ThreatQwen-1.7B-Detect

A QLoRA fine-tune of Qwen3-1.7B-Instruct for cybersecurity event triage. Given a raw security event (Sysmon, CloudTrail, HTTP log, etc.), the model returns a structured JSON verdict.

Results

Evaluated on a balanced held-out test set of 882 samples (441 malicious + 441 benign):

Model	Accuracy	Mal. Recall	Ben. Recall	Macro F1
ThreatQwen-1.7B-Detect (ours)	95.1%	96.1%	94.2%	0.951
Base Qwen3-1.7B (no fine-tune)	85.1%	92.1%	78.2%	0.851
GPT-4o (Azure, zero-shot)	51.8%	85.0%	18.6%	0.458
GPT-4o-mini (Azure, zero-shot)	51.9%	59.6%	44.2%	0.516

Fine-tuning improves the base model by +10 percentage points and outperforms GPT-4o by +43.3 percentage points.

Output Schema

{"verdict": "malicious | benign"}

Training

Parameter	Value
Base model	unsloth/Qwen3-1.7B-unsloth-bnb-4bit
Method	QLoRA 4-bit NF4
LoRA rank / alpha	16 / 32
Epochs	3
Effective batch size	16 (batch 4 × accum 4)
Learning rate	2e-4 cosine
MAX_SEQ_LEN	512
Hardware	Tesla T4 (Kaggle free tier)
Training time	~10 min

Dataset

Combines SigmaHQ, Elastic Detection Rules, and Nuclei templates (5,823 real malicious events) with GPT-4o-generated synthetic benign examples (3,743 benign covering Windows, web, email, database, VPN/remote-access). Full dataset: minar-svn/ThreatQwen-detection-dataset

Deployment

• Fully offline — no internet required (air-gapped SOC capable)
• ~3.1 GB VRAM (4-bit quantized)
• ~18 tokens/sec on Tesla T4
• ~5–7 sec/event latency
• Adapter: ~434 MB
• Min GPU: RTX 3060 (8 GB)

Usage

from transformers import AutoModelForCausalLM, AutoTokenizer
from peft import PeftModel
import torch, json

base = AutoModelForCausalLM.from_pretrained(
    "unsloth/Qwen3-1.7B-unsloth-bnb-4bit",
    torch_dtype=torch.float16, device_map="auto",
)
model     = PeftModel.from_pretrained(base, "minar-svn/ThreatQwen-1.7B-Detect")
tokenizer = AutoTokenizer.from_pretrained("minar-svn/ThreatQwen-1.7B-Detect")

SYSTEM = 'You are a cybersecurity detection model. Respond ONLY with valid JSON. Format: {"verdict": "malicious | benign"}'

event = "EventID: 1 Image: rundll32.exe CommandLine: comsvcs.dll MiniDump User: admin"

msgs   = [{"role":"system","content":SYSTEM},{"role":"user","content":f"Analyze:\n\n{event}"}]
prompt = tokenizer.apply_chat_template(msgs, tokenize=False, add_generation_prompt=True).strip()
inputs = tokenizer(prompt, return_tensors="pt").to(model.device)

with torch.no_grad():
    out = model.generate(**inputs, max_new_tokens=40, do_sample=False,
                         pad_token_id=tokenizer.eos_token_id)

response = tokenizer.decode(out[0][inputs["input_ids"].shape[1]:], skip_special_tokens=True).strip()
blocks   = [b.strip() for b in response.split("\n\n") if b.strip()]
print(json.loads(blocks[-1]))
# {"verdict": "malicious"}

Limitations

• All benign test examples are synthetic — real-world benign generalization untested
• English only
• Analyst aid only — not a sole decision authority

Citation

@misc{threatqwen2026,
  author    = {Md. Minaruzzaman Shovon},
  title     = {ThreatQwen-1.7B-Detect},
  year      = {2026},
  publisher = {Hugging Face},
  url       = {https://huggingface.co/minar-svn/ThreatQwen-1.7B-Detect}
}

License

Apache 2.0