Mohammed Sbaihi
commited on
Update README.md
Browse files
README.md
CHANGED
@@ -25,7 +25,7 @@ The actual version has an accuracy of 82% <br>
|
|
25 |
|
26 |
### Model Description
|
27 |
|
28 |
-
ThreatDetect-C-Cpp can be used as a code classifier.
|
29 |
| Label | Description |
|
30 |
|---------|-------------------------------------------------------|
|
31 |
| CWE-119 | Improper Restriction of Operations within the Bounds of a Memory Buffer |
|
@@ -38,7 +38,7 @@ ThreatDetect-C-Cpp can be used as a code classifier. It classify the input code
|
|
38 |
|
39 |
|
40 |
- **Developed by:** [lemon42-ai](https://github.com/lemon42-ai)
|
41 |
-
- **Contributers** [Abdellah Oumida](https://www.linkedin.com/in/abdellah-oumida-ab9082234/) & [
|
42 |
- **Model type:** [ModernBERT, Encoder-only Transformer](https://arxiv.org/abs/2412.13663)
|
43 |
- **Supported Programming Languages:** C/C++
|
44 |
- **License:** Apache 2.0 (see original License of ModernBERT-Base)
|
@@ -58,142 +58,63 @@ ThreadDetect-C-Cpp can be integrated in code-related applications. For example,
|
|
58 |
|
59 |
## Bias, Risks, and Limitations
|
60 |
|
|
|
|
|
61 |
|
62 |
-
[More Information Needed]
|
63 |
|
64 |
-
### Recommendations
|
65 |
-
|
66 |
-
<!-- This section is meant to convey recommendations with respect to the bias, risk, and technical limitations. -->
|
67 |
-
|
68 |
-
Users (both direct and downstream) should be made aware of the risks, biases and limitations of the model. More information needed for further recommendations.
|
69 |
-
|
70 |
-
## How to Get Started with the Model
|
71 |
-
|
72 |
-
Use the code below to get started with the model.
|
73 |
-
|
74 |
-
[More Information Needed]
|
75 |
|
76 |
## Training Details
|
77 |
|
78 |
### Training Data
|
79 |
|
80 |
-
|
81 |
-
|
82 |
-
[More Information Needed]
|
83 |
|
84 |
### Training Procedure
|
85 |
|
86 |
-
|
87 |
|
88 |
-
#### Preprocessing [optional]
|
89 |
-
|
90 |
-
[More Information Needed]
|
91 |
|
92 |
|
93 |
#### Training Hyperparameters
|
94 |
|
95 |
-
|
96 |
-
|
97 |
-
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
98 |
|
99 |
-
<!-- This section provides information about throughput, start/end time, checkpoint size if relevant, etc. -->
|
100 |
|
101 |
-
[More Information Needed]
|
102 |
|
103 |
## Evaluation
|
104 |
|
105 |
-
|
106 |
-
|
107 |
-
### Testing Data, Factors & Metrics
|
108 |
-
|
109 |
-
#### Testing Data
|
110 |
-
|
111 |
-
<!-- This should link to a Dataset Card if possible. -->
|
112 |
-
|
113 |
-
[More Information Needed]
|
114 |
-
|
115 |
-
#### Factors
|
116 |
-
|
117 |
-
<!-- These are the things the evaluation is disaggregating by, e.g., subpopulations or domains. -->
|
118 |
-
|
119 |
-
[More Information Needed]
|
120 |
-
|
121 |
-
#### Metrics
|
122 |
-
|
123 |
-
<!-- These are the evaluation metrics being used, ideally with a description of why. -->
|
124 |
-
|
125 |
-
[More Information Needed]
|
126 |
-
|
127 |
-
### Results
|
128 |
-
|
129 |
-
[More Information Needed]
|
130 |
-
|
131 |
-
#### Summary
|
132 |
|
133 |
|
134 |
|
135 |
-
##
|
136 |
|
137 |
-
<!-- Relevant interpretability work for the model goes here -->
|
138 |
-
|
139 |
-
[More Information Needed]
|
140 |
-
|
141 |
-
## Environmental Impact
|
142 |
-
|
143 |
-
<!-- Total emissions (in grams of CO2eq) and additional considerations, such as electricity usage, go here. Edit the suggested text below accordingly -->
|
144 |
-
|
145 |
-
Carbon emissions can be estimated using the [Machine Learning Impact calculator](https://mlco2.github.io/impact#compute) presented in [Lacoste et al. (2019)](https://arxiv.org/abs/1910.09700).
