SCADE: Scalable Framework for Anomaly Detection in High-Performance System

Anjali Mangal; Vaishali Vinay

REVIEW 5 major objections 5 minor 45 references

SCADE: Scalable Framework for Anomaly Detection in High-Performance System

T0 review · 5 major / 5 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read SCADE claims that scoring command-line token rarity with BM25 and log entropy, then checking local user and asset baselines, detects malicious commands at above 98% signal-to-noise without labeled data.

desk verdict A plausible architecture with an unverified performance claim and a local-analysis stage that cannot do what the paper says it does. read the letter →

arxiv 2412.04259 v2 pith:X3AGZKBH submitted 2024-12-05 cs.CR cs.LG

Vaishali Vinay , Anjali Mangal This is my paper · ORCID

classification cs.CRcs.LG

keywords anomalydetectioncommand-linesecurityliving-off-the-landunsupervisedlearningBM25logentropydynamicthresholdingIsolationForest

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

SCADE is an unsupervised framework for spotting malicious command-line activity in very large enterprise systems, aimed at attacks that abuse legitimate tools, known as living-off-the-land. It argues that rarity is the usable signal: tokens that rarely appear across millions of command-line events are scored by BM25 and log-entropy statistics, and then re-checked against per-user and per-asset baselines so that rare-but-authorized admin actions are not escalated as threats. The paper reports that in a red-team exercise on Microsoft data-center telemetry, the framework separated injected malicious commands from routine activity with above 98% signal-to-noise and true-positive rate, without labeled training data. If the reported figures hold, the framework offers a label-free, scalable detection path for environments where supervised detectors choke on alert volume.

What carries the argument

The engine is the two-layer scoring pipeline. Raw process-creation telemetry (Event ID 4688) is normalized and concatenated into a payload_items field, then tokenized as 1-grams and 2-grams. Two rarity scorers run over the corpus: BM25, computed as $BM25(d)=\sum_t IDF(t)\cdot TF(t,d)$, and log entropy, which weights each token by $1+\frac{f(t,d)}{\sum_{d\in D} f(t,d)\log(|D|/(1+f(t)))}$. Dynamic thresholds based on the mean and standard deviation of recent scores, $1.5\sigma$ for medium severity and $2\sigma$ for high severity, select candidate anomalies. The local layer then builds a 5-day per-user, per-asset execution history and applies an Isolation Forest to the resulting statistics, producing the final true-positive versus benign-positive decision. The combination lets the system downgrade globally rare commands that are normal for a particular user or asset, which is what keeps the signal-to-noise ratio high.

What would settle it

A red-team test where the injected commands reuse only the most frequent command-line tokens and ordinary admin parameter formats should make the global rarity scores for malicious events overlap with normal events; if SCADE's signal-to-noise still exceeds 98% under that condition, the rarity assumption is not actually load-bearing, and if it drops, the framework's core premise is falsified.

Watch

Extended reading notes

Core claim

The central claim is that combining a global rarity layer with a local context layer lets an unsupervised detector tell genuine threats from benign anomalies at scale. On the global side, each command-line event is flattened into a concatenated payload string, tokenized into 1-grams and 2-grams, and scored by BM25 and log-entropy; both scores reward tokens that are rare across the whole corpus. A dynamic threshold, set at $1.5\sigma$ and $2\sigma$ from the recent mean, flags high- and medium-severity candidates. The local layer then looks at each flagged command's 5-day execution history for the involved user and asset and runs an Isolation Forest over those statistics, reclassifying as a benign positive anything that fits the user's or asset's usual pattern. The authors report 100% signal-to-noise in the evaluation narrative and above 98% signal-to-noise and true-positive rate in the abstract and conclusion, with the true-positive versus benign-positive split being the key differentiator.

Load-bearing premise

The framework assumes that malicious commands are statistically rare in the token distribution, so rarity alone can flag candidates before the local layer reclassifies them; if an attacker uses only common commands or common parameter patterns, the global layer has nothing to catch.

