netgoat-ai/koda-ids-frontier

Koda IDS Frontier

Koda IDS Frontier is a lightweight cybersecurity incident detection and reasoning model based on Liquid AI's LFM2.5-2.6B.

It specializes in defensive security analysis: interpreting telemetry, correlating evidence, identifying plausible explanations, communicating uncertainty, and recommending proportionate defensive investigation.

Koda IDS Frontier is based on and fine-tuned from Liquid AI LFM2.5-2.6B.

Status: Frontier research model Base model: LFM2.5-2.6B Model size: ~2.6B parameters License: Apache-2.0

Model Lineage

Liquid AI LFM2.5-2.6B
        │
        │ Fine-tuning / specialization
        ▼
   Koda IDS Frontier
        │
        ├── F16 GGUF
        │
        └── Q4_K_M GGUF

Koda IDS Frontier does not train a language model from scratch. It builds upon the capabilities of LFM2.5-2.6B and specializes them for defensive cybersecurity analysis.

Available Files

This repository currently provides two GGUF variants:

File	Format	Approx. size	Intended use
koda-ids-f16.gguf	F16 GGUF	~5.0 GB	Highest-fidelity local inference
koda-ids-Q4_K_M.gguf	Q4_K_M GGUF	~1.7 GB	Lightweight local inference

Only these two variants are currently published.

The Q4_K_M version is intended for systems with limited RAM/VRAM while retaining practical model quality. The F16 version is provided when memory availability is less constrained and maximum numerical fidelity is preferred.

What Koda IDS Is For

Koda IDS is focused on defensive cybersecurity reasoning, including:

• Security telemetry interpretation
• Incident triage
• Network and DNS anomalies
• Authentication and identity events
• Process and host telemetry
• Cloud and infrastructure events
• CI/CD and service activity
• Distinguishing suspicious behavior from legitimate operational activity
• Evidence-based hypothesis generation
• Identifying missing information
• Investigation planning
• Defensive response recommendations

Koda is specifically trained to avoid treating every anomaly as malicious.

A security-relevant event may have multiple explanations, including:

• legitimate administrative activity
• scheduled jobs
• deployments
• monitoring
• backups
• internal testing
• software failures
• configuration changes
• genuinely suspicious activity

The model should therefore distinguish observed evidence from inference and hypothesis.

Reasoning Principles

Evidence first

The model should only make claims supported by the provided evidence.

Explicit uncertainty

When the evidence is insufficient, Koda should say what is unknown rather than inventing an answer.

Multiple hypotheses

Suspicious telemetry should not automatically be classified as malicious.

Tool honesty

Koda should not claim to have executed a command, queried a tool, accessed a system, or obtained a result unless that information is actually provided.

Proportionate response

Recommended defensive actions should correspond to the available evidence and severity.

Defensive use

Koda is intended for security monitoring, incident analysis, investigation support, and defensive response.

Model Behavior

A typical response may reason through:

Observed evidence
        ↓
Known facts
        ↓
Possible explanations
        ↓
Missing evidence
        ↓
Investigation priorities
        ↓
Severity / confidence
        ↓
Defensive action

For example, unusually high DNS traffic should not automatically be labeled as DNS abuse. Koda should consider the surrounding context, such as deployments, scheduled jobs, internal audits, or other legitimate causes.

Usage with llama.cpp

The GGUF files can be used with llama.cpp-compatible runtimes.

Example:

llama-cli \
  -m koda-ids-Q4_K_M.gguf \
  -c 8192 \
  -n 1024

For the F16 model:

llama-cli \
  -m koda-ids-f16.gguf \
  -c 8192 \
  -n 1024

Exact runtime parameters may vary depending on your hardware and application.

Ollama

An Ollama-compatible configuration can use the published Q4_K_M model:

FROM ./koda-ids-Q4_K_M.gguf
PARAMETER temperature 0.1
PARAMETER top_k 50
PARAMETER top_p 0.7
PARAMETER repeat_penalty 1.1
PARAMETER num_ctx 8192
PARAMETER stop "<|im_end|>"
PARAMETER stop "<|im_start|>user"
PARAMETER stop "<|im_start|>system"
PARAMETER stop "<|im_start|>assistant"
PARAMETER stop "<|endoftext|>"

The model uses the LFM2 chat format.

Recommended Prompt Structure

For best results, provide concrete telemetry and clearly distinguish known information from assumptions.

Analyze the following security event.
Known evidence:
- ...
- ...
- ...
Context:
- ...
Unknown:
- ...
Determine:
1. What is directly observed?
2. What explanations are plausible?
3. What evidence is missing?
4. What should be investigated next?
5. What severity and confidence are justified?

Avoid supplying fabricated tool results or asking the model to assume that an investigation has already been performed.

Output Philosophy

Koda should prioritize:

Evidence > speculation
Calibration > false certainty
Investigation > premature conclusion
Defensive action > offensive action

A good answer may conclude that the available evidence is insufficient to determine whether an event is malicious.

That is an intentional behavior.

Model Limitations

Koda IDS Frontier is a research model and can still:

• Misinterpret ambiguous telemetry
• Miss important context
• Produce incorrect hypotheses
• Miscalibrate severity or confidence
• Make reasoning errors
• Require additional evidence before reaching a reliable conclusion

Do not treat model output as authoritative security evidence.

Validate important findings against the underlying telemetry and appropriate security tooling.

The model should also not be treated as having access to tools, systems, logs, networks, or threat intelligence unless those results are explicitly provided to it.

Quantization

Currently published:

F16

koda-ids-f16.gguf

Use this when you have sufficient memory and want the closest GGUF representation to the trained model.

Q4_K_M

koda-ids-Q4_K_M.gguf

Use this for significantly lower memory requirements and faster local inference.

Additional quantizations may be published in the future.

Architecture

Koda IDS Frontier is based on:

Liquid AI LFM2.5-2.6B
        ↓
Cybersecurity specialization
        ↓
SFT
        ↓
Reasoning / alignment optimization
        ↓
Koda IDS Frontier
        ↓
GGUF

The model is intended to remain lightweight enough for local deployment while providing specialized cybersecurity analysis capabilities.

Intended Use

Koda IDS Frontier is intended for:

• Security research
• Defensive incident analysis
• SOC experimentation
• Security telemetry analysis
• Local security assistants
• Incident triage
• Cybersecurity education and research
• Open-source defensive security tooling

Not Intended For

Koda IDS Frontier should not be treated as:

• An autonomous security authority
• A replacement for security professionals
• A source of guaranteed threat attribution
• A substitute for telemetry or forensic evidence
• A system that has access to infrastructure unless explicitly integrated with it

About NetGoat OSS

Koda IDS is part of the NetGoat OSS ecosystem, an open-source project focused on independent, self-hostable web and infrastructure security.

Koda IDS is intended to provide lightweight AI-assisted defensive analysis that can operate alongside locally controlled security infrastructure.

Model Card

Model: Koda IDS Frontier Base model: Liquid AI LFM2.5-2.6B Model lineage: Fine-tuned derivative of LFM2.5-2.6B Parameter count: ~2.6B Formats: GGUF Published variants: F16, Q4_K_M Primary language: English Domain: Defensive cybersecurity License: Apache-2.0 Status: Research / Frontier release

Disclaimer

Koda IDS Frontier is provided for research and defensive security purposes.

Security decisions should be based on verified evidence and appropriate operational controls. Model outputs may be incorrect and should be independently validated before taking consequential actions.