--- title: "Command-Line Obfuscation Detection in Real-World Telemetry" description: "The authors, from Cisco, build a detector for such obfuscated command-lines that can run on real… 5 references, cited by 1 paper here." authors: ["Vojtěch Outrata", "Barbora Štěpánková", "Michael Adam Polák", "Martin Kopp"] year: 2026 venue: "Proceedings of the Second International Conference on Natural Language Processing and Artificial Intelligence for Cyber Security" source: "https://aclanthology.org/2026.nlpaics-1.8/" licence: "CC BY 4.0 (ACL Anthology)" licence_url: "https://creativecommons.org/licenses/by/4.0/" summary_licence: "Elamur Cosmic License" canonical: "https://research.elamur.ai/free/en/papers/outrata-2026-command-line-obfuscation-detection-real/" --- [Elamur Research](https://md.research.elamur.ai/free/en/) · [this page in HTML](https://research.elamur.ai/free/en/papers/outrata-2026-command-line-obfuscation-detection-real/) [home](https://md.research.elamur.ai/free/en/) / [papers](https://md.research.elamur.ai/free/en/papers/) / [2026](https://md.research.elamur.ai/free/en/papers/2026/page/11/) / Command-Line Obfuscation Detection in Real-World Telemetry under Extreme Class Imbalance # Command-Line Obfuscation Detection in Real-World Telemetry under Extreme Class Imbalance **Authors:** [Vojtěch Outrata](https://md.research.elamur.ai/free/en/authors/vojtech-outrata/), [Barbora Štěpánková](https://md.research.elamur.ai/free/en/authors/barbora-stepankova/), Michael Adam Polák and [Martin Kopp](https://md.research.elamur.ai/free/en/authors/martin-kopp/) · **Year:** 2026 · **Venue:** [Proceedings of the Second International Conference on Natural Language Processing and Artificial Intelligence for Cyber Security](https://md.research.elamur.ai/free/en/venues/nlpaics/) ([International Conference on Natural Language Processing and Artificial Intelligence for Cyber Security 2026](https://md.research.elamur.ai/free/en/venues/nlpaics/2026/)) · **Publisher:** [Department of Languages and Information Systems, University of Alicante](https://md.research.elamur.ai/free/en/publishers/department-of-languages-and-information-systems-university-of-alicante/) · **Licence:** [CC BY 4.0 (ACL Anthology)](https://creativecommons.org/licenses/by/4.0/) **Links:** [Publisher's page](https://aclanthology.org/2026.nlpaics-1.8/) · [PDF](https://aclanthology.org/2026.nlpaics-1.8.pdf) **Citations:** [1](https://md.research.elamur.ai/free/en/papers/outrata-2026-command-line-obfuscation-detection-real/cited-by/) in our library, of the 149,439 papers whose bibliographies we read ## Summary Attackers often abuse built-in Windows utilities (LOLBins) and disguise their commands by rewriting the syntax while keeping the behavior. Tricks include random casing, caret insertion, and string reassembly, and they defeat hash and signature matching. The authors, from Cisco, build a detector for such obfuscated command-lines that can run on real endpoint telemetry. Two constraints shape the design: obfuscated entries there are extremely rare, and daily log volumes are huge. They train a small transformer (an ELECTRA-based model) from scratch, paired with a WordPiece tokenizer fitted to command-line logs. Training uses real benign traffic, roughly 1,500 obfuscated samples confirmed by threat hunters, and synthetic positives generated with public obfuscation tools. Earlier methods were mostly tested on balanced data. Here, evaluation subsets are resampled to progressively harsher class ratios, and the model beats existing approaches, especially at extreme imbalance. A second test covers 24 million real command-lines, with flagged items reviewed by hand. The model keeps precision high, runs on a single GPU, and finds previously unseen malicious variants. This makes it useful for cutting analyst workload at scale. ## Key points - **Telemetry:** about 350 million unique execution logs from around 1,000 private networks over 20 days. They cover PowerShell, cmd, msiexec, rundll and explorer. The estimated rate of real obfuscation is below 1 in 100k. - **Training and evaluation sets:** both use a 1:10 positive-to-negative ratio. - Training: 405k negatives, 1.1k real obfuscated samples and 39.4k artificial ones. - Evaluation: 129k negatives, 387 real and 12.5k artificial positives. - Synthetic positives