Editorial extensions

If this is right

SCADE can operate without labeled data, so it can be dropped into data-center environments where supervised models fail for lack of ground truth.
The dual-layer split between global rarity and local habit should reduce alert fatigue for security teams, since benign positives are separated from true positives rather than dumped into one queue.
Because both global scorers are simple statistical models, the pipeline scales to billions of events across 18 million nodes in near real time, unlike transformer-based detectors.
The framework can flag compliance issues, not just attacks, as demonstrated by the long-running certification dump processes it uncovered.
The modular design allows future integration of active learning, intent understanding, and additional telemetry without rebuilding the core.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

The rarity principle is transferable: the same BM25-plus-local-baseline pipeline could be applied to PowerShell script blocks, bash history, or Kubernetes exec events, though SCADE only tests process-command telemetry.
A natural ablation study would vary the BM25 $k$ and $b$ parameters and the $\sigma$ thresholds to see how sensitive the claimed >98% signal-to-noise is to those choices; the paper does not report this.
The 5-day local window is short relative to monthly or quarterly admin tasks; extending it may catch annual or seasonal rare-but-authorized commands that currently risk being mislabeled as true positives.
The paper reports the red-team exercise in narrative form without giving confusion-matrix counts or exact score distributions, so an independent replication on a public dataset would be the decisive test.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

SCADE is a clearly written system description of a two-layer command-line anomaly detector. The architecture—global BM25/log-entropy rarity scoring, then local per-user/per-asset Isolation Forest—is a reasonable engineering response to a real problem, and the related work is adequate. That is where the credit ends.

The evaluation is essentially absent. No data volume, event counts, node counts, duration, baseline, or confusion matrix are reported. Section 4.4 claims 100% SNR, the abstract and conclusion claim >98% SNR and >98% TPR, and none of these numbers are tied to a measurement. Equations (2) and (4) contain typos, and the dynamic threshold in S7 is set from the same run that is later scored, so any reported performance is in-sample.

The deeper problem is the local-analysis stage. The paper says S8–S10 exist to avoid flagging rare-but-benign commands like an admin test that runs once a year. But the S9 baseline uses only five days of history. A once-a-year command is absent from every five-day window, just like a one-time malicious command. The Isolation Forest in S10 therefore has no feature that distinguishes 'rare because periodic' from 'rare because malicious'. The claimed false-positive reduction cannot be produced by this pipeline.

The novelty is thin: BM25 and log entropy are standard 1990s IR weights, and applying them to command-line tokens is an incremental transfer. The 'first application' claim is unverified.

Who is this for? Practitioners wanting a rough architecture sketch might glance at it. Researchers should not cite its performance numbers. The paper needs real evaluation and a reworked local-analysis design before it is peer-reviewable. I would desk reject as is, with an invitation to resubmit with numbers.

Referee Report

5 major / 5 minor

Summary. The paper presents SCADE, an unsupervised command-line anomaly detection framework for large-scale data-center environments. The framework consists of a global analysis stage that tokenizes telemetry payload items into 1- and 2-grams and scores them with BM25 and Log Entropy, followed by dynamic threshold selection, and a local analysis stage that builds per-user, per-asset baselines over five-day windows and applies an Isolation Forest to filter false positives. The authors report a red-team proof of concept claiming 100% signal-to-noise ratio in Section 4.4 and 'above 98%' true positive rate in the abstract and conclusion. The contributions claimed include dual-layer detection, first application of BM25 and Log Entropy to command-line anomaly detection, dynamic thresholding, and scalability to billions of events.

