TolgaTD/karakam-llama3.1-8b-gguf

KARAKAM AI – LLaMA 3.1 8B (Android Malware Analysis)

KARAKAM AI is a domain-specific large language model fine-tuned for Android malware analysis and threat intelligence reasoning.

The model is designed to behave like a senior Android malware analyst, producing conservative, evidence-based security verdicts.

This repository provides GGUF-quantized weights optimized for local and on-premise inference using Ollama.

---

Base Model

• Meta LLaMA 3.1 8B Instruct
• Original model: meta-llama/Meta-Llama-3.1-8B-Instruct

---

Fine-Tuning Overview

• Fine-tuning method: Supervised Fine-Tuning (SFT)
• Optimization technique: QLoRA
• Framework: Unsloth
• Training hardware: NVIDIA A100 GPU
• Epochs: 4
• Batch size: 32 (with gradient accumulation)
• Learning rate schedule: Cosine decay

The fine-tuning process focuses on context-aware security reasoning instead of signature-based detection.

---

Domain and Task Focus

KARAKAM AI is specialized for:

• Android malware analysis
• Static analysis interpretation
• Threat intelligence correlation
• Evidence-based verdict generation

The model outputs exactly one of the following classifications:

• BENIGN
• SUSPICIOUS
• MALICIOUS

Each verdict is accompanied by concise technical reasoning.

---

Training Data

The training dataset was created specifically for an academic research project.

Dataset characteristics:

• Approximately 1,000 Android APK samples
• Balanced malicious and benign distribution
• Malware samples aligned with MITRE ATT&CK for Mobile
• Inputs derived from:
  • Static analysis reports (permissions, API usage)
  • Network indicators
  • VirusTotal intelligence signals

No raw APK files are included in this repository.

---

Evaluation Summary

The model was evaluated on a held-out test set of 100 Android applications.

• Malicious recall: 0.90
• Competitive precision compared to larger open-source models
• Conservative verdict strategy to minimize false positives
• Optimized for resource-efficient on-premise deployment

---

Quantization

This repository currently provides the following GGUF variant:

• Meta-Llama-3.1-8B-Instruct.Q4_K_M.gguf
  Recommended for most local deployments due to balanced accuracy and memory usage.

---

Usage with Ollama

Step 1: Download the model file

Meta-Llama-3.1-8B-Instruct.Q4_K_M.gguf

---

Step 2: Create a file named Modelfile with the following content

FROM ./Meta-Llama-3.1-8B-Instruct.Q4_K_M.gguf

SYSTEM """ You are KARAKAM AI, a senior Android malware analyst. You analyze Android applications using static analysis signals and produce conservative, evidence-based security verdicts. """

---

Step 3: Build the model

ollama create karakam-ai -f Modelfile

---

Step 4: Run the model

ollama run karakam-ai

---

Intended Use

• Academic research
• Android malware analysis
• Security Operations Center (SOC) decision support
• On-premise, privacy-preserving analysis environments

---

Limitations

• Optimized for static analysis contexts
• May underperform on heavily obfuscated or novel zero-day malware
• Not intended as a standalone antivirus engine

---

Ethical Considerations

This model is intended strictly for defensive cybersecurity purposes. Users are responsible for ensuring compliance with applicable laws and ethical guidelines.

---

License

This model is licensed under the Meta LLaMA 3.1 Community License.

The license of the base model applies to all fine-tuned and quantized derivatives in this repository.

---

Citation

KARAKAM AI – AI-assisted Android Malware Analysis Platform
Undergraduate Graduation Project
Gazi University, Department of Computer Engineering, 2026

---

Author

Tolga Demirel