| --- |
| title: CodeSentinel |
| emoji: 🛡️ |
| colorFrom: green |
| colorTo: gray |
| sdk: docker |
| app_port: 7860 |
| pinned: false |
| --- |
| |
| # CodeSentinel |
|
|
| Vulnerability classification tool combining fine-tuned ML models with MITRE framework coverage. |
|
|
| Paste a **code snippet**, **CVE description**, or **bug report** — CodeSentinel identifies the vulnerability type, severity, and (for AI/ML inputs) the relevant ATLAS attack technique. |
|
|
| ## What it does |
|
|
| - **Code input** → Qwen2.5-Coder 7B analyzes the code → RoBERTa classifies the CWE |
| - **Text input** → RoBERTa classifies directly from the description |
| - **AI/ML input** → ATLAS pattern matcher identifies the relevant attack technique |
|
|
| ## Models |
|
|
| | Model | Purpose | Accuracy | |
| |-------|---------|----------| |
| | [`martynattakit/vuln-classifier-roberta`](https://huggingface.co/martynattakit/vuln-classifier-roberta) | CWE classification from text | Macro F1: 0.850 | |
| | [`martynattakit/vuln-analyzer-qwen-lora`](https://huggingface.co/martynattakit/vuln-analyzer-qwen-lora) | Code → vulnerability description | Eval loss: — | |
|
|
| ## Coverage |
|
|
| **CWE Top 25** (MITRE 2024): |
| CWE-787, CWE-79, CWE-89, CWE-416, CWE-78, CWE-20, CWE-125, CWE-22, CWE-352, CWE-434, CWE-862, CWE-476, CWE-287, CWE-190, CWE-502, CWE-77, CWE-119, CWE-798, CWE-918, CWE-306, CWE-362, CWE-269, CWE-94, CWE-863, CWE-276 |
|
|
| **MITRE ATLAS** (25 techniques): |
| Prompt injection, data poisoning, model extraction, membership inference, adversarial examples, jailbreaking, and more. |
|
|
| ## Known limitations |
|
|
| - **CWE-77**: 0 F1 — insufficient training samples. Predictions for this class are unreliable. |
| - **CWE-863**: F1 0.60 — semantic overlap with CWE-862 makes these hard to distinguish. |
| - **ATLAS matching** uses keyword signals + retrieval, not a fine-tuned classifier. Confidence scores reflect signal overlap, not ground-truth accuracy. No labeled ATLAS dataset exists yet. |
| - **Code analysis** training data is primarily C/C++ (BigVul). Python/JS/Go descriptions may be less precise. |
|
|
| ## Stack |
|
|
| ``` |
| RoBERTa-base fine-tuned on 165k CVE→CWE pairs (xamxte/cve-to-cwe) |
| Qwen2.5-Coder-7B QLoRA fine-tuned on BigVul (1,596 samples) |
| ATLAS matcher keyword RAG over 25 hand-crafted MITRE case studies |
| FastAPI REST API backend |
| ``` |
|
|
| ## Local development |
|
|
| ```bash |
| pip install -r requirements.txt |
| python app.py |
| # → http://localhost:7860 |
| ``` |
|
|
| ## Project structure |
|
|
| ``` |
| pipeline/ |
| classifier.py RoBERTa inference wrapper |
| code_analyzer.py Qwen inference wrapper |
| atlas_matcher.py ATLAS pattern matcher |
| router.py Input routing + output card |
| api/ |
| main.py FastAPI endpoints |
| frontend/ |
| index.html Web UI |
| data/ |
| atlas_cases.json 25 MITRE ATLAS techniques (hand-crafted) |
| notebooks/ |
| 01_roberta_finetune.ipynb |
| 02_qwen_qlora.ipynb |
| ``` |
|
|
| ## Links |
| - [Try the application here!](https://huggingface.co/spaces/martynattakit/CodeSentinel-CWE_Classification) |
| - [Medium Blog](https://medium.com/@martyxc2018/codesentinel-ai-cwe-classification-a3ed88f2be28) |
|
|
| ## Acknowledgements |
|
|
| - **My mentor and TA from AI Builders 2025** |
| For making this project possible by giving me guidances, feedbacks throughout the development of this project. |
|
|
