Update README.md
Browse files
README.md
CHANGED
|
@@ -36,7 +36,7 @@ The architecture is implemented as a custom `MultiTaskUnixCoder` class in PyTorc
|
|
| 36 |
|
| 37 |
## Training Dataset
|
| 38 |
|
| 39 |
-
The model was trained on the `mahdin70/balanced_merged_bigvul_primevul` dataset
|
| 40 |
- **BigVul**: A dataset of real-world vulnerabilities from open-source projects.
|
| 41 |
- **PrimeVul**: A dataset focused on prime vulnerabilities in code.
|
| 42 |
|
|
@@ -45,10 +45,12 @@ The model was trained on the `mahdin70/balanced_merged_bigvul_primevul` dataset
|
|
| 45 |
- Train: 124,780 samples
|
| 46 |
- Validation: 26,740 samples
|
| 47 |
- Test: 26,738 samples
|
|
|
|
| 48 |
- **Features**:
|
| 49 |
- `func`: Code snippet (text)
|
| 50 |
- `vul`: Binary label (0 = non-vulnerable, 1 = vulnerable)
|
| 51 |
- `CWE ID`: CWE identifier (e.g., CWE-89) or None for non-vulnerable samples
|
|
|
|
| 52 |
- **Preprocessing**:
|
| 53 |
- CWE labels were encoded using a `LabelEncoder` with 134 unique CWE classes identified across the dataset.
|
| 54 |
- Non-vulnerable samples assigned a CWE label of -1 (mapped to 0 in the model).
|
|
@@ -105,106 +107,6 @@ Install the required libraries:
|
|
| 105 |
```bash
|
| 106 |
pip install transformers torch datasets huggingface_hub
|
| 107 |
|
| 108 |
-
```
|
| 109 |
-
Apologies for the oversight! Below is the corrected README.md with the entire content, including the "Sample Code Snippet" section through to the end, formatted properly in Markdown.
|
| 110 |
-
|
| 111 |
-
markdown
|
| 112 |
-
|
| 113 |
-
Collapse
|
| 114 |
-
|
| 115 |
-
Wrap
|
| 116 |
-
|
| 117 |
-
Copy
|
| 118 |
-
# UnixCoder-Primevul-BigVul Model Card
|
| 119 |
-
|
| 120 |
-
## Model Overview
|
| 121 |
-
|
| 122 |
-
`UnixCoder-Primevul-BigVul` is a multi-task model based on Microsoft's `unixcoder-base`, fine-tuned to detect vulnerabilities (`vul`) and classify Common Weakness Enumeration (CWE) types in code snippets. It was developed by [mahdin70](https://huggingface.co/mahdin70) and trained on a balanced dataset combining BigVul and PrimeVul datasets. The model performs binary classification for vulnerability detection and multi-class classification for CWE identification.
|
| 123 |
-
|
| 124 |
-
- **Model Repository**: [mahdin70/UnixCoder-Primevul-BigVul](https://huggingface.co/mahdin70/UnixCoder-Primevul-BigVul)
|
| 125 |
-
- **Base Model**: [microsoft/unixcoder-base](https://huggingface.co/microsoft/unixcoder-base)
|
| 126 |
-
- **Tasks**: Vulnerability Detection (Binary), CWE Classification (Multi-class)
|
| 127 |
-
- **License**: MIT (assumed; adjust if different)
|
| 128 |
-
- **Date**: Trained and uploaded as of March 11, 2025
|
| 129 |
-
|
| 130 |
-
## Model Architecture
|
| 131 |
-
|
| 132 |
-
The model extends `unixcoder-base` with two task-specific heads:
|
| 133 |
-
- **Vulnerability Head**: A linear layer mapping 768-dimensional hidden states to 2 classes (vulnerable or not).
|
| 134 |
-
- **CWE Head**: A linear layer mapping 768-dimensional hidden states to 135 classes (134 CWE types + 1 for "no CWE").
|
| 135 |
-
|
| 136 |
-
The architecture is implemented as a custom `MultiTaskUnixCoder` class in PyTorch, with the loss computed as the sum of cross-entropy losses for both tasks.
|
| 137 |
-
|
| 138 |
-
## Training Dataset
|
| 139 |
-
|
| 140 |
-
The model was trained on the `mahdin70/balanced_merged_bigvul_primevul` dataset (configuration: `10_per_commit`), which combines:
|
| 141 |
-
- **BigVul**: A dataset of real-world vulnerabilities from open-source projects.
|
| 142 |
-
- **PrimeVul**: A dataset focused on prime vulnerabilities in code.
|
| 143 |
-
|
| 144 |
-
### Dataset Details
|
| 145 |
-
- **Splits**:
|
| 146 |
-
- Train: 124,780 samples
|
| 147 |
-
- Validation: 26,740 samples
|
| 148 |
-
- Test: 26,738 samples
|
| 149 |
-
- **Features**:
|
| 150 |
-
- `func`: Code snippet (text)
|
| 151 |
-
- `vul`: Binary label (0 = non-vulnerable, 1 = vulnerable)
|
| 152 |
-
- `CWE ID`: CWE identifier (e.g., CWE-89) or None for non-vulnerable samples
|
| 153 |
-
- **Preprocessing**:
|
| 154 |
-
- CWE labels were encoded using a `LabelEncoder` with 134 unique CWE classes identified across the dataset.
