scanx-cve-llm

OWASP Top 10 Vulnerability Detection LLM built on the Ornith model and hosted on Ollama.

Overview

scanx-cve-llm is a specialized LLM for detecting security vulnerabilities in code, trained to identify all OWASP Top 10 (2021) categories:

Usage

Running with Ollama

# Start Ollama and run the model
ollama run scanx-cve-llm

Example Analysis

Analyze this code:
db.execute(f"DELETE FROM users WHERE id = {user_id}")

Output:

VULNERABLE - A03:2021 Injection - SQL injection via f-string interpolation
of `user_id` directly into the SQL query.

Project Structure

scanx-cve-llm/
├── dataset/
│   ├── generate_data.py      # Dataset generation script
│   ├── owasp_train.jsonl     # Training data (45 samples)
│   └── owasp_test.jsonl     # Test data (5 samples)
├── training/
│   ├── config.yaml           # Axolotl training config
│   └── train.py              # Training script
├── models/                   # Model output directory
├── modelfile                # Ollama modelfile
└── README.md

Dataset

The dataset contains code examples for: - Vulnerable code - Each OWASP category with common vulnerability patterns - Safe code - Secure implementations following best practices

Generating Dataset

cd scanx-cve-llm/dataset
uv run python generate_data.py

Training

The project includes a training pipeline using LoRA with Axolotl. For full fine-tuning:

cd scanx-cve-llm/training
uv run python train.py

Note: Full training requires GPU. On CPU-only systems, the model uses prompt engineering for vulnerability detection.

Model Details

• Base Model: Ornith (scanx:latest) - 5.6GB
• Framework: Ollama
• Parameters: ~9B
• Context Window: 8192 tokens

Testing

Run the built-in test:

echo 'Analyze this code:
db.execute(f"SELECT * FROM users WHERE id = {user_id}")' | ollama run scanx-cve-llm

Current Status

✅ Model is operational and detecting vulnerabilities across OWASP Top 10 categories.

For full fine-tuning with custom dataset, you’ll need a GPU with sufficient VRAM.