---
title: "Semantic Clustering of Obfuscated Command-Line Detections for"
description: "Security teams using endpoint protection face far more alerts than they can review. 11 references."
authors: ["Barbora Štěpánková", "Vojtěch Outrata", "Martin Kopp"]
year: 2026
venue: "Proceedings of the Second International Conference on Natural Language Processing and Artificial Intelligence for Cyber Security"
source: "https://aclanthology.org/2026.nlpaics-1.19/"
licence: "CC BY 4.0 (ACL Anthology)"
licence_url: "https://creativecommons.org/licenses/by/4.0/"
summary_licence: "Elamur Cosmic License"
canonical: "https://research.elamur.ai/free/en/papers/stepankova-2026-semantic-clustering-obfuscated-command-line/"
---
[Elamur Research](https://md.research.elamur.ai/free/en/) · [this page in HTML](https://research.elamur.ai/free/en/papers/stepankova-2026-semantic-clustering-obfuscated-command-line/)

[home](https://md.research.elamur.ai/free/en/) / [papers](https://md.research.elamur.ai/free/en/papers/) / [2026](https://md.research.elamur.ai/free/en/papers/2026/page/42/) / Semantic Clustering of Obfuscated Command-Line Detections for Alert Reduction

# Semantic Clustering of Obfuscated Command-Line Detections for Alert Reduction

**Authors:** [Barbora Štěpánková](https://md.research.elamur.ai/free/en/authors/barbora-stepankova/), [Vojtěch Outrata](https://md.research.elamur.ai/free/en/authors/vojtech-outrata/) and [Martin Kopp](https://md.research.elamur.ai/free/en/authors/martin-kopp/) · **Year:** 2026 · **Venue:** [Proceedings of the Second International Conference on Natural Language Processing and Artificial Intelligence for Cyber Security](https://md.research.elamur.ai/free/en/venues/nlpaics/) ([International Conference on Natural Language Processing and Artificial Intelligence for Cyber Security 2026](https://md.research.elamur.ai/free/en/venues/nlpaics/2026/)) · **Publisher:** [Department of Languages and Information Systems, University of Alicante](https://md.research.elamur.ai/free/en/publishers/department-of-languages-and-information-systems-university-of-alicante/) · **Licence:** [CC BY 4.0 (ACL Anthology)](https://creativecommons.org/licenses/by/4.0/)

**Links:** [Publisher's page](https://aclanthology.org/2026.nlpaics-1.19/) · [PDF](https://aclanthology.org/2026.nlpaics-1.19.pdf)

## Summary
Security teams using endpoint protection face far more alerts than they can review. Even a precise detector of obfuscated command-lines raises many alerts, and many of them are near-identical variants or benign but syntactically complex commands. The authors, from Cisco, add a post-processing stage between the detector and alert creation. First, command-lines are normalized by replacing dates, URLs, GUIDs and IPs with placeholders. They are then embedded with Sentence-BERT (all-MiniLM-L6-v2) and grouped using hierarchical agglomerative clustering. Each cluster gets one real command-line as its representative. A zero-shot LLM then judges whether that representative is truly obfuscated, so false-positive clusters are dropped. The evaluation used real telemetry from a commercial product: three manually labeled days plus one unlabeled week. Across that week, alert volume fell by about 98%, and clusters stayed pure and coherent. Because the LLM only sees one representative per cluster, its cost grows with the number of clusters rather than raw detections. This makes the approach practical for high-volume operational settings.

## Key points
- **Clustering setup:** HAC with average linkage over cosine distances, distance threshold 0.3 and minimum cluster size 1. The representative is the member with the smallest Levenshtein distance to the cluster's longest common subsequence (LCS).
- **Data:** The detector produces about 1,400 flags daily. 4,432 instances from three days were hand-labeled (two days for development, one held out), and an additional unlabeled week was used for label-free evaluation. The data is not public because it contains sensitive customer information.
- **Alert reduction:** An average of 1,207 daily detections became about 67 clusters and then about 23 final alerts, a reduction of roughly 98% that held steady across the week.
- **Cluster quality:** Label purity was 100% on the labeled subset, and the mean silhouette score was 0.82. A new LLM-based coherence metric rates each cluster on a 1–5 scale, where lower is better, and scores fell mostly in the low-to-mid range.
- **Cluster sizes:** On a typical day, about 31 clusters were singletons and fewer than 8 had more than 10 members. The largest cluster held 1,061 command-lines and had an average coherence score of 2.

*Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.*

📚 Shelves (2): [🖥️ Computer Science](https://md.research.elamur.ai/free/en/shelves/computer-science/) · 16,667 works · [🤖 Artificial Intelligence](https://md.research.elamur.ai/free/en/shelves/computer-science/artificial-intelligence/) · 16,194 works

## Cite

Cite as: Barbora Štěpánková, Vojtěch Outrata and Martin Kopp. 2026. Semantic Clustering of Obfuscated Command-Line Detections for Alert Reduction. Proceedings of the Second International Conference on Natural Language Processing and Artificial Intelligence for Cyber Security.

The paper itself, not this page. BibTeX from the library's record of the work.

```bibtex
@inproceedings{stepankova2026semantic,
  title = {{Semantic Clustering of Obfuscated Command-Line Detections for Alert Reduction}},
  author = {Barbora Štěpánková, Vojtěch Outrata and Martin Kopp},
  booktitle = {Proceedings of the Second International Conference on Natural Language Processing and Artificial Intelligence for Cyber Security},
  year = {2026},
  url = {https://aclanthology.org/2026.nlpaics-1.19/}
}
```

- [← previous Sem-DPO: Mitigating Semantic Inconsistency in Preference Optimization for Prompt Engineering](https://md.research.elamur.ai/free/en/papers/mohamed-2026-sem-dpo-mitigating-semantic-inconsistency/)
- [next → Semantic Contrastive Adaptation for Multimodal Figurative Language Understanding](https://md.research.elamur.ai/free/en/papers/siddiqui-2026-semantic-contrastive-adaptation-multimodal-figurative/)
- [↑ back to papers of 2026](https://md.research.elamur.ai/free/en/papers/2026/page/42/)

