Command-Line Obfuscation Detection in Real-World Telemetry under Extreme Class Imbalance

[Command-Line Obfuscation Detection in Real-World Telemetry under Extreme Class Imbalance](https://aclanthology.org/2026.nlpaics-1.8.pdf)

[Vojtěch Outrata](/people/vojtech-outrata/unverified/),
[Barbora Štěpánková](/people/barbora-stepankova-6180/),
[Michael Adam Polák](/people/michael-adam-polak/unverified/),
[Martin Kopp](/people/martin-kopp/unverified/)

Abstract

To avoid detection by endpoint security tools, adversaries employ command-line obfuscation to alter syntax while preserving functionality. This paper proposes a scalable detection method specifically for command-line data, centered on a custom-trained, small transformer-based model optimized for low-latency inference across massive data streams. We demonstrate the method’s efficacy through a two-phase evaluation: first, by benchmarking the model on a controlled dataset simulating realistic command-line telemetry with extreme class imbalance, where it outperforms previous approaches. Second, we evaluate the model against multiple days of high-volume telemetry from diverse real-world environments. Our results show that this approach provides the high precision and computational efficiency required to handle large-scale command-line logs while effectively reducing analyst workload.- Anthology ID:

- 2026.nlpaics-1.8
- Volume:

Proceedings of the Second International Conference on Natural Language Processing and Artificial Intelligence for Cyber Security- Month:

• June
• Year:
• 2026
• Address:
• Alicante, Spain
• Editors: Ruslan Mitkov,Rafael Muñoz,Elena Lloret,Tharindu Ranasinghe,Ernesto L. Estevanell-Valladares,Salima Lamsiyah,Andrés Montoyo,Saad Ezzini- Venue:

[NLPAICS](/venues/nlpaics/)- SIG:
- Publisher:

• Department of Languages and Information Systems, University of Alicante

- Note:
- Pages:

• 74–87

- Language:
- URL:
[https://aclanthology.org/2026.nlpaics-1.8/](https://aclanthology.org/2026.nlpaics-1.8/)- DOI:
- Cite (ACL):

• Vojtěch Outrata, Barbora Štěpánková, Michael Adam Polák, and Martin Kopp. 2026. Command-Line Obfuscation Detection in Real-World Telemetry under Extreme Class Imbalance. InProceedings of the Second International Conference on Natural Language Processing and Artificial Intelligence for Cyber Security, pages 74–87, Alicante, Spain. Department of Languages and Information Systems, University of Alicante. - Cite (Informal):

[Command-Line Obfuscation Detection in Real-World Telemetry under Extreme Class Imbalance](https://aclanthology.org/2026.nlpaics-1.8/)(Outrata et al., NLPAICS 2026)- PDF:
[https://aclanthology.org/2026.nlpaics-1.8.pdf](https://aclanthology.org/2026.nlpaics-1.8.pdf)