.

README.md

@@ -1,8 +1,8 @@
 ---
-title: Llm Threat Graph Demo
-emoji: 😻
-colorFrom: yellow
-colorTo: indigo
+title: LLM Threat Association Analysis
+emoji: 🕸️
+colorFrom: red
+colorTo: purple
 sdk: gradio
 sdk_version: 5.32.0
 app_file: app.py
@@ -11,4 +11,74 @@ license: mit
 short_description: Can a security-tuned LLM rival STIX’s expressiveness?
 ---
 
-Check out the configuration reference at https://huggingface.co/docs/hub/spaces-config-reference
+# 🕸️ LLM Threat Association Analysis
+
+*Visualizing Campaign-Actor-Technique relationships using Language Models*
+
+## Features
+
+- **Campaign-Actor Associations**: Probabilistic analysis using softmax normalization
+- **Campaign-Technique Associations**: Independent binary scoring with length normalization
+- **Customizable Prompt Templates**: Edit templates for different analysis scenarios
+- **Interactive Heatmaps**: Matplotlib/Seaborn visualizations
+- **ZeroGPU Support**: Optimized for Hugging Face Spaces GPU infrastructure
+
+## ZeroGPU Configuration
+
+This Space is optimized for ZeroGPU deployment with the following configuration:
+
+### Environment Variables Required
+
+Set these in your Space settings:
+
+**Secret Variables:**
+- `HF_TOKEN`: Your Hugging Face access token
+
+**Regular Variables:**
+- `ZEROGPU_V2=true`: Enables ZeroGPU v2
+- `ZERO_GPU_PATCH_TORCH_DEVICE=1`: Enables device patching for PyTorch
+
+### Technical Specifications
+
+- **GPU Type**: NVIDIA H200 slice
+- **Available VRAM**: 70GB per workload
+- **PyTorch Version**: 2.4.0 (ZeroGPU compatible)
+- **Gradio Version**: 5.29.0
+
+## Usage
+
+1. **Enter Campaigns**: Comma-separated list of threat campaigns
+2. **Configure Prompt Templates**: Customize the language patterns used for analysis
+3. **Select Actors/Techniques**: Enter relevant threat actors and techniques
+4. **Generate Heatmaps**: Click buttons to create visualizations
+
+## Installation
+
+For local development:
+
+```bash
+pip install -r requirements.txt
+python app.py
+```
+
+## Architecture
+
+### Campaign-Actor Analysis
+- Uses `P(actor | "{campaign} is conducted by")` with softmax normalization
+- Results in probability distributions (sum to 1.0 per campaign)
+- Shows relative likelihood of actor attribution
+
+### Campaign-Technique Analysis  
+- Uses binary association scoring with length normalization
+- Independent scores for each campaign-technique pair
+- Accounts for phrase length bias in language models
+
+## Model Support
+
+Currently supports any Hugging Face transformers model. Default model is `sshleifer/tiny-gpt2` for demonstration purposes.
+
+To use a different model, update the `MODEL_NAME` variable in `app.py`.
+
+## References
+
+Based on the ZeroGPU usage guide: https://huggingface.co/spaces/nyasukun/compare-security-models/blob/main/zerogpu.md