## References

11 references, 2 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

1. Chris Egersdoerfer, Di Zhang, and Dong Dai. 2022. Clusterlog: Clustering logs for effective log-based anomaly detection. In 2022 IEEE/ACM 12th Workshop on Fault Tolerance for HPC at eXtreme Scale (FTXS), pages 1–10. [find](https://scholar.google.com/scholar?q=Chris+Egersdoerfer%2C+Di+Zhang%2C+and+Dong+Dai%2E+2022%2E+Clusterlog%3A+Clustering+logs+for+effective+log%2Dbased+anomaly+detection%2E+In+2022+IEEE%2FACM+12th+Workshop+on+Fault+Tolerance+for+HPC+at+eXtreme+Scale+%28FTX)
2. Daniel S. Hirschberg. 1977. Algorithms for the longest common subsequence problem. J. ACM, 24(4):664–675. [find](https://scholar.google.com/scholar?q=Daniel+S%2E+Hirschberg%2E+1977%2E+Algorithms+for+the+longest+common+subsequence+problem%2E+J%2E+ACM%2C+24%284%29%3A664%E2%80%93675%2E)
3. Sian-Yao Huang, Cheng-Lin Yang, Che-Yu Lin, and Chun-Ying Huang. 2024. CmdCaliper: A semantic-aware command-line embedding model and dataset for security research. In Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, pages 20188–20206, Miami, Florida, USA. Assoc… [find](https://scholar.google.com/scholar?q=Sian%2DYao+Huang%2C+Cheng%2DLin+Yang%2C+Che%2DYu+Lin%2C+and+Chun%2DYing+Huang%2E+2024%2E+CmdCaliper%3A+A+semantic%2Daware+command%2Dline+embedding+model+and+dataset+for+security+research%2E+In+Proceedings+of+the+2024+Conferenc)
4. Jinxi Kuang, Jinyang Liu, Junjie Huang, Renyi Zhong, Jiazhen Gu, Lan Yu, Rui Tan, Zengyin Yang, and Michael R. Lyu. 2024. Knowledge-aware alert aggregation in large-scale cloud systems: a hybrid approach. In Proceedings of the 46th International Conference on Software Engineering: Software Engineeri… [find](https://scholar.google.com/scholar?q=Jinxi+Kuang%2C+Jinyang+Liu%2C+Junjie+Huang%2C+Renyi+Zhong%2C+Jiazhen+Gu%2C+Lan+Yu%2C+Rui+Tan%2C+Zengyin+Yang%2C+and+Michael+R%2E+Lyu%2E+2024%2E+Knowledge%2Daware+alert+aggregation+in+large%2Dscale+cloud+systems%3A+a+hybrid+appro)
5. Bronagh Lanigan, Zeinab Rezaeifar, Federico Cruciani, Michael Milliken, Jordan Vincent, Samuel Moore, Muhammad Aaqib, Alan Mills, Pushpin-der K. Chouhan, Alfie Beard, Chris D. Nugent, Luke Chen, and Alex Healing. 2025. Alert correlation for intelligent threat detection and response. Intelligent Syst… [find](https://scholar.google.com/scholar?q=Bronagh+Lanigan%2C+Zeinab+Rezaeifar%2C+Federico+Cruciani%2C+Michael+Milliken%2C+Jordan+Vincent%2C+Samuel+Moore%2C+Muhammad+Aaqib%2C+Alan+Mills%2C+Pushpin%2Dder+K%2E+Chouhan%2C+Alfie+Beard%2C+Chris+D%2E+Nugent%2C+Luke+Chen%2C+and+A)
6. Vojtěch Outrata, Barbora Štěpánková, Michael Adam Polák, and Martin Kopp. 2026. [Command-line obfuscation detection in real-world telemetry under extreme class imbalance](https://md.research.elamur.ai/free/en/papers/outrata-2026-command-line-obfuscation-detection-real/). In Proceedings of the Second International Conference on Natural Language Processing and Artificial Intelligence for Cyber Secur…
7. Nils Reimers and Iryna Gurevych. 2019. [Sentence-BERT: Sentence embeddings using Siamese BERT-networks](https://md.research.elamur.ai/free/en/papers/reimers-2019-sentence-bert-sentence-embeddings-siamese/). In Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Joint Conference on Natural Language Processing (EMNLP-IJCNLP), pages 3982–3992,…
8. Peter Rousseeuw. 1987. Rousseeuw, p.j.: Silhouettes: A graphical aid to the interpretation and validation of cluster analysis. comput. appl. math. 20, 53-65. Journal of Computational and Applied Mathematics, 20:53–65. [find](https://scholar.google.com/scholar?q=Peter+Rousseeuw%2E+1987%2E+Rousseeuw%2C+p%2Ej%2E%3A+Silhouettes%3A+A+graphical+aid+to+the+interpretation+and+validation+of+cluster+analysis%2E+comput%2E+appl%2E+math%2E+20%2C+53%2D65%2E+Journal+of+Computational+and+Applied+Mathe)
9. Lior Turgeman, Yaniv Avrashi, Gabriella Vagner, Nadeem Azaizah, and Someshwar Katkar. 2022. Context-aware incremental clustering of alerts in monitoring systems. Expert Systems with Applications, 210:118489. [find](https://scholar.google.com/scholar?q=Lior+Turgeman%2C+Yaniv+Avrashi%2C+Gabriella+Vagner%2C+Nadeem+Azaizah%2C+and+Someshwar+Katkar%2E+2022%2E+Context%2Daware+incremental+clustering+of+alerts+in+monitoring+systems%2E+Expert+Systems+with+Applications%2C+210%3A)
10. Junjie Zha, Xinwen Shan, Jiaxin Lu, Jiajia Zhu, and Zihan Liu. 2024. Leveraging large language models for efficient alert aggregation in aiops. Electronics, 13(22). [find](https://scholar.google.com/scholar?q=Junjie+Zha%2C+Xinwen+Shan%2C+Jiaxin+Lu%2C+Jiajia+Zhu%2C+and+Zihan+Liu%2E+2024%2E+Leveraging+large+language+models+for+efficient+alert+aggregation+in+aiops%2E+Electronics%2C+13%2822%29%2E)
11. Valdemar Švábenský, Jan Vykopal, Pavel Čeleda, Kris-tián Tkáčik, and Daniel Popovič. 2022. Student assessment in cybersecurity training automated by pattern mining and clustering. Education and Information Technologies. [find](https://scholar.google.com/scholar?q=Valdemar+%C5%A0v%C3%A1bensk%C3%BD%2C+Jan+Vykopal%2C+Pavel+C%CC%8Celeda%2C+Kris%2Dti%C3%A1n+Tk%C3%A1c%CC%8Cik%2C+and+Daniel+Popovic%CC%8C%2E+2022%2E+Student+assessment+in+cybersecurity+training+automated+by+pattern+mining+and+clustering%2E+Education+and+Inf)

*Updated 1 November 2026*