|
146 |
-
|
147 |
-
- **Hardware Type:** [More Information Needed]
|
148 |
-
- **Hours used:** [More Information Needed]
|
149 |
-
- **Cloud Provider:** [More Information Needed]
|
150 |
-
- **Compute Region:** [More Information Needed]
|
151 |
-
- **Carbon Emitted:** [More Information Needed]
|
152 |
-
|
153 |
-
## Technical Specifications [optional]
|
154 |
-
|
155 |
-
### Model Architecture and Objective
|
156 |
-
|
157 |
-
[More Information Needed]
|
158 |
-
|
159 |
-
### Compute Infrastructure
|
160 |
-
|
161 |
-
[More Information Needed]
|
162 |
|
163 |
#### Hardware
|
164 |
|
165 |
-
|
166 |
-
|
167 |
-
#### Software
|
168 |
-
|
169 |
-
[More Information Needed]
|
170 |
-
|
171 |
-
## Citation [optional]
|
172 |
-
|
173 |
-
<!-- If there is a paper or blog post introducing the model, the APA and Bibtex information for that should go in this section. -->
|
174 |
-
|
175 |
-
**BibTeX:**
|
176 |
-
|
177 |
-
[More Information Needed]
|
178 |
-
|
179 |
-
**APA:**
|
180 |
-
|
181 |
-
[More Information Needed]
|
182 |
-
|
183 |
-
## Glossary [optional]
|
184 |
-
|
185 |
-
<!-- If relevant, include terms and calculations in this section that can help readers understand the model or model card. -->
|
186 |
-
|
187 |
-
[More Information Needed]
|
188 |
|
189 |
-
## More Information [optional]
|
190 |
|
191 |
-
[More Information Needed]
|
192 |
|
193 |
-
## Model Card Authors [optional]
|
194 |
|
195 |
-
[More Information Needed]
|
196 |
|
197 |
-
## Model Card Contact
|
198 |
|
199 |
-
[More Information Needed]
|
|
|
25 |
|
26 |
### Model Description
|
27 |
|
28 |
+
ThreatDetect-C-Cpp can be used as a code classifier. Instead of binary classification ("safe", "unsafe"), it classify the input code into 7 labels: 'safe' (no vulnerability detected) and six other CWE weaknesses:
|
29 |
| Label | Description |
|
30 |
|---------|-------------------------------------------------------|
|
31 |
| CWE-119 | Improper Restriction of Operations within the Bounds of a Memory Buffer |
|
|
|
38 |
|
39 |
|
40 |
- **Developed by:** [lemon42-ai](https://github.com/lemon42-ai)
|
41 |
+
- **Contributers** [Abdellah Oumida](https://www.linkedin.com/in/abdellah-oumida-ab9082234/) & [Mohammed Sbaihi](https://www.linkedin.com/in/mohammed-sbaihi-aa6493254/)
|
42 |
- **Model type:** [ModernBERT, Encoder-only Transformer](https://arxiv.org/abs/2412.13663)
|
43 |
- **Supported Programming Languages:** C/C++
|
44 |
- **License:** Apache 2.0 (see original License of ModernBERT-Base)
|
|
|
58 |
|
59 |
## Bias, Risks, and Limitations
|
60 |
|
61 |
+
ThreadDetect-C-Cpp can detect weaknesses in C/C++ code only. It should not be used with other programming languages.<br>
|
62 |
+
The model can only detect the six CWEs in the table above.
|
63 |
|
|
|
64 |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
65 |
|
66 |
## Training Details
|
67 |
|
68 |
### Training Data
|
69 |
|
70 |
+
The model was fine-tuned on a minified, clean and deduplicated version of [DiverseVul](https://github.com/wagner-group/diversevul) dataset. <br>
|
71 |
+
This new version can be explored on HF datasets [HERE](https://huggingface.co/datasets/lemon42-ai/minified-diverseful-multilabels)
|
|
|
72 |
|
73 |
### Training Procedure
|
74 |
|
75 |
+
The model was trained using LoRA applied to Q and V matrices.
|
76 |
|
|
|
|
|
|
|
77 |
|
78 |
|
79 |
#### Training Hyperparameters
|
80 |
|
81 |
+
| Hyperparameter | Value |
|
82 |
+
|-------------------------|---------------------------|
|
83 |
+
| Max Sequence Length | 600 |
|
84 |
+
| Batch Size | 48 |
|
85 |
+
| Number of Epochs | 20 |
|
86 |
+
| Learning Rate | 5e-4 |
|
87 |
+
| Weight Decay | 0.01 |
|
88 |
+
| Logging Steps | 100 |
|
89 |
+
| LoRA Rank (r) | 8 |
|
90 |
+
| LoRA Alpha | 32 |
|
91 |
+
| LoRA Dropout | 0.1 |
|
92 |
+
| LoRA Target Modules | attn.Wqkv |
|
93 |
+
| Optimizer | AdamW |
|
94 |
+
| LR Scheduler | CosineAnnealingWarmRestarts |
|
95 |
+
| Scheduler T_0 | 10 |
|
96 |
+
| Scheduler T_mult | 2 |
|
97 |
+
| Scheduler eta_min | 1e-6 |
|
98 |
+
| Training Split Ratio | 90% Train / 10% Validation |
|
99 |
+
| Seed for Splitting | 42 |
|
100 |
|
|
|
101 |
|
|
|
102 |
|
103 |
## Evaluation
|
104 |
|
105 |
+
ThreatDetect-C-Cpp reaches an accruacy of 82%.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
106 |
|
107 |
|
108 |
|
109 |
+
## Technical Specifications
|
110 |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
111 |
|
112 |
#### Hardware
|
113 |
|
114 |
+
The model was fine-tuned on 4 GPUs using torch + accelerate frameworks.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
115 |
|
|
|
116 |
|
|
|
117 |
|
|
|
118 |
|
|
|
119 |
|
|
|
120 |
|
|