clear, concise, human-readable summaries and assess their severity.

INCIDENT METADATA:
- Incident ID: {incident_id}
- Source IP: {source_ip}
- Timewindow: {timewindow}
- Accumulated Threat Level: {threat_level}
- Time Range: {start} to {end}
- Total Events: {count}

RAW EVENTS:
{dag_analysis}

YOUR TASK:
1. Transform technical event descriptions into clear, readable summaries
2. Group identical or similar events
3. Assess severity (CRITICAL/HIGH/MEDIUM/LOW/INFO)
4. Calculate overall severity breakdown

OUTPUT FORMAT:
============================================================
Incident: <incident_id>
Source IP: <source_ip> | Timewindow: <timewindow>
Timeline: <start> to <end>
Threat Level: <threat_level> | Events: <count>

• HH:MM-HH:MM - [Your clear grouped summary] [SEVERITY]
• HH:MM - [Your clear summary] [SEVERITY]

Total Evidence: <count> events
Severity breakdown: [e.g., "High: 5, Medium: 3, Info: 2"]"""

# --- Task 2: Cause Analysis ---
cause_prompt = """You are a cybersecurity analyst. Analyze the following network security incident and provide a structured analysis of possible causes.

INCIDENT METADATA:
- Incident ID: {incident_id}
- Source IP: {source_ip}
- Accumulated Threat Level: {threat_level}

SECURITY EVIDENCE:
{dag_analysis}

Output Requirements:
- Respond with ONLY the analysis content

**Possible Causes:**

**1. Malicious Activity:**
• [Specific attack technique]

**2. Legitimate Activity:**
• [Benign operational cause]

**3. Misconfigurations:**
• [Technical misconfigurations]

**Conclusion:** [Assessment of most likely cause category]"""

# --- Task 3: Risk Assessment ---
risk_prompt = """You are a cybersecurity analyst. Analyze the following network security incident and provide a structured risk assessment.

INCIDENT METADATA:
- Incident ID: {incident_id}
- Source IP: {source_ip}
- Accumulated Threat Level: {threat_level}

SECURITY EVIDENCE:
{dag_analysis}

**Risk Level:** [Critical/High/Medium/Low]

**Justification:** [Technical justification]

**Business Impact:** [Single clear sentence describing business effect]

**Likelihood of Malicious Activity:** [High/Medium/Low] - [Brief rationale]

**Investigation Priority:** [Immediate/High/Medium/Low] - [Brief justification]"""

def run_task(prompt):
    messages = [{"role": "user", "content": prompt}]
    input_ids = tokenizer.apply_chat_template(
        messages, return_tensors="pt", add_generation_prompt=True
    ).to(model.device)
    output = model.generate(input_ids, max_new_tokens=512, do_sample=False)
    return tokenizer.decode(output[0][input_ids.shape[1]:], skip_special_tokens=True)

Training Details

Dataset

Source: 750 incidents from real Slips IDS network captures (675 train / 75 eval incidents)
Tasks: Three tasks per incident — summarization (S), cause analysis (A), risk assessment (B) — interleaved
Responses: 4 model responses per incident per task (GPT-4o, GPT-4o-mini, Qwen2.5 3B, Qwen2.5 1.5B)
Selection: Best-of-N — highest-scoring response selected via LLM-as-judge
Filtering: Responses with judge score < 4 discarded
Split: 3715 train / 225 eval records — cause+risk upsampled 2x (82% cause+risk, 18% summarization)

Training Procedure

Parameter	Value
Base Model	`unsloth/Qwen2.5-1.5B-Instruct`
Training Method	SFT (Supervised Fine-Tuning)
Framework	Unsloth + TRL SFTTrainer
LoRA Rank (r)	128
LoRA Alpha	128
LoRA Dropout	0.0
RSLoRA	Enabled (required at r=64)
LoRA Targets	q_proj, k_proj, v_proj, o_proj, gate_proj, up_proj, down_proj
Sequence Length	4096
Batch Size	1 (effective: 16 via gradient accumulation)
Learning Rate	2e-5
LR Scheduler	Cosine
Warmup Steps	30
Weight Decay	0.01
Epochs	2
Optimizer	adamw_8bit
Precision	BF16
Quantization	4bit (QLoRA)
Hardware	A100 80GB MiG 20GB slice

Training Results

Step	Epoch	Eval Loss
50	0.57	0.8047
100	1.12	0.7594
150	1.69	0.7426
200	2.25	0.7327
250	2.82	0.7293 ← best

Eval loss decreased monotonically across all checkpoints with no sign of overfitting.

Evaluation Results

Summarization Task

Evaluated on 47 held-out Slips IDS incidents using gpt-oss-120b as an independent LLM-as-judge.

Rank	Model	Avg Score	Win Rate
1	GPT-4o-mini	6.89/10	42.6%
2	GPT-4o	5.87/10	29.8%
3	Qwen2.5-1.5B (finetuned)	4.70/10	19.1%
4	Qwen2.5 3B (baseline)	4.57/10	8.5%
5	Qwen2.5 1B (baseline)	3.36/10	0.0%

The finetuned 1.5B model beats both untuned baselines and achieves a 19.1% win rate — higher than the 3B baseline.

Cause Analysis & Risk Assessment Tasks

Evaluated on 67 held-out Slips IDS incidents.

Rank	Model	Avg Cause Score	Avg Risk Score	Win Rate
1	GPT-4o	15.33	11.99	40.3%
2	Qwen2.5-1.5B (finetuned)	15.58	10.27	37.3%
3	GPT-4o-mini	15.31	11.63	19.4%
4	Qwen2.5 1.5B (baseline)	9.15	8.79	3.0%
5	Qwen2.5 3B (baseline)	7.40	9.61	0.0%

Key Finding: The finetuned model is nearly tied with GPT-4o overall and beats GPT-4o on cause analysis (15.58 vs 15.33), at a fraction of the inference cost.

Known Limitations

Context window: Performance degrades on incidents with ≥500 events where DAG token counts exceed the 4096-token limit. Complex incidents are truncated.
Risk calibration: The model is stronger at identifying causes than calibrating risk levels (cause score 15.58 vs risk score 10.27).
Normal traffic: Summarization accuracy on normal (benign) traffic is lower than on incident traffic.
Domain: Trained exclusively on Slips IDS logs — not suitable for other IDS formats or general security tasks.

Intended Use

Automated triage of Slips IDS alerts for security analysts
Full pipeline: summarize → analyze cause → assess risk, in a single model
First-pass analysis of network incident logs as input to downstream reporting or ticketing workflows
Edge/on-premises deployment (RPi5, low-resource servers) via GGUF quantization

Out-of-Scope Use

General-purpose chat or instruction following
Security domains outside Slips IDS / network intrusion detection
Non-English inputs

Model Details

Model Size: 1.5B parameters
Tensor Type: BF16
License: Apache-2.0

Citation

bibtex

@misc{qwen2.5-1.5b-slips-unified,
  title        = {Qwen2.5-1.5B fine-tuned for unified Slips IDS security analysis},
  author       = {Stratosphere Laboratory, CTU Prague},
  year         = {2026},
  howpublished = {\url{https://huggingface.co/harpomaxx/qwen2.5-1.5b-slips-immune-unified-v3}}
}

Acknowledgments

Supported by the NLnet Foundation as part of the IMMUNE project, promoting open internet standards and open source software.