update

Dockerfile

@@ -1,20 +1,31 @@
-FROM python:3.13.5-slim
+# Text OSINT AI demo — Docker Space (CPU). Runs the Streamlit app.
+# For a GPU Space, swap the base for an NVIDIA CUDA image (e.g.
+# nvidia/cuda:12.4.1-runtime-ubuntu22.04 + python), install bitsandbytes,
+# and the app's USE_GPU path loads the 4-bit base automatically.
+FROM python:3.12-slim
 
-WORKDIR /app
-
-RUN apt-get update && apt-get install -y \
-    build-essential \
-    curl \
-    git \
+# curl is used by the Streamlit healthcheck below
+RUN apt-get update && apt-get install -y --no-install-recommends curl \
     && rm -rf /var/lib/apt/lists/*
 
-COPY requirements.txt ./
-COPY src/ ./src/
+# Non-root user (HF Spaces best practice — keeps the HF model cache writable)
+RUN useradd -m -u 1000 user
+USER user
+ENV HOME=/home/user \
+    PATH=/home/user/.local/bin:$PATH \
+    HF_HOME=/home/user/.cache/huggingface
 
-RUN pip3 install -r requirements.txt
+WORKDIR $HOME/app
 
-EXPOSE 8501
+COPY --chown=user requirements.txt ./
+RUN pip install --no-cache-dir --upgrade pip \
+    && pip install --no-cache-dir -r requirements.txt
 
-HEALTHCHECK CMD curl --fail http://localhost:8501/_stcore/health
+COPY --chown=user . .
+
+EXPOSE 8501
+HEALTHCHECK CMD curl --fail http://localhost:8501/_stcore/health || exit 1
 
-ENTRYPOINT ["streamlit", "run", "src/streamlit_app.py", "--server.port=8501", "--server.address=0.0.0.0"]
+ENTRYPOINT ["streamlit", "run", "app.py", \
+            "--server.port=8501", "--server.address=0.0.0.0", \
+            "--server.headless=true"]

README.md

@@ -1,20 +1,47 @@
 ---
-title: TextScout
-emoji: 🚀
-colorFrom: red
-colorTo: red
+title: Text OSINT AI
+emoji: 🛡️
+colorFrom: indigo
+colorTo: blue
 sdk: docker
 app_port: 8501
-tags:
-- streamlit
 pinned: false
-short_description: ' Fine-tuned Llama 3.2 3B for red team Text OSINT.'
 license: bigscience-openrail-m
 ---
 
-# Welcome to Streamlit!
+# Text OSINT AI — demo
 
-Edit `/src/streamlit_app.py` to customize this app to your heart's desire. :heart:
+Live demo of the fine-tuned **Text OSINT AI** model: a Llama-3.2-3B LoRA adapter
+(`Maximuz23/Text-OSINT`) for red-team threat intelligence. It extracts IOCs,
+profiles threat actors, and maps MITRE ATT&CK from a supplied record — and
+**refuses to fabricate** when the lookup is empty (evidence-gated honesty).
 
-If you have any questions, checkout our [documentation](https://docs.streamlit.io) and [community
-forums](https://discuss.streamlit.io).
+This is a **Docker** Space. Files: `Dockerfile`, `app.py`, `requirements.txt`,
+`examples.json`. The container installs deps and runs
+`streamlit run app.py` on port 8501.
+
+## Pushing updates
+From the `osint-project` root, with the `hf` CLI authenticated:
+```bash
+hf upload <user>/<space> demo . --type space
+```
+If the adapter repo `Maximuz23/Text-OSINT` is **private**, add a Space secret
+`HF_TOKEN` (Settings → Variables and secrets) with a read token.
+
+## CPU vs GPU
+- **Free CPU** runs the 3B model; the first generation is ~30–60s (model load),
+  then faster. Lower *Max new tokens* in the sidebar for a snappier live demo.
+- For instant responses, switch the Space hardware to **T4 small** (~$0.40/hr),
+  change the `Dockerfile` base to an NVIDIA CUDA image, and uncomment
+  `bitsandbytes` in `requirements.txt` (the GPU path uses the 4-bit base).
+  **Pause the Space after the demo** so you stop paying.
+
+## Contract — do not drift
+`app.py` mirrors `ai-test.ipynb` exactly: the system prompt, chat template,
+greedy decoding (`do_sample=False`), and 384 max new tokens. If you retrain and
+the eval contract changes, update both together or the model goes off-distribution.
+
+## Phase 2 (optional)
+Add live-API enrichment: user types a CVE id / actor name → fetch NVD / CISA KEV /
+MITRE → build the record in this same format → feed the model. Keeps the demo on
+"current ground truth" instead of pasted records. Needs NVD/OTX keys as secrets.

