Command-Line Obfuscation Detection in Real-World Telemetry under Extreme Class Imbalance

Researchers from the University of Alicante and other institutions presented a scalable detection method for command-line obfuscation using a custom-trained small transformer-based model, which outperformed previous approaches on a controlled dataset with extreme class imbalance and demonstrated high precision and computational efficiency on multiple days of real-world telemetry, reducing analyst workload.

Command-Line Obfuscation Detection in Real-World Telemetry under Extreme Class Imbalance https://aclanthology.org/2026.nlpaics-1.8.pdf Vojtěch Outrata /people/vojtech-outrata/unverified/ , Barbora Štěpánková /people/barbora-stepankova-6180/ , Michael Adam Polák /people/michael-adam-polak/unverified/ , Martin Kopp /people/martin-kopp/unverified/ Abstract To avoid detection by endpoint security tools, adversaries employ command-line obfuscation to alter syntax while preserving functionality. This paper proposes a scalable detection method specifically for command-line data, centered on a custom-trained, small transformer-based model optimized for low-latency inference across massive data streams. We demonstrate the method’s efficacy through a two-phase evaluation: first, by benchmarking the model on a controlled dataset simulating realistic command-line telemetry with extreme class imbalance, where it outperforms previous approaches. Second, we evaluate the model against multiple days of high-volume telemetry from diverse real-world environments. Our results show that this approach provides the high precision and computational efficiency required to handle large-scale command-line logs while effectively reducing analyst workload.- Anthology ID: - 2026.nlpaics-1.8 - Volume: Proceedings of the Second International Conference on Natural Language Processing and Artificial Intelligence for Cyber Security /volumes/2026.nlpaics-1/ - Month: - June - Year: - 2026 - Address: - Alicante, Spain - Editors: Ruslan Mitkov /people/ruslan-mitkov/ , Rafael Muñoz /people/rafael-munoz/ , Elena Lloret /people/elena-lloret/unverified/ , Tharindu Ranasinghe /people/tharindu-ranasinghe/ , Ernesto L. Estevanell-Valladares /people/ernesto-luis-estevanell-valladares/ , Salima Lamsiyah /people/salima-lamsiyah/unverified/ , Andrés Montoyo /people/andres-montoyo/ , Saad Ezzini /people/saad-ezzini/ - Venue: NLPAICS /venues/nlpaics/ - SIG: - Publisher: - Department of Languages and Information Systems, University of Alicante - Note: - Pages: - 74–87 - Language: - URL: https://aclanthology.org/2026.nlpaics-1.8/ https://aclanthology.org/2026.nlpaics-1.8/ - DOI: - Cite ACL : - Vojtěch Outrata, Barbora Štěpánková, Michael Adam Polák, and Martin Kopp. 2026. Command-Line Obfuscation Detection in Real-World Telemetry under Extreme Class Imbalance https://aclanthology.org/2026.nlpaics-1.8/ . In Proceedings of the Second International Conference on Natural Language Processing and Artificial Intelligence for Cyber Security , pages 74–87, Alicante, Spain. Department of Languages and Information Systems, University of Alicante. - Cite Informal : Command-Line Obfuscation Detection in Real-World Telemetry under Extreme Class Imbalance https://aclanthology.org/2026.nlpaics-1.8/ Outrata et al., NLPAICS 2026 - PDF: https://aclanthology.org/2026.nlpaics-1.8.pdf https://aclanthology.org/2026.nlpaics-1.8.pdf