MACyber-12B

MACyber-12B

MACyber-12B is an adaptive 12B-parameter cybersecurity language model designed to bridge security data silos across heterogeneous, structured data sources. Rather than treating cybersecurity as decontextualized question answering, it analyzes operational records from multiple security domains and produces unified, evidence-grounded outputs for anomaly detection, situation assessment, reasoning, and response recommendation.

MACyber-12B combines a dual-channel threat-intelligence retrieval mechanism with CyberLoRA, which supports single-step rapid adaptation for previously unseen threats through LoRA-based adaptation, HyperLoRA, and a hash-fingerprint threat vector library. On the MACyber-INT benchmark, the paper reports that MACyber-12B outperforms the average score of 13 LLM baselines by 21.42% across four cybersecurity tasks. For unknown threats, CyberLoRA provides an average 3.18-point gain with 23.2 ms average adaptation latency.

MACyber-12B is developed together with MACyber-INT, a multi-source aligned cybersecurity intelligence benchmark spanning seven domains and more than 300 cyber threats from a 1.4 TB cybersecurity corpus. The released checkpoint uses the Gemma3ForConditionalGeneration architecture, while the released evaluation workflow targets serialized structured-security text records.

Model Details

The configuration confirms a Gemma3 12B-class architecture. The exact public upstream checkpoint identifier and applicable weight redistribution license should be confirmed before publishing model weights on the Hugging Face Hub.

Intended Uses

MACyber-12B is intended for research on:

• Security telemetry and threat-intelligence record analysis.
• Structured threat classification, severity assessment, and response recommendation.
• Retrieval-augmented cybersecurity situational awareness.
• Evaluation on the MACyber-INT benchmark.

It is not intended to autonomously block traffic, quarantine assets, or make production incident-response decisions without human review.

Output Format

The model is designed to generate a structured assessment in the following form:

{
  "evidence": [
    "feature = value (security interpretation)"
  ],
  "analysis": "First check ...; then verify ...; finally confirm ...; because ..., classify as ....",
  "action": "none | monitor | block",
  "official": "threat label",
  "severity": "benign | suspicious | low | medium | high"
}

Threat-Intelligence RAG

The MACyber repository provides an optional retrieval-augmented generation module under Threat Intelligence RAG/:

• Known-attack channel: retrieves reference cases from a curated knowledge base when the sample belongs to a known dataset or attack domain.
• Unknown-attack channel: retrieves similar reference cases for samples outside the known-attack mapping using feature-based similarity search.

When enabled in the generation pipeline, retrieved references are appended to the system prompt as contextual examples before inference.

CyberLoRA

The repository additionally provides CyberLoRA experimental assets for lightweight cybersecurity adaptation, including a single-step adaptation implementation and a LoRA artifact. The available LoRA training record reports:

These artifacts document the adaptation workflow; users should verify which checkpoint files are included in a specific Hub release before loading an adapter or merged model.

Configuration

The exported model configuration specifies:

The exported artifacts also include an Ollama Modelfile generated by LLaMA-Factory with a default runtime context setting of 4096.

Usage

pip install vllm "transformers>=4.57.6"

import json
from vllm import LLM, SamplingParams
from transformers import AutoTokenizer

model_id = "qcy98/MACyber-12B"

llm = LLM(
    model=model_id,
    trust_remote_code=True,
    gpu_memory_utilization=0.9,
    tensor_parallel_size=1,
    max_model_len=8192,
)
tokenizer = AutoTokenizer.from_pretrained(model_id, trust_remote_code=True)

record = {
    "meta": {"category": "dns", "subcategory": "dns-doh"},
    "json": {"example_feature": "example_value"}
}

system_prompt = """You are an experienced cybersecurity expert. Analyze the input
record and output only valid JSON with the fields evidence, analysis, action,
official, and severity. The action must be block, monitor, or none. The
severity must be benign, suspicious, low, medium, or high."""

user_prompt = (
    "Please analyze the following feature data and output analysis results "
    "in the required JSON format:\n\n"
    + json.dumps(record, ensure_ascii=False, indent=2)
)

messages = [
    {"role": "system", "content": system_prompt},
    {"role": "user", "content": user_prompt},
]

prompt = tokenizer.apply_chat_template(
    messages,
    tokenize=False,
    add_generation_prompt=True,
)

sampling_params = SamplingParams(
    temperature=0.3,
    top_p=0.9,
    max_tokens=1024,
)

outputs = llm.generate([prompt], sampling_params)
print(outputs[0].outputs[0].text.strip())

Although the checkpoint configuration inherits the Gemma3 architecture, the released MACyber evaluation workflow uses vLLM text generation over serialized structured security records.

For benchmark generation with the optional RAG module, use the generation scripts in the MACyber repository:

python Benchmark_Evaluation/generate_answers_vllm.py \
  --input "MACyber-INT_benchmark/DNS Security Threat/dns-doh.json" \
  --output "Benchmark_Evaluation/outputs/MACyber-12B/DNS Security Threat/dns-doh/model_output.json" \
  --type dns-doh \
  --model-path "/path/to/MACyber-12B" \
  --use-rag \
  --rag-top-k 3

In this repository script, --model-path must be a local downloaded checkpoint directory.

Evaluation

MACyber-12B is evaluated with MACyber-INT, a structured cybersecurity benchmark containing 31 datasets across seven domains:

• Network Traffic Security
• IoT Security
• System Log Security
• DNS Security Threat
• Web Security Threat
• Vulnerability Intelligence
• Threat Intelligence

The MACyber evaluator assesses four components of each answer:

Benchmark data, evaluation scripts, and reported result tables are available in the MACyber repository.

Limitations

• Model outputs may contain incorrect classifications, severity assignments, unsupported evidence, or inappropriate response recommendations.
• Retrieval-augmented outputs depend on the coverage and quality of the retrieved reference records.
• Benchmark performance does not establish reliability for real-world incident response or threat hunting.
• The model should be used with analyst review in operational security workflows.

Ethical and Safety Considerations

MACyber-12B is intended for defensive cybersecurity research and analysis. Users are responsible for validating generated assessments, avoiding disclosure of sensitive operational data, and complying with applicable law and organizational policy.

Citation

Please cite the associated project paper:

Chenyang Qiu, Boyuan Wang, Guoshun Nan, Deyu Meng, Tongchuan Xia, Danchen Guan, Yilin Peng, Chenyang Wang, and Xiaofeng Tao. Bridging Cybersecurity Data Silos: From Multi-Source Unified Intelligence Benchmark to Adaptive Cybersecurity LLM.

License

The release license for MACyber-12B model weights must be specified consistently with the confirmed upstream base model license and the terms applicable to any included adaptation artifacts before public distribution. This model card intentionally does not assert a Hub license field until that verification is complete.