NiffyHunt90/wraithwall-core-qwen-epoch2

WraithWall Core

A LoRA adapter fine-tuned on live deception intelligence data.

Developer: wraithwall
Base model: unsloth/qwen2.5-coder-7b-instruct-bnb-4bit
License: apache-2.0

---

What this is

This is not a general-purpose coding assistant. It is a domain-specific adapter trained to reason about deception infrastructure, threat intelligence, and attacker behavior.

I built it because I run live honeypots on the public internet and needed a model that understands:

• Cowrie SSH session analysis
• MITRE ATT&CK technique mapping from raw attacker commands
• CISA KEV CVE triage and patch prioritization
• AbuseIPDB reputation scoring and ISP attribution
• Malware family identification (Mozi, Mirai variants)
• BGP route hijack indicators
• Canary token deployment and detection logic

Trained on real data from production systems — not lab simulations.

---

Training

Parameter	Value
Base model	Qwen/Qwen2.5-Coder-7B-Instruct
Quantization	4-bit (bnb)
Method	LoRA (r=128, alpha=256, dropout=0.05)
Trainable params	322,961,408 (4.07%)
Max seq length	2048
Optimizer	adamw_8bit
Learning rate	1e-4
Scheduler	cosine with 50 warmup steps
Batch size	2 per device, grad accum 2
Effective batch	8
Epochs	2 (~2,100 steps)
Final loss	~0.40–0.47
Platform	Kaggle (NVIDIA T4)

---

Data

Combined WraithWall v2 and v3 datasets. 7,903 examples from two .jsonl files.

Source	Count	What
AbuseIPDB	34	Real attacker IPs from Cowrie honeypot
CISA KEV	46	Live CVEs with CVSS and patch deadlines
MITRE ATT&CK	24	Enterprise techniques mapped to sessions
Malware intel	20	Mozi trends, Mirai 2026 evolution
Honeypot analysis	18	Real Cowrie sessions and payloads
Infrastructure defense	18	SSH hardening, canary deployment
Threat intelligence	25	Campaign correlation, HASSH/JA3
CVE/vulnerabilities	24	CVE-2024-6387, CVE-2024-3094
BGP/ASN monitoring	20	Hijack detection, RIPE RIS
Phishing/domains	25	Typosquatting, homograph detection

Format: ChatML (messages array). Deduped. Zero JSON errors.

---

Usage

With Unsloth

from unsloth import FastLanguageModel

model, tokenizer = FastLanguageModel.from_pretrained(
    model_name="NiffyHunt90/wraithwall-core-qwen-epoch2",
    max_seq_length=2048,
    dtype=None,
    load_in_4bit=True,
)

model = FastLanguageModel.for_inference(model)

messages = [
    {"role": "system", "content": "You are WraithWall Core, a deception intelligence engine."},
    {"role": "user", "content": "Map this Cowrie session to MITRE ATT&CK."},
]

inputs = tokenizer.apply_chat_template(messages, tokenize=True, return_tensors="pt").to("cuda")
outputs = model.generate(inputs, max_new_tokens=512)
print(tokenizer.decode(outputs[0], skip_special_tokens=True))
### With PEFT

```python
from transformers import AutoModelForCausalLM
from peft import PeftModel

base = "Qwen/Qwen2.5-Coder-7B-Instruct"
adapter = "NiffyHunt90/wraithwall-core-qwen-epoch2"

model = AutoModelForCausalLM.from_pretrained(base, load_in_4bit=True, device_map="auto")
model = PeftModel.from_pretrained(model, adapter)
Intended use
•  Honeypot session triage and IOC extraction
•  MITRE technique mapping from raw logs
•  Threat intel Q&A (CVEs, IPs, malware families)
•  Detection rule drafting
•  Python tooling for OSINT and log parsing
Not for
•  General creative writing
•  Medical, legal, or financial advice
•  Real-time data (training cutoff applies)
•  Autonomous high-stakes decisions without human review
----
Limitations
•  Domain-specific. Performance drops outside threat intel and deception topics.
•  LoRA adapter. Requires the base model alongside these weights.
•  Data bias. Tuned on my honeypot infrastructure. Your environment may differ.
•  Hallucination risk. Always verify CVEs and IPs against primary sources.
•  English only.
----
Links
•  Portfolio: niffyhunt.online https://niffyhunt.online
•  GitHub: @niffyhunt https://github.com/niffyhunt
•  Blog: wraithwall.online/blog https://wraithwall.online/blog
----
Built on live traffic. Trained on Kaggle. Deployed to HuggingFace.