Significance. If the reported performance were substantiated, SCADE would be a useful addition to the unsupervised command-line anomaly detection literature: the combination of global rarity scoring with local contextual baselines is sensible, and the application of BM25 and Log Entropy to command-line payloads is a reasonable novelty. The paper also explicitly targets a real operational constraint, the lack of labeled data, and the proposed architecture is modular and plausible for distributed deployment. However, the manuscript as submitted provides no quantitative evaluation beyond unverifiable summary claims, and two architectural elements—the circular threshold selection and the five-day local baseline—undermine the central false-positive-reduction claim. The contributions are therefore not supported by evidence in the current text, and the paper is not reproducible in its present form.

major comments (5)

[§4.4] The evaluation section contains no quantitative evidence: no data volume, event count, node count, duration, red-team injection count, confusion matrix, or false-positive count is reported. The statement that SCADE achieved an SNR of 100% is not accompanied by any computation, and the abstract and conclusion claim 'above 98%' and 'true positive rate above 98%' without reconciling these numbers with the 100% figure. The central performance claim is therefore unverifiable from the manuscript.
[§4.3.2, S7] The dynamic threshold is computed from the mean and standard deviation of the anomaly scores of the same run that is later used to compute the reported SNR. Because there is no held-out period, separate validation set, or ground-truth-based threshold tuning described, the threshold selection and the reported detection performance are not independent. The reported SNR is consequently not a reliable estimate of performance on new data.
[§4.3.3, S9] The local analysis baseline is built from only five days of historical data, yet S8 explicitly identifies the case of a legitimate command executed once a year as rare but not harmful. Such a command would be absent from every five-day window, exactly like a one-time malicious command. The Isolation Forest in S10 therefore has no feature that distinguishes 'rare because authorized and periodic' from 'rare because malicious,' so the architecture cannot deliver the false-positive reduction asserted in the abstract and conclusion.
[§4.3.2, Eq (2)] The IDF formula as written is not the standard BM25 IDF. The expression log((N - n(t) + 0.5) / (n(t) + 0.5 + 1)) (if the '+1' is outside the log) or log((N - n(t) + 0.5) / (n(t) + 0.5) + 1) (if inside) differs from the standard form log((N - n(t) + 0.5) / (n(t) + 0.5) + 1), which guarantees non-negativity. The printed version can produce negative or shifted scores, and because all BM25-based anomaly scores in S5–S8 depend on this value, the scoring is not well defined as presented.
[§4.3.2, S6 and Eq (4)] The Log Entropy weight formula is not the standard log-entropy weighting and appears to have the summation in the wrong place. The expression 1 + f(t,d) / (sum_{d in D} f(t,d) · log(|D| / (1 + f(t)))) either omits the required entropy sum over tokens or uses f(t) in two incompatible roles. The paper also does not specify how the per-token Log Entropy weights are aggregated into the payload-item score that enters the anomaly threshold in S7, making the entire Log Entropy path irreproducible.

minor comments (5)

[§4.3.2, S7] The high-severity criterion 'more than two standard deviations' and the medium-severity criterion 'between 1.5 and 2 standard deviations' leave the boundary at exactly 2σ unclassified; the paper should state whether that case is high or medium severity.
[§4.3.2, S6] There is a duplicated definite article in 'the the term frequency' that should be corrected.
[§3, item 3] The term 'high Signal-to-Noise Ratio (SNR) environment' is used to describe a setting with many false positives, whereas the rest of the paper treats high SNR as a desirable property. The terminology should be clarified or reversed for consistency.
[References] Reference [25] contains the typo 'First Confrence' and several references lack complete venue or year information; in particular, the ACM template placeholders ('Conference acronym XX', 'June 03–05, 2018') should be replaced with the actual submission venue and date.
[General] The title and the abstract use 'High-Performance System' while the body refers to 'high-computation environments' and 'data centers'; these terms should be aligned to avoid ambiguity.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity found: the global scoring and thresholding are fixed external formulas, and the reported SNR is under-specified rather than definitionally tied to the pipeline's inputs.

