FALCON dual-encoder — YARA / `all-MiniLM-L6-v2`

Contrastive encoder fine-tuned to map CTI text and YARA rules into a shared embedding space. Backbone: sentence-transformers/all-MiniLM-L6-v2.

Test-set metrics

split	recall@1	F1	threshold	diag mean	off-diag mean
pretrained	0.7980	0.5409	0.7171	0.9198	0.7944
run_0	0.9487	0.9179	0.7038	0.9263	0.1520
run_1	0.9476	0.9209	0.7041	0.9429	0.0878
run_2	0.9487	0.9184	0.7084	0.9577	0.1051
run_3	0.9498	0.9329	0.7039	0.9508	0.0639
run_4	0.9498	0.9313	0.7105	0.9692	0.0063

Training

Symmetric InfoNCE / NT-Xent over in-batch negatives. Best checkpoint selected by validation loss.

Run 0 — batch=16, epochs=5, lr=2e-05, schedule=constant, T=0.05
Run 1 — batch=50, epochs=10, lr=2e-05, schedule=constant, T=0.05
Run 2 — batch=70, epochs=30, lr=2e-05, schedule=constant, T=0.05
Run 3 — batch=128, epochs=30, lr=5e-05, schedule=warmup_cosine, T=0.05
Run 4 — batch=70, epochs=50, lr=2e-05, schedule=constant, T=0.07

Loading

from transformers import AutoModel, AutoTokenizer
tok   = AutoTokenizer.from_pretrained("shaswatamitra/falcon-yara-dual-all-MiniLM-L6-v2", subfolder='rule')
model = AutoModel.from_pretrained("shaswatamitra/falcon-yara-dual-all-MiniLM-L6-v2", subfolder='rule')

Dual-encoder layout: this repo has rule/ (encodes YARA rules) and cti/ (encodes CTI text) subfolders. Load each with subfolder=....

Citation

@article{mitra2025falcon,
  title={FALCON: Autonomous Cyber Threat Intelligence Mining with LLMs for IDS Rule Generation},
  author={Mitra, Shaswata and Bazarov, Azim and Duclos, Martin and Mittal, Sudip and Piplai, Aritran and Rahman, Md Rayhanur and Zieglar, Edward and Rahimi, Shahram},
  journal={arXiv preprint arXiv:2508.18684},
  year={2025}
}