stratosphere/qwen2.5-1.5b-slips-immune-summarization

TEXT GENERATIONConcurrent Unit Cost:1Model Size:1.5BQuant:BF16Context Size:32kTool Calling:SupportedPublished:Mar 31, 2026License:apache-2.0Architecture:Transformer Open Weights Featherless Exclusive Cold

stratosphere/qwen2.5-1.5b-slips-immune-summarization is a 1.5 billion parameter Qwen2.5-based language model fine-tuned by Stratosphere Laboratory, CTU Prague, specifically for translating technical network security events from Slips IDS into clear, human-readable incident summaries with severity assessments. This model excels at generating structured, concise summaries of network intrusion detection system logs, including per-event and overall severity breakdowns, making it ideal for automated security alert triage.

Loading preview...

Model Overview

This model, stratosphere/qwen2.5-1.5b-slips-immune-summarization, is a specialized fine-tuned version of Qwen2.5-1.5B-Instruct. Developed by Stratosphere Laboratory, CTU Prague, its core function is to transform highly technical network security event logs from the Slips IDS into clear, human-readable incident summaries.

Key Capabilities

  • Technical Log Translation: Converts complex Slips IDS DAG-structured alert logs into plain language summaries.
  • Severity Assessment: Provides per-event severity labels (CRITICAL, HIGH, MEDIUM, LOW, INFO) and an overall severity breakdown for incidents.
  • Structured Output: Generates concise, grouped summaries of security events, ideal for quick analysis.
  • Performance: The fine-tuned 1.5B model outperforms both untuned Qwen2.5 1B and 3B baselines in LLM-as-judge evaluations, achieving a 19.1% win rate. It is particularly competitive with larger models like GPT-4o on simpler incidents.

Training and Evaluation

The model was fine-tuned using Supervised Fine-Tuning (SFT) on a dataset of 532 real Slips IDS incidents. Training involved best-of-N response selection, where the highest-scoring response (judged by an LLM) from various models (GPT-4o, GPT-4o-mini, Qwen2.5 3B, Qwen2.5 1B) was used as the target. Evaluation on 47 held-out incidents showed significant improvement over baseline models, though it exhibits a known limitation with very complex incidents (>= 500 events) due to context length constraints.

Good For

  • Automated Security Triage: Streamlining the initial assessment of Slips IDS alerts for security analysts.
  • Incident Summarization: Generating first-pass summaries of network incident logs.
  • Downstream Workflows: Providing structured input for reporting or ticketing systems in cybersecurity operations.

Finetunes
1 models