full rationale

No circular step is exhibited in the paper's derivation chain. The global analysis (S3–S6) applies standard BM25 and log-entropy formulas to tokenized payload items; these are external scoring functions with stated constants and do not encode the red-team labels or the reported SNR. S7's dynamic threshold is a fixed rule based on the mean and standard deviation of the current run's scores, not a parameter fitted to maximize detection accuracy, and the paper gives no equation that makes the reported SNR or true-positive rate equal to that threshold rule. The local analysis (S9–S10) uses a separate five-day historical baseline and an Isolation Forest model; nothing in the text defines true positives or benign positives in terms of that model's output in a way that would make the evaluation tautological. There are no load-bearing self-citations, no imported uniqueness theorems, and no ansatz smuggled in via prior work by the same authors. The evaluation section is under-specified: it does not define SNR, does not state whether thresholds were computed on the same data as the reported detections, and does not provide a reproducible protocol for the >98% claims. Those are evidence and correctness concerns, not circularity under the stated hard rules. Because I cannot quote a specific equation or construction that reduces a claimed prediction to its inputs, the appropriate finding is no significant circularity.

Assumptions & free parameters 6 free parameters · 5 assumptions · 0 invented entities

The framework depends on several free parameters and domain assumptions. Most free parameters are not given values, and the key hypothesis that rare commands are suspicious is a stated domain assumption, not derived. No new entities are introduced beyond the system components.

free parameters (6)

BM25 k (term frequency saturation) = not specified
Controls how quickly term frequency saturates in Eq. (1); no default or tuning procedure is given.
BM25 b (length normalization) = not specified
Balances document-length penalty in Eq. (1); no value or tuning procedure is given.
Severity thresholds (sigma multiples) = 2.0 high, 1.5 medium
Chosen in S7 without justification or sensitivity analysis.
Local analysis history window = 5 days
S9 uses 5 days of historical data; no analysis of window size impact.
Threshold recalculation window = last 2 days
S7 self-adjusting mechanism uses a 2-day window; no justification.
Isolation Forest hyperparameters = not specified
S10 uses Isolation Forest but does not state contamination, tree count, or feature details.

assumptions (5)

standard math BM25 and log entropy formulas are correct as stated and applicable to command-line tokens.
S5-S6 rely on these formulas from IR literature, but Eqs. (2) and (4) appear to contain typos and are sourced from Wikipedia and an AI answer site.
domain assumption Rare command-line tokens correlate with malicious behavior.
S3-S7 treat token rarity as the core anomaly signal; this is stated as intuition, not derived or validated.
domain assumption Windows Event ID 4688 captures all relevant process creation events.
S2 filters telemetry to Event ID 4688, assuming this includes the command-line activity of interest.
domain assumption Red team TTPs are representative of real-world command-line attacks.
Section 4.4 evaluates only on a red team exercise with no details on attack selection or coverage.
ad hoc to paper The 1.5-sigma and 2-sigma threshold bands separate benign positives from true positives.
S7 introduces these bands without calibration or external justification; they are specific to this paper's design.

how reviews work

0 comments

Cite this review

Pith. "Pith review of SCADE: Scalable Framework for Anomaly Detection in High-Performance System." pith.science (2026). https://pith.science/paper/X3AGZKBH

@misc{pith2026241204259,
  author       = {Pith},
  title        = {Pith review of: SCADE: Scalable Framework for Anomaly Detection in High-Performance System},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/X3AGZKBH}},
  note         = {Machine review of arXiv:2412.04259}
}