app.py

@@ -0,0 +1,179 @@
+"""
+Text OSINT AI — live demo (Streamlit, for Hugging Face Spaces).
+
+Loads the fine-tuned LoRA adapter `Maximuz23/Text-OSINT` on Llama-3.2-3B-Instruct
+and reproduces the EXACT inference contract from ai-test.ipynb (system prompt,
+chat template, greedy decoding, 384 new tokens). Keep these in sync with the
+notebook — any drift puts the model off-distribution and the demo looks broken.
+
+The point of the demo is the honesty differentiator: the model extracts/structures
+intel from a real record, and *refuses* (instead of hallucinating) when the lookup
+is empty — fake CVE id, unknown actor, etc.
+"""
+import os
+import json
+import time
+import pathlib
+import re
+
+import streamlit as st
+import torch
+from transformers import AutoModelForCausalLM, AutoTokenizer
+from peft import PeftModel
+
+# --- contract (mirror ai-test.ipynb cells 1 & 3) --------------------------------
+HF_REPO = "Maximuz23/Text-OSINT"
+USE_GPU = torch.cuda.is_available()
+# GPU Space -> the 4-bit base used in training (needs bitsandbytes).
+# Free CPU Space -> the 16-bit base (ungated); the adapter applies to either.
+BASE_MODEL = "unsloth/Llama-3.2-3B-Instruct-bnb-4bit" if USE_GPU else "unsloth/Llama-3.2-3B-Instruct"
+MAX_NEW_TOKENS_DEFAULT = 384
+HF_TOKEN = os.environ.get("HF_TOKEN")  # set as a Space secret if the adapter repo is private
+
+SYSTEM_PROMPT = (
+    "You are an expert cybersecurity analyst specializing in Text OSINT and threat "
+    "intelligence for red team operations. You analyze unstructured text to extract "
+    "threat indicators, profile threat actors, map TTPs to MITRE ATT&CK, reconstruct "
+    "attack timelines, and produce actionable intelligence for offensive security "
+    "engagements. Work only from the record provided: extract and analyze what is present, "
+    "and when a lookup is empty or no record is given, say so plainly instead of inventing "
+    "details. Judge by the evidence in the input, not by whether a name looks familiar."
+)
+
+# Light heuristic only for the on-screen badge (NOT the eval scorer).
+REFUSAL_HINTS = re.compile(
+    r"no record (?:for|of|found)|won'?t fabricat|returns? no data|not indexed|"
+    r"no authoritative record|cannot produce an assessment|no matching group",
+    re.I,
+)
+
+EXAMPLES_PATH = pathlib.Path(__file__).parent / "examples.json"
+EXAMPLE_LABELS = {
+    "real_cve":   "Real CVE — Log4Shell  →  expect: structured assessment",
+    "fake_cve":   "Fake CVE — CVE-9999-987654  →  expect: refusal",
+    "real_actor": "Real actor — APT28  →  expect: threat profile",
+    "fake_actor": "Fake actor — APT-Lyrebird-77  →  expect: refusal",
+    "raw_report": "Raw report — abuse.ch malware URL  →  expect: IOC extraction",
+}
+
+
+@st.cache_resource(show_spinner="Loading Llama-3.2-3B + Text-OSINT adapter (first load is slow)…")
+def load_model():
+    tok = AutoTokenizer.from_pretrained(BASE_MODEL, token=HF_TOKEN)
+    if tok.pad_token is None:
+        tok.pad_token = tok.eos_token
+    tok.padding_side = "left"
+    kwargs = dict(token=HF_TOKEN)
+    if USE_GPU:
+        kwargs.update(device_map={"": 0}, torch_dtype=torch.float16)
+    else:
+        # bf16 halves RAM vs fp32 (~6GB for 3B, fits the free 16GB CPU Space) and,
+        # unlike fp16, runs on CPU. low_cpu_mem_usage avoids a 2x spike at load.
+        kwargs.update(torch_dtype=torch.bfloat16, low_cpu_mem_usage=True)
+    base = AutoModelForCausalLM.from_pretrained(BASE_MODEL, **kwargs)
+    base.config.use_cache = True
+    model = PeftModel.from_pretrained(base, HF_REPO, token=HF_TOKEN)
+    model.eval()
+    return tok, model
+
+
+def _device(model):
+    return next(model.parameters()).device
+
+
+def generate(prompt, use_adapter=True, max_new_tokens=MAX_NEW_TOKENS_DEFAULT):
+    tok, model = load_model()
+    messages = [
+        {"role": "system", "content": SYSTEM_PROMPT},
