Dataset Card for RedSage-CFW-Full (CyberFineWeb Full)

"RedSage: A Cybersecurity Generalist LLM" (ICLR 2026).
Authors: Naufal Suryanto¹, Muzammal Naseer^1†, Pengfei Li¹, Syed Talal Wasim², Jinhui Yi², Juergen Gall², Paolo Ceravolo³, Ernesto Damiani^3
1Khalifa University, ²University of Bonn, ³University of Milan
^†Project Lead


🌐 Project Page  |   🤖 Model Collection  |   📊 Benchmark Collection  |   📘 Data Collection

---

Dataset Summary

RedSage-CFW Full (Non-Dedup) is the complete, raw filtered cybersecurity web corpus extracted from FineWeb across all 103 Common Crawl dumps from CC-MAIN-2013-20 through CC-MAIN-2024-51.

This release contains 122,152,063 raw filtered documents (~267 GB in Parquet format) prior to deduplication. It preserves all historical crawl documents classified as cybersecurity-relevant, enabling researchers to inspect raw document distributions, analyze longitudinal web security trends, or apply custom deduplication (e.g., MinHash, exact match, semantic embeddings) and filtering pipelines.

Note on CFW Versions:

• RedSage-CFW Full (Non-Dedup) [This Dataset]: Complete raw classifier outputs across 103 dumps (122.15M rows, ~267 GB). No deduplication applied.
• RedSage-CFW Full (Dedup): Full corpus after global MinHash-LSH deduplication.
• RedSage-CFW: The curated continual pretraining corpus consisting of the latest 5 chronological chunks with MinHash deduplication and 30% FineWeb-Edu general knowledge replay (~13M documents, ~11.7B tokens).

Supported Tasks

• Continual Domain Pretraining: Adapt foundational LLMs across extensive cybersecurity web corpora.
• Domain Corpus Exploration & Custom Filtering: Access the full historical distribution of cybersecurity text from 2013 to 2024 for custom deduplication, replay strategies, or chronological drift analysis.
• Cybersecurity Text Evolution & Corpus Linguistics: Track the emergence of domain-specific terminology, public security disclosures, and changing community practices across more than ten years of web discourse.

Languages

The dataset consists primarily of English text filtered from the FineWeb Common Crawl archive.

---

Dataset Structure

Data Instances

The dataset is partitioned by Common Crawl dump (103 subsets, ranging from CC-MAIN-2013-20 to CC-MAIN-2024-51). Each row represents an individual document extracted from FineWeb and identified as cybersecurity-relevant by the classifier.

Data Fields

The dataset contains the following 12 fields:

• probability (float64): Confidence score generated by the ModernBERT cybersecurity classifier indicating domain relevance.
• relevant (bool): Binary flag (true/false) indicating whether the document met the cybersecurity relevance threshold.
• text (string): Full extracted text content of the document from FineWeb.
• id (string): Unique Common Crawl URN document identifier (e.g., <urn:uuid:...>).
• dump (string): Source Common Crawl snapshot identifier (e.g., CC-MAIN-2013-20, CC-MAIN-2024-51).
• url (string): Original source URL of the web page.
• date (string): Crawl / publication timestamp string.
• file_path (string): Source file path in the underlying Common Crawl / FineWeb archive.
• language (string): Detected language tag (e.g., en).
• language_score (float64): Confidence score of the language identification model.
• token_count (int64): Number of tokens contained in the document text.
• idx (int64): Index identifier of the record within the split/subset.

Data Splits

The dataset contains 103 subsets (one per Common Crawl dump), each containing a single train split:

• Total Documents: 122,152,063
• Total Disk Size: ~267 GB (Parquet)
• Subsets: 103 dumps (CC-MAIN-2013-20 through CC-MAIN-2024-51)

---

Usage

Loading a Specific Crawl Dump

from datasets import load_dataset

# Load a specific crawl subset (e.g., CC-MAIN-2013-20 or CC-MAIN-2024-51)
ds_dump = load_dataset(
    "RISys-Lab/RedSage-CFW", 
    name="CC-MAIN-2024-51", 
    split="train"
)
print(ds_dump[0])

Streaming the Dataset

Due to the 267 GB footprint, streaming enables immediate document processing without downloading the full archive:

from datasets import load_dataset

dataset = load_dataset(
    "RISys-Lab/RedSage-CFW", 
    name="CC-MAIN-2024-51", 
    split="train", 
    streaming=True
)for sample in dataset:
    print(sample["id"], sample["probability"])
    break

Dataset Creation

Curation Rationale

Transparent, open-source continual pretraining requires domain-specific data at web scale. While the standard RedSage-CFW release focuses on the final pretraining-ready mix, releasing the full 122M-document source corpus allows the research community to inspect raw classifier predictions, study longitudinal cybersecurity trends across a decade of web crawls, and experiment with alternative replay and filtering ratios.

Source Data

• Base Corpus: HuggingFaceFW/fineweb, aggregated across 103 Common Crawl snapshots between Summer 2013 and December 2024 (~17.2T tokens).

Data Processing & Filtering

1. Classifier Training: A binary classifier based on ModernBERT-base was trained on the "Cybersecurity Topic Classification" dataset (sourced from Reddit, StackExchange, and arXiv), achieving 97.3% validation accuracy.
2. Global Filtering: The classifier was executed across all Common Crawl snapshots within FineWeb, identifying 122,152,063 cybersecurity-relevant documents (~89.8B tokens).
3. Relation to RedSage-CFW:

• RedSage-CFW (Full) [This Dataset]: Contains the full set of 122,152,063 classified documents organized by dump.
• RedSage-CFW (Pretraining Subset): Takes the filtered documents, applies MinHash-LSH deduplication via DataTrove (~47.9% token reduction), introduces a 30% FineWeb-Edu general knowledge replay ratio, and selects the latest 5 chronological chunks (~13M documents, ~11.7B tokens) to train the RedSage LLM.

Considerations for Using the Data

Social Impact

This dataset supports public research into domain-specific LLM pretraining, local and privacy-preserving cybersecurity assistants, and automated threat analysis, directly helping alleviate the global cybersecurity skills shortage.

Discussion of Biases and Limitations

• Source Biases: Inherits biases, non-standard forum syntax, and noise present in Common Crawl web data.
• Dual-Use Risk: Web-crawled cybersecurity content inherently includes public exploits, vulnerability analyses, proof-of-concept code, and offensive security tutorials. Models trained on this corpus should implement appropriate safety alignments for defensive deployment.

@inproceedings{suryanto2026redsage,
  title={RedSage: A Cybersecurity Generalist {LLM}},
  author={Naufal Suryanto and Muzammal Naseer and Pengfei Li and Syed Talal Wasim and Jinhui Yi and Juergen Gall and Paolo Ceravolo and Ernesto Damiani},
  booktitle={The Fourteenth International Conference on Learning Representations},
  year={2026},
  url={[https://openreview.net/forum?id=W4FAenIrQ2](https://openreview.net/forum?id=W4FAenIrQ2)}
}