read the original abstract

As command-line interfaces remain integral to high-performance computing environments, the risk of exploitation through stealthy and complex command-line abuse grows. Conventional security solutions struggle to detect these anomalies due to their context-specific nature, lack of labeled data, and the prevalence of sophisticated attacks like Living-off-the-Land (LOL). To address this gap, we introduce the Scalable Command-Line Anomaly Detection Engine (SCADE), a framework that combines global statistical models with local context-specific analysis for unsupervised anomaly detection. SCADE leverages novel statistical methods, including BM25 and Log Entropy, alongside dynamic thresholding to adaptively detect rare, malicious command-line patterns in low signal-to-noise ratio (SNR) environments. Experimental results show that SCADE achieves above 98% SNR in identifying anomalous behavior while minimizing false positives. Designed for scalability and precision, SCADE provides an innovative, metadata-enriched approach to anomaly detection, offering a robust solution for cybersecurity in high-computation environments. This work presents SCADE's architecture, detection methodology, and its potential for enhancing anomaly detection in enterprise systems. We argue that SCADE represents a significant advancement in unsupervised anomaly detection, offering a robust, adaptive framework for security analysts and researchers seeking to enhance detection accuracy in high-computation environments.

Figures

Figures reproduced from arXiv: 2412.04259 by the authors.

**Figure 1.** The architecture of the SCADE framework. It highlights the dual-layer analysis approach combining Global and Local Analysis, designed to detect anomalies in commandline activities with precision and contextual awareness. 4.1 Understanding Malicious Command-Line Behavior The detection of malicious command-line behavior hinges on differentiating benign anomalies from actions that may signal potential threats. In hig… view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

45 extracted references · 35 canonical work pages

[1]

Shikha Agrawal and Jitendra Agrawal. 2015. Survey on Anomaly Detection using Data Mining Techniques. Procedia Computer Science 60 (2015), 708–713. https://doi.org/10.1016/j.procs.2015.08.220

work page doi:10.1016/j.procs.2015.08.220 2015
[2]

Infermatic AI. 2024. How can log entropy be used to identify potential security threats in a system? https: //infermatic.ai/ask/?question=How+can+log+entropy+be+used+to+ identify+potential+security+threats+in+a+system%3F Accessed: 2024-11-20

work page 2024
[3]

Leman Akoglu, Hanghang Tong, and Danai Koutra. 2015. Graph based anomaly detection and description: a survey. Data mining and knowledge discovery 29 (2015), 626–688

2015
[4]

Almgren and E

M. Almgren and E. Jonsson. 2004. Using active learning in intrusion detection. In Proceedings. 17th IEEE Computer Security Foundations Workshop, 2004. IEEE, Pacific Grove, CA, USA, 88–98. https://doi.org/ 10.1109/CSFW.2004.1310734

arXiv 2004
[5]

Microsoft Security Blog. 2018. Out of Sight but Not Invisible: Defeating Fileless Malware with Behavior Monitoring, AMSI, and Next-Gen AV. https://www.microsoft.com/en-us/security/blog/2018/09/27/out-of- sight-but-not-invisible-defeating-fileless-malware-with-behavior- monitoring-amsi-and-next-gen-av/

work page 2018
[6]

Varun Chandola, Arindam Banerjee, and Vipin Kumar. 2009. Anomaly detection: A survey. ACM computing surveys (CSUR) 41, 3 (2009), 1–58

2009
[7]

Communications of the ACM. 2024. Security in High-Performance Computing Environments. Commun. ACM 60, 9 (2024), 72–

work page 2024
[8]

Wikipedia contributors. 2024. Okapi BM25. https://en.wikipedia.org/ wiki/Okapi_BM25

work page 2024

Show all 45 references

[9]

CrowdStrike. 2018. Going Beyond Malware: The Rise of Living-Off- The-Land Attacks. https://www.crowdstrike.com/en-us/blog/going- beyond-malware-the-rise-of-living-off-the-land-attacks/

2018
[10]

CrowdStrike. 2023. Going Beyond Malware: The Rise of Living-Off- The-Land Attacks. https://www.crowdstrike.com/en-us/blog/going- beyond-malware-the-rise-of-living-off-the-land-attacks/

2023
[11]

CrowdStrike. 2024. BERT Embeddings: A New Approach for Command-Line Anomaly Detection. CrowdStrike Blog (2024). https://www.crowdstrike.com/en-us/blog/bert-embeddings- new-approach-for-command-line-anomaly-detection/

2024
[12]

Cynet. 2024. What Are LOLBins and How Do Attackers Use Them in Fileless Attacks? https://www.cynet.com/attack-techniques-hands- Conference acronym ’XX, June 03–05, 2018, Woodstock, NY Vaishali Vinay and Anjali Mangal on/what-are-lolbins-and-how-do-attackers-use-them-in-fileles...