+        {"role": "user", "content": prompt},
+    ]
+    inputs = tok.apply_chat_template(
+        messages, tokenize=True, add_generation_prompt=True,
+        return_tensors="pt", return_dict=True,
+    )
+    inputs = {k: v.to(_device(model)) for k, v in inputs.items()}
+    gen_kwargs = dict(max_new_tokens=max_new_tokens, do_sample=False, pad_token_id=tok.eos_token_id)
+    with torch.no_grad():
+        if use_adapter:
+            out = model.generate(**inputs, **gen_kwargs)
+        else:
+            with model.disable_adapter():
+                out = model.generate(**inputs, **gen_kwargs)
+    in_len = inputs["input_ids"].shape[1]
+    return tok.decode(out[0][in_len:], skip_special_tokens=True).strip()
+
+
+def badge(text):
+    if REFUSAL_HINTS.search(text):
+        st.warning("🛡️ **Refused** — no source record (honesty guardrail held)")
+    else:
+        st.success("✅ **Extracted** from the record")
+
+
+# --- UI -------------------------------------------------------------------------
+st.set_page_config(page_title="Text OSINT AI", page_icon="🛡️", layout="wide")
+st.title("🛡️ Text OSINT AI — red-team threat-intel assistant")
+st.caption(
+    "Fine-tuned Llama-3.2-3B (LoRA adapter `Maximuz23/Text-OSINT`). It extracts IOCs, "
+    "profiles actors, and maps MITRE ATT&CK from a supplied record — and **refuses to "
+    "fabricate** when the lookup is empty (fake CVE, unknown actor). Evidence-gated honesty."
+)
+
+with st.sidebar:
+    st.subheader("Model")
+    st.markdown(
+        f"- **Base:** `{BASE_MODEL}`\n"
+        f"- **Adapter:** `{HF_REPO}`\n"
+        f"- **Device:** `{'GPU' if USE_GPU else 'CPU (free)'}`"
+    )
+    st.divider()
+    max_tokens = st.slider(
+        "Max new tokens", 128, 512, MAX_NEW_TOKENS_DEFAULT, 32,
+        help="384 matches the eval. Lower it for faster CPU demos.",
+    )
+    show_base = st.checkbox(
+        "Also run the BASE model (show what fine-tuning fixed)", value=False,
+        help="Doubles latency. Best on a fake input: base waffles, fine-tune refuses.",
+    )
+    st.caption("Inputs use the same record format the model was trained on — load an example to see it.")
+
+examples = json.loads(EXAMPLES_PATH.read_text())
+st.session_state.setdefault("input_text", examples["fake_cve"])
+
+col_in, col_pick = st.columns([3, 1])
+with col_pick:
+    choice = st.selectbox("Try an example", list(EXAMPLE_LABELS), format_func=lambda k: EXAMPLE_LABELS[k])
+    if st.button("⤵ Load example", use_container_width=True):
+        st.session_state.input_text = examples[choice]
+with col_in:
+    prompt = st.text_area("Record / report to analyze", key="input_text", height=240)
+
+if st.button("🔍 Analyze", type="primary"):
+    if not prompt.strip():
+        st.error("Paste a record or load an example first.")
+        st.stop()
+
+    if show_base:
+        col_ft, col_base = st.columns(2)
+        with col_ft:
+            st.markdown("#### Fine-tuned (Text-OSINT)")
+            with st.spinner("Generating…"):
+                t0 = time.time()
+                out = generate(prompt, use_adapter=True, max_new_tokens=max_tokens)
+            badge(out)
+            st.code(out, language="markdown")
+            st.caption(f"{time.time() - t0:.1f}s")
+        with col_base:
+            st.markdown("#### Base Llama-3.2-3B (no adapter)")
+            with st.spinner("Generating…"):
+                t0 = time.time()
+                out_b = generate(prompt, use_adapter=False, max_new_tokens=max_tokens)
+            st.code(out_b, language="markdown")
+            st.caption(f"{time.time() - t0:.1f}s")
+    else:
+        with st.spinner("Generating…"):
+            t0 = time.time()
+            out = generate(prompt, use_adapter=True, max_new_tokens=max_tokens)
+        badge(out)
+        st.code(out, language="markdown")
+        st.caption(f"{time.time() - t0:.1f}s")

