Training update: 12,676/238,520 rows (5.31%) | +2059 new @ 2025-10-23 07:43:06

README.md

@@ -18,43 +18,43 @@ library_name: transformers
 pipeline_tag: fill-mask
 ---
 # bert-micro-cybersecurity
+
 ## 1. Model Details
 **Model description**  
 "bert-micro-cybersecurity" is a compact transformer model adapted for cybersecurity text classification tasks (e.g., threat detection, incident reports, malicious vs benign content).
 - Model type: fine-tuned lightweight BERT variant  
 - Languages: English & Indonesia
 - Finetuned from: `boltuix/bert-micro`
-- Status: **Early version** — trained on **3.25%** of planned data.
+- Status: **Early version** — trained on **5.31%** of planned data.
 **Model sources**  
 - Base model: [boltuix/bert-micro](https://huggingface.co/boltuix/bert-micro)
 - Data: Cybersecurity Data
+
 ## 2. Uses
 ### Direct use  
 You can use this model to classify cybersecurity-related text — for example, whether a given message, report or log entry indicates malicious intent, abnormal behaviour, or threat presence.
 ### Downstream use  
-- Embedding extraction for clustering or anomaly detection in security logs.  
+- Embedding extraction for clustering.
+- Named Entity Recognition on log or security data.
+- Classification of security data.
+- Anomaly detection in security logs.  
 - As part of a pipeline for phishing detection, malicious email filtering, incident triage.  
 - As a feature extractor feeding a downstream system (e.g., alert-generation, SOC dashboard).
 ### Out-of-scope use  
 - Not meant for high-stakes automated blocking decisions without human review.  
 - Not optimized for languages other than English and Indonesian.  
 - Not tested for non-cybersecurity domains or out-of-distribution data.
+
+### Downstream Usecase in Development using this model
+- NER on security log, botnet data, and json data.
+- Early classification of SIEM alert & events.
+
 ## 3. Bias, Risks, and Limitations 
-Because the model is based on a small subset (3.25%) of planned data, performance is preliminary and may degrade on unseen or specialized domains (industrial control, IoT logs, foreign language).
+Because the model is based on a small subset (5.31%) of planned data, performance is preliminary and may degrade on unseen or specialized domains (industrial control, IoT logs, foreign language).
 - Inherits any biases present in the base model (`boltuix/bert-micro`) and in the fine-tuning data — e.g., over-representation of certain threat types, vendor or tooling-specific vocabulary.
-- Should not be used as sole authority for incident decisions; only as an aid to human analysts.
-## 4. How to Get Started with the Model  
-```python
-from transformers import AutoTokenizer, AutoModelForSequenceClassification
-tokenizer = AutoTokenizer.from_pretrained("codechrl/bert-micro-cybersecurity")
-model = AutoModelForSequenceClassification.from_pretrained("codechrl/bert-micro-cybersecurity")
-inputs = tokenizer("The server logged an unusual outbound connection to 123.123.123.123", 
-                   return_tensors="pt", truncation=True, padding=True)
-outputs = model(**inputs)
-logits = outputs.logits
-predicted_class = logits.argmax(dim=-1).item()
-```
-## 5. Training Details
+- **Should not be used as sole authority for incident decisions; only as an aid to human analysts.**
+
+## 4. Training Details
 
 ### Text Processing & Chunking
 Since cybersecurity data often contains lengthy alert descriptions and execution logs that exceed BERT's 512 token limit, we implement an overlapping chunking strategy:
@@ -74,11 +74,9 @@ Since cybersecurity data often contains lengthy alert descriptions and execution
 - **LR scheduler**: Linear with warmup
 
 ### Training Data
-- **Total database rows**: 238,469
-- **Rows processed (cumulative)**: 7,754 (3.25%)
-- **Rows in this session**: 4,922
-- **Training samples (after chunking)**: 5,000
-- **Training date**: 2025-10-23 04:53:41
+- **Total database rows**: 238,520
+- **Rows processed (cumulative)**: 12,676 (5.31%)
+- **Training date**: 2025-10-23 07:43:06
 
 ### Post-Training Metrics
 - **Final training loss**: 

model.safetensors

@@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:e34d67e8d356f460943f98143843d64ac1d706bd3d53a639e1776fafddce67af
+oid sha256:68ee1fc100b841633b706f0d5222d91775561369465c8b1c96afd2cde4b55c33
 size 17671560

training_args.bin

@@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:1b6723809aae4d6e81df5bc3af0fef812aef6e4e443ec397ab0eca959b1da657
+oid sha256:55311dd962a4c0afe20204036e6312d1bcb507b0775ded50c5441d844c8c8238
 size 5905

training_metadata.json

@@ -1,11 +1,11 @@
 {
-  "trained_at": 1761195221.323231,
-  "trained_at_readable": "2025-10-23 04:53:41",
-  "samples_this_session": 5000,
-  "new_rows_this_session": 4922,
-  "trained_rows_total": 7754,
-  "total_db_rows": 238469,
-  "percentage": 3.2515756765030255,
+  "trained_at": 1761205386.5296822,
+  "trained_at_readable": "2025-10-23 07:43:06",
+  "samples_this_session": 7524,
+  "new_rows_this_session": 2059,
+  "trained_rows_total": 12676,
+  "total_db_rows": 238520,
+  "percentage": 5.314439040751299,
   "final_loss": 0,
   "epochs": 3,
   "learning_rate": 5e-05,