2024
[13]

Cyware. 2023. Let’s dig deeper on how cybercriminals use Living- off-the-Land attack tactics. https://social.cyware.com/news/lets- dig-deeper-on-how-cybercriminals-use-living-off-the-land-attack- tactics-cac5c132

2023
[14]

Sanjeev Das, Yang Liu, Wei Zhang, and Mahintham Chandramo- han. 2016. Semantics-Based Online Malware Detection: Towards Efficient Real-Time Protection Against Malware. IEEE Transactions on Information Forensics and Security 11, 2 (2016), 289–302. https: //doi.org/10.1109/TIFS....

2016
[15]

Zhaoyun Ding, Lina Liu, Donghua Yu, Songping Huang, Hang Zhang, and Kai Liu. 2021. Detection of Anomaly User Behaviors Based on Deep Neural Networks. In 2021 IEEE 20th International Conference on Trust, Security and Privacy in Computing and Communications (Trust- Com). IEEE, S...

2021
[16]

Bobby Filar and David French. 2020. ProblemChild: Discovering Anomalous Patterns based on Parent-Child Process Relationships. arXiv:2008.04676 [cs.CR] https://arxiv.org/abs/2008.04676

2020 arXiv
[17]

Joao Gama, Pedro Pereira Rodrigues, Eduardo Spinosa, and Andre Carvalho. 2010. Knowledge discovery from data streams. In Web Intelligence and Security. IOS Press, New York, 125–138

2010
[18]

Ashish Gehani and Dawood Tariq. 2012. SPADE: support for prove- nance auditing in distributed environments. In Proceedings of the 13th International Middleware Conference (ontreal, Quebec, Canada) (Mid- dleware ’12). Springer-Verlag, Berlin, Heidelberg, 101–120

2012
[19]

Manish Gupta, Jing Gao, Charu C Aggarwal, and Jiawei Han. 2013. Outlier detection for temporal data: A survey. IEEE Transactions on Knowledge and data Engineering 26, 9 (2013), 2250–2267

2013
[20]

Wajih Ul Hassan, Shengjian Guo, Ding Li, Zhengzhang Chen, Kangkook Jee, Zhichun Li, and Adam Bates. 2019. NoDoze: Combatting Threat Alert Fatigue with Automated Provenance Triage. Proceedings 2019 Network and Distributed System Security Symposium (2019), 24–27. https://doi.org...

2019
[21]

Atefeh Heydari, Mohammad ali Tavakoli, Naomie Salim, and Zahra Heydari. 2015. Detection of review spam: A survey. Expert Systems with Applications 42, 7 (2015), 3634–3642

2015
[22]

Victoria Hodge and Jim Austin. 2004. A survey of outlier detection methodologies. Artificial intelligence review 22 (2004), 85–126

2004
[24]

Sian-Yao Huang, Cheng-Lin Yang, Che-Yu Lin, and Chun-Ying Huang
[25]

M. Junius. 2023. AnoMark: Anomaly Detection in Command Lines. In Proceedings of the FIRST Conference 2023 . 2023 First Confrence, Montreal, CA, 44 pages. https://www.first.org/resources/papers/ conf2023/FIRSTCON23-TLP-CLEAR-Junius-AnoMark-Anomaly- Detection-in-Command-Lines.pdf

2023
[26]

Knapp, Gary D

Kenneth J. Knapp, Gary D. Denney, and Mark E. Barner. 2011. Key issues in data center security: An investigation of government audit reports. Government Information Quarterly 28, 4 (2011), 533–541. https: //doi.org/10.1016/j.giq.2010.10.008

2011 doi
[27]

In Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing , Yaser Al-Onaizan, Mohit Bansal, and Yun-Nung Chen (Eds.)