examples.json

@@ -0,0 +1,7 @@
+{
+ "real_cve": "[CVE Record]\nCVE: CVE-2021-44228\nName: Apache Log4j2 Remote Code Execution Vulnerability\nVendor/Product: Apache Log4j2\nDescription: Apache Log4j2 contains a vulnerability where JNDI features do not protect against attacker-controlled JNDI-related endpoints, allowing for remote code execution.\nCISA KEV: listed (confirmed exploited in the wild)\nRequired action: For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures provided at https://www.cisa.gov/uscert/ed-22-02-apache-log4j-recommended-mitigation-measures are only acceptable until updates are available.\n\nAssess this CVE for offensive relevance.",
+ "fake_cve": "[CVE Record]\nCVE: CVE-9999-987654\nNVD: this identifier is not indexed.\nKEV: not present.\n\nAssess this CVE for offensive relevance.",
+ "real_actor": "[MITRE ATT&CK Group lookup]\nName: APT28 (G0007)\nAliases: APT28, IRON TWILIGHT, SNAKEMACKEREL, Swallowtail, Group 74, Sednit, Sofacy, Pawn Storm, Fancy Bear, STRONTIUM, Tsar Team, Threat Group-4127, TG-4127, Forest Blizzard, FROZENLAKE, GruesomeLarch\nAttributed techniques: T1001.001, T1003, T1003.001, T1003.003, T1005, T1014, T1021.002, T1025, T1027.013, T1030, T1036, T1036.005\nDescription: APT28 is a threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center (GTsSS) military unit 26165. This group has been active since at least 2004. APT28 reportedly compromised the Hillary Clinton campaign, the Democratic National Committee, and the Democratic Congressional Campaign Committee in 2016 in an attempt to interfere with the U.S. presidential election. In 2018, the US indicted five GRU Unit 26165 officers associated with APT28 for cyber operations (including close-access operations) conducted between 2014 and 2018 against the World Anti-Doping Agency (WADA), the US Anti-Doping Agency, a US nuclear facility, t\n\nProfile this threat actor and summarize how they operate.",
+ "fake_actor": "[MITRE ATT&CK Group lookup]\nQuery: APT-Lyrebird-77\nResult: query returned no results.\n\nProfile this threat actor.",
+ "raw_report": "This URL was reported to abuse.ch as a malware distribution point. Extract IOCs and explain its threat relevance:\n\nhxxps://wash8siteview.felo7wave[.]surf/software-distribution-dxnp2c7/meta-verify.index malware_download"
+}

requirements.txt

@@ -1,3 +1,8 @@
-altair
-pandas
-streamlit
+streamlit>=1.40
+torch>=2.2
+transformers>=4.45
+peft>=0.13
+accelerate>=0.34
+sentencepiece
+# --- GPU Space only (the 4-bit base needs this) ---
+# bitsandbytes>=0.43