shaswatamitra/falcon-snort-bi-all-mpnet-base-v2

FALCON bi-encoder — SNORT / all-mpnet-base-v2

Contrastive encoder fine-tuned to map CTI text and SNORT rules into a shared embedding space. Backbone: sentence-transformers/all-mpnet-base-v2.

Test-set metrics

split	recall@1	F1	threshold	diag mean	off-diag mean
pretrained	0.8142	0.3063	0.6441	0.5653	0.3167
run_0	0.9539	0.9118	0.7036	0.9352	0.0594
run_1	0.9526	0.9310	0.7008	0.9283	0.0472
run_2	0.9551	0.9301	0.6966	0.9358	0.0510
run_3	0.9551	0.9360	0.6986	0.9423	0.0381
run_4	0.9551	0.9443	0.7112	0.9668	0.0073

Training

Symmetric InfoNCE / NT-Xent over in-batch negatives. Best checkpoint selected by validation loss.

• Run 0 — batch=16, epochs=5, lr=2e-05, schedule=constant, T=0.05
• Run 1 — batch=50, epochs=10, lr=2e-05, schedule=constant, T=0.05
• Run 2 — batch=70, epochs=30, lr=2e-05, schedule=constant, T=0.05
• Run 3 — batch=128, epochs=30, lr=5e-05, schedule=warmup_cosine, T=0.05
• Run 4 — batch=70, epochs=50, lr=2e-05, schedule=constant, T=0.07

Loading

from transformers import AutoModel, AutoTokenizer
tok   = AutoTokenizer.from_pretrained("shaswatamitra/falcon-snort-bi-all-mpnet-base-v2")
model = AutoModel.from_pretrained("shaswatamitra/falcon-snort-bi-all-mpnet-base-v2")

Citation

@article{mitra2025falcon,
  title={FALCON: Autonomous Cyber Threat Intelligence Mining with LLMs for IDS Rule Generation},
  author={Mitra, Shaswata and Bazarov, Azim and Duclos, Martin and Mittal, Sudip and Piplai, Aritran and Rahman, Md Rayhanur and Zieglar, Edward and Rahimi, Shahram},
  journal={arXiv preprint arXiv:2508.18684},
  year={2025}
}