come from Invoke-Obfuscation and Invoke-DOSfuscation. - **Tokenizer:** a custom WordPiece tokenizer (Huggingface Tokenizers) trained on 300M logs, with a 20k vocabulary chosen. A 10k-vocabulary version already yields about 11% fewer tokens than the 32k bert-base-cased tokenizer. - **Real-world deployment:** detections were manually labeled to measure precision. The model caught Raspberry Robin-style commands that published signatures would miss. - **Limitations and code:** stated limitations are reliance on tool-generated samples, untested adversarial robustness, and Windows-only scope. Code is released on GitHub, but the data and tokenizer stay private. *Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.* 📚 Shelves (2): [🖥️ Computer Science](https://md.research.elamur.ai/free/en/shelves/computer-science/) · 18,614 works · [🤖 Artificial Intelligence](https://md.research.elamur.ai/free/en/shelves/computer-science/artificial-intelligence/) · 17,965 works ## Cite Cite as: Vojtěch Outrata, Barbora Štěpánková, Michael Adam Polák and Martin Kopp. 2026. Command-Line Obfuscation Detection in Real-World Telemetry under Extreme Class Imbalance. Proceedings of the Second International Conference on Natural Language Processing and Artificial Intelligence for Cyber Security. The paper itself, not this page. BibTeX from the library's record of the work. ```bibtex @inproceedings{outrata2026command, title = {{Command-Line Obfuscation Detection in Real-World Telemetry under Extreme Class Imbalance}}, author = {Vojtěch Outrata, Barbora Štěpánková, Michael Adam Polák and Martin Kopp}, booktitle = {Proceedings of the Second International Conference on Natural Language Processing and Artificial Intelligence for Cyber Security}, year = {2026}, url = {https://aclanthology.org/2026.nlpaics-1.8/} } ``` - [← previous Comhis at SemEval-2026 Task 4: Embedding-Space Adaptation and LLM-Assisted Inference for Narrative Similarity](https://md.research.elamur.ai/free/en/papers/shu-2026-comhis-semeval-2026-task-4/) - [next → Common European Language Data Space: Development, Current Status, and Future Perspectives](https://md.research.elamur.ai/free/en/papers/piperidis-2026-common-european-language-data-space/) - [↑ back to papers of 2026](https://md.research.elamur.ai/free/en/papers/2026/page/11/) ## References 5 references, 1 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet. 1. Adobe. 2025. Command obfuscation detection. [Online]. Available: [https://github.com/adobe/](https://github.com/adobe/) obfuscation-detection. Accessed August 6, 2025. [↗](https://github.com/adobe/) 2. Radovan Haluška, Jan Brabec, and Tomáš Komárek. 2022. Benchmark of data preprocessing methods for imbalanced classification. In 2022 IEEE International Conference on Big Data (Big Data), pages 2970–2979. IEEE. [find](https://scholar.google.com/scholar?q=Radovan+Halu%C5%A1ka%2C+Jan+Brabec%2C+and+Tom%C3%A1%C5%A1+Kom%C3%A1rek%2E+2022%2E+Benchmark+of+data+preprocessing+methods+for+imbalanced+classification%2E+In+2022+IEEE+International+Conference+on+Big+Data+%28Big+Data%29%2C+pages+2970%E2%80%9329) 3. Ben Athiwaratkun and Jack W Stokes. 2017. Malware classification with lstm and gru language models and a character-level cnn. In 2017 IEEE international Danny Hendler, Shay Kels, and Amir Rubin. 2018. Detecting malicious powershell commands using deep neural networks. In Proceedings of the 2018 on A… [find](https://scholar.google.com/scholar?q=Ben+Athiwaratkun+and+Jack+W+Stokes%2E+2017%2E+Malware+classification+with+lstm+and+gru+language+models+and+a+character%2Dlevel+cnn%2E+In+2017+IEEE+international+Danny+Hendler%2C+Shay+Kels%2C+and+Amir+Rubin%2E+2018%2E) 4. Renuka Kumar and Anand Raj Essar Vaishakh. 2016. Detection of obfuscation in java malware. Procedia Computer Science, 78:521–529. [find](https://scholar.google.com/scholar?q=Renuka+Kumar+and+Anand+Raj+Essar+Vaishakh%2E+2016%2E+Detection+of+obfuscation+in+java+malware%2E+Procedia+Computer+Science%2C+78%3A521%E2%80%93529%2E) 5. Tsung-Yi Lin, Priya Goyal, Ross Girshick, Kaiming He, and Piotr Dollár. 2017. [Focal loss for dense object detection](https://md.research.elamur.ai/free/en/papers/lin-2017-focal-loss-dense-object-detection/). In Proceedings of the IEEE international conference on computer vision, pages 2980–2988. *Updated 1 November 2026*