Skip to content

Commit 9cf2f8e

Browse files
doc: Improve main documentation
Add configuration section, CNVD dataset/trainer details (CVE cross-refs, deduplicated split, --class-weights flag), CNVD validator usage, and links to dataset card and improvements report. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
1 parent a4697aa commit 9cf2f8e

1 file changed

Lines changed: 29 additions & 8 deletions

File tree

docs/index.md

Lines changed: 29 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -6,9 +6,10 @@
66

77
## Presentation
88

9-
VulnTrain provides a set of tools to generate diverse AI-ready datasets and train models using comprehensive vulnerability data from Vulnerability-Lookup.
10-
It leverages over one million JSON records from multiple advisory sources to build high-quality, domain-specific models.
9+
VulnTrain provides a set of tools to generate diverse AI-ready datasets and train models using comprehensive vulnerability data from [Vulnerability-Lookup](https://vulnerability.circl.lu).
10+
It leverages over one million JSON records from multiple advisory sources (CVE, GitHub advisories, CSAF, PySecDB, CNVD) to build severity classifiers, description generators, and CWE classifiers.
1111

12+
Models and datasets are published to Hugging Face Hub under the [CIRCL](https://huggingface.co/CIRCL) organization.
1213

1314
## Installation
1415

@@ -20,18 +21,21 @@ poetry install
2021

2122
Three types of commands are available:
2223

23-
- **Dataset generation**: Create and prepare datasets.
24+
- **Dataset generation**: Create and prepare datasets from vulnerability sources.
2425
- **Model training**: Train models using the prepared datasets.
25-
- **Model validation**: Evaluate the performance of trained models.
26+
- **Model validation**: Evaluate and compare trained models.
2627

2728
For AMD Ryzen GPU:
2829

2930
```bash
3031
pip3 install --pre torch torchvision torchaudio --index-url https://download.pytorch.org/whl/nightly/rocm6.4/
3132
```
3233

33-
## Datasets
34+
## Configuration
35+
36+
Copy `vulntrain/config/conf_sample.py` to `vulntrain/config/conf.py` and fill in the Valkey connection details and tokens. Set the `VulnTrain_CONFIG` environment variable to point to your config file.
3437

38+
## Datasets
3539

3640
Ensure that the ``huggingface_hub`` package is installed:
3741

@@ -45,23 +49,26 @@ Then log in to Hugging Face:
4549
hf auth login
4650
```
4751

48-
Then ensure that the kvrocks database of Vulnerability-Lookup is running.
52+
Then ensure that the Valkey database of Vulnerability-Lookup is running.
4953

5054

51-
### Vulnerabililty severity scores
55+
### Vulnerability severity scores
5256

5357
Example: Generate [CIRCL/vulnerability-scores](https://huggingface.co/datasets/CIRCL/vulnerability-scores) dataset
5458

5559
```bash
5660
vulntrain-dataset-generation --sources cvelistv5,github,csaf_redhat,csaf_cisco,csaf_cisa,pysec --repo-id=CIRCL/vulnerability-scores
5761
```
5862

59-
Example: Generate [CIRCL/Vulnerability/CNVD](https://huggingface.co/datasets/CIRCL/Vulnerability-CNVD) dataset
63+
Example: Generate [CIRCL/Vulnerability-CNVD](https://huggingface.co/datasets/CIRCL/Vulnerability-CNVD) dataset
6064

6165
```bash
6266
vulntrain-dataset-generation --sources cnvd --repo-id=CIRCL/Vulnerability-CNVD
6367
```
6468

69+
The CNVD dataset includes a `cve_id` field cross-referencing CVE equivalents (~81% of entries).
70+
See the [dataset card](https://huggingface.co/datasets/CIRCL/Vulnerability-CNVD) for details on coverage, severity distribution, and known caveats.
71+
6572

6673
### Associating Git Fixes with Common Weakness Enumerations (CWEs)
6774

@@ -87,6 +94,8 @@ Generate the model [CIRCL/vulnerability-severity-classification-chinese-macbert-
8794
vulntrain-train-severity-cnvd-classification --base-model hfl/chinese-macbert-base --dataset-id CIRCL/Vulnerability-CNVD --repo-id CIRCL/vulnerability-severity-classification-chinese-macbert-base
8895
```
8996

97+
The CNVD trainer uses a deduplicated train/test split to prevent data leakage and supports different loss strategies via `--class-weights` (`none`, `sqrt`, `balanced`, `focal`). Defaults to uniform loss. See the [improvements report](cnvd-severity-improvements.md) for details.
98+
9099
### Training for CWE classification
91100

92101
```bash
@@ -131,6 +140,18 @@ Using CUDA (Nvidia GPU).
131140
132141
## Validation
133142
143+
### Severity model comparison (CNVD)
144+
145+
Compare old and new CNVD severity models on a deduplicated test set:
146+
147+
```bash
148+
python -m vulntrain.validators.severity_cnvd \
149+
--old-model CIRCL/vulnerability-severity-classification-chinese-macbert-base \
150+
--new-model CIRCL/vulnerability-severity-classification-chinese-macbert-base-test
151+
```
152+
153+
### Text generation
154+
134155
It is possible to send prompts to a model trained for text generation (descriptions of vulnerabilities).
135156
136157
```bash

0 commit comments

Comments
 (0)