|
| 155 |
-
- Non-vulnerable samples assigned a CWE label of -1 (mapped to 0 in the model).
|
| 156 |
-
|
| 157 |
-
The dataset is balanced to ensure a fair representation of vulnerable and non-vulnerable samples, with a maximum of 10 samples per commit where applicable.
|
| 158 |
-
|
| 159 |
-
## Training Details
|
| 160 |
-
|
| 161 |
-
### Training Arguments
|
| 162 |
-
The model was trained using the Hugging Face `Trainer` API with the following arguments:
|
| 163 |
-
- **Output Directory**: `./unixcoder_multitask`
|
| 164 |
-
- **Evaluation Strategy**: Per epoch
|
| 165 |
-
- **Save Strategy**: Per epoch
|
| 166 |
-
- **Learning Rate**: 2e-5
|
| 167 |
-
- **Batch Size**: 8 (per device, train and eval)
|
| 168 |
-
- **Epochs**: 3
|
| 169 |
-
- **Weight Decay**: 0.01
|
| 170 |
-
- **Logging**: Every 10 steps, logged to `./logs`
|
| 171 |
-
- **WANDB**: Disabled
|
| 172 |
-
|
| 173 |
-
### Training Environment
|
| 174 |
-
- **Hardware**: NVIDIA Tesla T4 GPU
|
| 175 |
-
- **Framework**: PyTorch 2.5.1+cu121, Transformers 4.47.0
|
| 176 |
-
- **Duration**: ~6 hours, 34 minutes, 53 seconds (23,397 steps)
|
| 177 |
-
|
| 178 |
-
### Training Metrics
|
| 179 |
-
Validation metrics across epochs:
|
| 180 |
-
|
| 181 |
-
| Epoch | Training Loss | Validation Loss | Vul Accuracy | Vul Precision | Vul Recall | Vul F1 | CWE Accuracy |
|
| 182 |
-
|-------|---------------|-----------------|--------------|---------------|------------|----------|--------------|
|
| 183 |
-
| 1 | 0.3038 | 0.4997 | 0.9570 | 0.8082 | 0.5379 | 0.6459 | 0.1887 |
|
| 184 |
-
| 2 | 0.6092 | 0.4859 | 0.9587 | 0.8118 | 0.5641 | 0.6657 | 0.2964 |
|
| 185 |
-
| 3 | 0.4261 | 0.5090 | 0.9585 | 0.8114 | 0.5605 | 0.6630 | 0.3323 |
|
| 186 |
-
|
| 187 |
-
- **Final Training Loss**: 0.4430 (average over all steps)
|
| 188 |
-
|
| 189 |
-
## Evaluation
|
| 190 |
-
|
| 191 |
-
The model was evaluated on the test split (26,738 samples) with the following metrics:
|
| 192 |
-
- **Vulnerability Detection**:
|
| 193 |
-
- Accuracy: 0.9571
|
| 194 |
-
- Precision: 0.7947
|
| 195 |
-
- Recall: 0.5437
|
| 196 |
-
- F1 Score: 0.6457
|
| 197 |
-
- **CWE Classification** (on vulnerable samples):
|
| 198 |
-
- Accuracy: 0.3288
|
| 199 |
-
|
| 200 |
-
The model excels at identifying non-vulnerable code (high accuracy) but has moderate recall for vulnerabilities and lower CWE classification accuracy, indicating room for improvement in CWE prediction.
|
| 201 |
-
|
| 202 |
-
## Usage
|
| 203 |
-
|
| 204 |
-
### Installation
|
| 205 |
-
Install the required libraries:
|
| 206 |
-
```bash
|
| 207 |
-
pip install transformers torch datasets huggingface_hub
|
| 208 |
```
|
| 209 |
|
| 210 |
### Sample Code Snippet
|
|
|
|
| 36 |
|
| 37 |
## Training Dataset
|
| 38 |
|
| 39 |
+
The model was trained on the `mahdin70/balanced_merged_bigvul_primevul` dataset, which combines:
|
| 40 |
- **BigVul**: A dataset of real-world vulnerabilities from open-source projects.
|
| 41 |
- **PrimeVul**: A dataset focused on prime vulnerabilities in code.
|
| 42 |
|
|
|
|
| 45 |
- Train: 124,780 samples
|
| 46 |
- Validation: 26,740 samples
|
| 47 |
- Test: 26,738 samples
|
| 48 |
+
|
| 49 |
- **Features**:
|
| 50 |
- `func`: Code snippet (text)
|
| 51 |
- `vul`: Binary label (0 = non-vulnerable, 1 = vulnerable)
|
| 52 |
- `CWE ID`: CWE identifier (e.g., CWE-89) or None for non-vulnerable samples
|
| 53 |
+
|
| 54 |
- **Preprocessing**:
|
| 55 |
- CWE labels were encoded using a `LabelEncoder` with 134 unique CWE classes identified across the dataset.
|
| 56 |
- Non-vulnerable samples assigned a CWE label of -1 (mapped to 0 in the model).
|
|
|
|
| 107 |
```bash
|
| 108 |
pip install transformers torch datasets huggingface_hub
|
| 109 |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| 110 |
```
|
| 111 |
|
| 112 |
### Sample Code Snippet
|