{"slug": "command-line-obfuscation-detection-in-real-world-telemetry-under-extreme-class", "title": "Command-Line Obfuscation Detection in Real-World Telemetry under Extreme Class Imbalance", "summary": "Researchers from the University of Alicante and other institutions presented a scalable detection method for command-line obfuscation using a custom-trained small transformer-based model, which outperformed previous approaches on a controlled dataset with extreme class imbalance and demonstrated high precision and computational efficiency on multiple days of real-world telemetry, reducing analyst workload.", "body_md": "[Command-Line Obfuscation Detection in Real-World Telemetry under Extreme Class Imbalance](https://aclanthology.org/2026.nlpaics-1.8.pdf)\n\n[Vojtěch Outrata](/people/vojtech-outrata/unverified/),\n[Barbora Štěpánková](/people/barbora-stepankova-6180/),\n[Michael Adam Polák](/people/michael-adam-polak/unverified/),\n[Martin Kopp](/people/martin-kopp/unverified/)\n\n##### Abstract\n\nTo avoid detection by endpoint security tools, adversaries employ command-line obfuscation to alter syntax while preserving functionality. This paper proposes a scalable detection method specifically for command-line data, centered on a custom-trained, small transformer-based model optimized for low-latency inference across massive data streams. We demonstrate the method’s efficacy through a two-phase evaluation: first, by benchmarking the model on a controlled dataset simulating realistic command-line telemetry with extreme class imbalance, where it outperforms previous approaches. Second, we evaluate the model against multiple days of high-volume telemetry from diverse real-world environments. Our results show that this approach provides the high precision and computational efficiency required to handle large-scale command-line logs while effectively reducing analyst workload.- Anthology ID:\n- 2026.nlpaics-1.8\n- Volume:\n[Proceedings of the Second International Conference on Natural Language Processing and Artificial Intelligence for Cyber Security](/volumes/2026.nlpaics-1/)- Month:\n- June\n- Year:\n- 2026\n- Address:\n- Alicante, Spain\n- Editors:\n[Ruslan Mitkov](/people/ruslan-mitkov/),[Rafael Muñoz](/people/rafael-munoz/),[Elena Lloret](/people/elena-lloret/unverified/),[Tharindu Ranasinghe](/people/tharindu-ranasinghe/),[Ernesto L. Estevanell-Valladares](/people/ernesto-luis-estevanell-valladares/),[Salima Lamsiyah](/people/salima-lamsiyah/unverified/),[Andrés Montoyo](/people/andres-montoyo/),[Saad Ezzini](/people/saad-ezzini/)- Venue:\n[NLPAICS](/venues/nlpaics/)- SIG:\n- Publisher:\n- Department of Languages and Information Systems, University of Alicante\n- Note:\n- Pages:\n- 74–87\n- Language:\n- URL:\n[https://aclanthology.org/2026.nlpaics-1.8/](https://aclanthology.org/2026.nlpaics-1.8/)- DOI:\n- Cite (ACL):\n- Vojtěch Outrata, Barbora Štěpánková, Michael Adam Polák, and Martin Kopp. 2026.\n[Command-Line Obfuscation Detection in Real-World Telemetry under Extreme Class Imbalance](https://aclanthology.org/2026.nlpaics-1.8/). In*Proceedings of the Second International Conference on Natural Language Processing and Artificial Intelligence for Cyber Security*, pages 74–87, Alicante, Spain. Department of Languages and Information Systems, University of Alicante. - Cite (Informal):\n[Command-Line Obfuscation Detection in Real-World Telemetry under Extreme Class Imbalance](https://aclanthology.org/2026.nlpaics-1.8/)(Outrata et al., NLPAICS 2026)- PDF:\n[https://aclanthology.org/2026.nlpaics-1.8.pdf](https://aclanthology.org/2026.nlpaics-1.8.pdf)", "url": "https://wpnews.pro/news/command-line-obfuscation-detection-in-real-world-telemetry-under-extreme-class", "canonical_source": "https://aclanthology.org/2026.nlpaics-1.8/", "published_at": "2026-07-31 00:00:00+00:00", "updated_at": "2026-08-10 23:49:05.415687+00:00", "lang": "en", "topics": ["machine-learning", "large-language-models", "ai-research", "ai-products"], "entities": ["University of Alicante", "Vojtěch Outrata", "Barbora Štěpánková", "Michael Adam Polák", "Martin Kopp", "NLPAICS"], "alternates": {"html": "https://wpnews.pro/news/command-line-obfuscation-detection-in-real-world-telemetry-under-extreme-class", "markdown": "https://wpnews.pro/news/command-line-obfuscation-detection-in-real-world-telemetry-under-extreme-class.md", "text": "https://wpnews.pro/news/command-line-obfuscation-detection-in-real-world-telemetry-under-extreme-class.txt", "jsonld": "https://wpnews.pro/news/command-line-obfuscation-detection-in-real-world-telemetry-under-extreme-class.jsonld"}}