license: other
pretty_name: CyberSec Knowledge Corpus
task_categories:

• text-generation
  tags:
• cybersecurity
• penetration-testing
• red-team
• blue-team
• mitre-attack
• capec
• cve
• owasp
• detection-engineering
• exploit
• malware-analysis
• reverse-engineering
  size_categories:
• 100K<n<1M
  configs:
• config_name: default
  data_files:
  • split: train
    path: data/train-*.jsonl

CyberSec Knowledge Corpus

nina from cybersec.org.za, made by the CEO Stephan.

208,513 documents from 56 security sources, 742.5M characters. CVE records
(151,023), nuclei templates (14,112), sigma rules (5,043), awesome-subs (4,987),
seclists (4,464), MITRE ATT&CK (3,987), OWASP guides and cheatsheets, atomic
red-team, LOLBAS/LOLDrivers, cheat sheets, YARA, and more.

This is the knowledge half of the NINA project. The trained students live
separately in cybersec-org-za/nina-specialists
— deliberately not mixed, because one is a corpus you retrain from and the
other is weights you load.

How this corpus is used

It is not baked into model weights. It is indexed into an external context
runtime — a typed memory graph with enforced provenance — and served at
inference time. A query returns a bounded working set (~1,200 tokens) drawn
from 72.8M tokens of indexed history, with every answer carrying the source
spans that grounded it.

The reason is architectural, not operational: a fact that gets corrected should
change what the system serves, not what the weights are. Superseding a CVE
or a detection rule is a normal event, and a model that learned the old one
cannot be corrected without retraining.

Quality control

Documents pass through an anti-cheat gate before they are used for training:
lint suppression, todo!()/NotImplementedError stubs, language mixing under
a declared language, hard-coded secrets, dynamically-constructed evasions and
eval-gaming are all dropped, and the drop counts per class are recorded rather
than discarded silently.

A second gate refuses a degenerate dataset — one whose rows are mostly the
same answer repeated. That gate exists because the offline pipeline once
emitted 3,000 rows over 4 distinct completions, a model memorised them, and a
specialist registered an 84.81% accuracy that measured the template bank rather
than the language. Those checkpoints are published as retired in the
specialists repo rather than deleted.

Known limitations

1. CVE records dominate at 72% of the corpus by document count. Retrieval
   over the whole corpus skews toward them; field-scoped retrieval should be
   used when the question is about a specific area.
2. Document-level, not instruction-level. These are reference documents, not
   prompt/completion pairs. The pipeline converts them to pairs before
   training.
3. Provenance is a filesystem path, not a licence identifier per document.
   Per-source licences are recorded at the corpus level.
4. Retrieval quality degrades with corpus size. At 72.8M indexed tokens the
   extractor was admitting table-of-contents lines as facts. A clause floor has
   been added and tested; the deployed store predates it.

Companion repositories

• cybersec-org-za/nina-specialists
  — 24 geometric-reasoning student checkpoints, 21 candidates and 3 retired
  with reasons, per-checkpoint sha256 verified and a SHA256SUMS file.