# Command-Line Obfuscation Detection in Real-World Telemetry under Extreme Class Imbalance

> Source: <https://aclanthology.org/2026.nlpaics-1.8/>
> Published: 2026-07-31 00:00:00+00:00

[Command-Line Obfuscation Detection in Real-World Telemetry under Extreme Class Imbalance](https://aclanthology.org/2026.nlpaics-1.8.pdf)

[Vojtěch Outrata](/people/vojtech-outrata/unverified/),
[Barbora Štěpánková](/people/barbora-stepankova-6180/),
[Michael Adam Polák](/people/michael-adam-polak/unverified/),
[Martin Kopp](/people/martin-kopp/unverified/)

##### Abstract

To avoid detection by endpoint security tools, adversaries employ command-line obfuscation to alter syntax while preserving functionality. This paper proposes a scalable detection method specifically for command-line data, centered on a custom-trained, small transformer-based model optimized for low-latency inference across massive data streams. We demonstrate the method’s efficacy through a two-phase evaluation: first, by benchmarking the model on a controlled dataset simulating realistic command-line telemetry with extreme class imbalance, where it outperforms previous approaches. Second, we evaluate the model against multiple days of high-volume telemetry from diverse real-world environments. Our results show that this approach provides the high precision and computational efficiency required to handle large-scale command-line logs while effectively reducing analyst workload.- Anthology ID:
- 2026.nlpaics-1.8
- Volume:
[Proceedings of the Second International Conference on Natural Language Processing and Artificial Intelligence for Cyber Security](/volumes/2026.nlpaics-1/)- Month:
- June
- Year:
- 2026
- Address:
- Alicante, Spain
- Editors:
[Ruslan Mitkov](/people/ruslan-mitkov/),[Rafael Muñoz](/people/rafael-munoz/),[Elena Lloret](/people/elena-lloret/unverified/),[Tharindu Ranasinghe](/people/tharindu-ranasinghe/),[Ernesto L. Estevanell-Valladares](/people/ernesto-luis-estevanell-valladares/),[Salima Lamsiyah](/people/salima-lamsiyah/unverified/),[Andrés Montoyo](/people/andres-montoyo/),[Saad Ezzini](/people/saad-ezzini/)- Venue:
[NLPAICS](/venues/nlpaics/)- SIG:
- Publisher:
- Department of Languages and Information Systems, University of Alicante
- Note:
- Pages:
- 74–87
- Language:
- URL:
[https://aclanthology.org/2026.nlpaics-1.8/](https://aclanthology.org/2026.nlpaics-1.8/)- DOI:
- Cite (ACL):
- Vojtěch Outrata, Barbora Štěpánková, Michael Adam Polák, and Martin Kopp. 2026.
[Command-Line Obfuscation Detection in Real-World Telemetry under Extreme Class Imbalance](https://aclanthology.org/2026.nlpaics-1.8/). In*Proceedings of the Second International Conference on Natural Language Processing and Artificial Intelligence for Cyber Security*, pages 74–87, Alicante, Spain. Department of Languages and Information Systems, University of Alicante. - Cite (Informal):
[Command-Line Obfuscation Detection in Real-World Telemetry under Extreme Class Imbalance](https://aclanthology.org/2026.nlpaics-1.8/)(Outrata et al., NLPAICS 2026)- PDF:
[https://aclanthology.org/2026.nlpaics-1.8.pdf](https://aclanthology.org/2026.nlpaics-1.8.pdf)