Decision-Theoretic Incident Response Planning with a Lightweight Large Language Model

A decision-support system powered by a foundation model for recovering from cyberattacks in networked systems.

Requirements

• Python 3.8+
• torch
• torchvision
• numpy
• transformers
• peft
• bitsandbytes
• accelerate
• hf-transfer

Development Requirements

• Python 3.8+
• flake8 (for linting)
• flake8-rst-docstrings (for linting docstrings)
• tox (for automated testing)
• pytest (for unit tests)
• pytest-cov (for unit test coverage)
• mypy (for static typing)
• mypy-extensions (for static typing)
• mypy-protobuf (for static typing)
• types-PyYaml (for static typing)
• types-paramiko (for static typing)
• types-protobuf (for static typing)
• types-requests (for static typing)
• types-urllib3 (for static typing)
• sphinx (for API documentation)
• sphinxcontrib-napoleon (for API documentation)
• sphinx-rtd-theme (for API documentation)
• pytest-mock (for mocking tests)
• pytest-grpc (for grpc tests)

Installation

# install from pip
pip install llm_recovery==<version>
# local install from source
$ pip install -e llm_recovery
# or (equivalently):
make install
# force upgrade deps
$ pip install -e llm_recovery --upgrade
# git clone and install from source
git clone https://github.com/Limmen/llm_recovery
cd llm_recovery
pip3 install -e .
# Install development dependencies
$ pip install -r requirements_dev.txt

Development tools

Install all development tools at once:

make install_dev

or

pip install -r requirements_dev.txt

Static code analysis

To run the Python linter, execute the following command:

flake8 .
# or (equivalently):
make lint

To run the mypy type checker, execute the following command:

mypy .
# or (equivalently):
make types

Unit tests

To run all the unit tests, execute the following command:

pytest
# or (equivalently):
make unit_tests

To run tests of a specific test suite, execute the following command:

pytest -k "ClassName"

To generate a coverage report, execute the following command:

pytest --cov=llm_recovery

Run tests and code analysis in different python environments

To run tests and code analysis in different python environments, execute the following command:

tox
# or (equivalently):
make tests

Create a new release and publish to PyPi

First build the package by executing:

python -m build
# or (equivalently)
make build

After running the command above, the built package is available at ./dist.

Push the built package to PyPi by running:

python -m twine upload dist/*
# or (equivalently)
make push

To run all commands for the release at once, execute:

make release

Author & Maintainer

Kim Hammar kimham@kth.se

Copyright and license

LICENSE

Creative Commons

(C) 2025, Kim Hammar