CmdCaliper: A Semantic-Aware Command-Line Embedding Model and Dataset for Security Research. In Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing , Yaser Al-Onaizan, Mohit Bansal, and Yun-Nung Chen (Eds.). Association for Computational Ling...

2024
[28]

Tao Liu, Jing Xia, Heping Tan, Ying Zhang, and Xiaofeng Xia. 2020. Scalable anomaly detection in massive data sets: a structured review. Journal of Big Data 7, 1 (2020), 1–23. https://doi.org/10.1186/s40537- 020-00320-x

2020 doi
[29]

Zefang Liu and John Buford. 2023. Anomaly Detection of Command Shell Sessions based on DistilBERT: Unsupervised and Supervised Approaches. arXiv:2310.13247 [cs.CL] https://arxiv.org/abs/2310.13247

2023 arXiv
[30]

Jiongliang Lin, Yiwen Guo, and Hao Chen. 2024. Intrusion Detection at Scale with the Assistance of a Command-line Language Model. arXiv:2404.13402 [cs.CR] https://arxiv.org/abs/2404.13402

2024 arXiv
[31]

Zhang, and Dongyan Xu

Shiqing Ma, X. Zhang, and Dongyan Xu. 2016. ProTracer: Towards Practical Provenance Tracing by Alternating Between Logging and Tainting. Proceedings 2016 Network and Distributed System Security Symposium (2016), 21–24. https://doi.org/10.14722/ndss.2016.23350

2016
[32]

Milajerdi, Rigel Gjomemo, Birhanu Eshete, R

Sadegh M. Milajerdi, Rigel Gjomemo, Birhanu Eshete, R. Sekar, and V. N. Venkatakrishnan. 2019. HOLMES: Real-time APT Detection through Correlation of Suspicious Information Flows. arXiv:1810.01594 [cs.CR] https://arxiv.org/abs/1810.01594

2019 arXiv
[33]

City University London. 2024. Okapi Information Retrieval System. https://smcse.city.ac.uk/doc/cisr/web/okapi/okapi.html

2024
[34]

Stokes, Jonathan Bar Or, Ke Tian, Farid Tajaddo- dianfar, Joshua Neil, Christian Seifert, Alina Oprea, and John C

Talha Ongun, Jack W. Stokes, Jonathan Bar Or, Ke Tian, Farid Tajaddo- dianfar, Joshua Neil, Christian Seifert, Alina Oprea, and John C. Platt
[35]

Srinivasan Parthasarathy, Amol Ghoting, and Matthew Otey. 2007. A Survey of Distributed Mining of Data Streams . Vol. 31. Springer, Boston, MA, Boston, MA, 289–307. https://doi.org/10.1007/978-0-387-47534- 9_13

2007 doi
[36]

Palo Alto Networks. n.d.. What Are Fileless Malware At- tacks? https://www.paloaltonetworks.com/cyberpedia/what-are- fileless-malware-attacks
[37]

Akhloufi

Abir Rahali and Moulay A. Akhloufi. 2023. MalBERTv2: Code Aware BERT-Based Model for Malware Identification. Big Data and Cognitive Computing 7, 2 (2023), 60. https://doi.org/10.3390/bdcc7020060

2023 doi
[38]

Stephen Robertson and Hugo Zaragoza. 2009. The Probabilistic Rel- evance Framework: BM25 and Beyond. Found. Trends Inf. Retr. 3, 4 (April 2009), 333–389. https://doi.org/10.1561/1500000019

2009 doi
[39]

SOCRadar. 2024. Living Off The Land (LOTL): The Invisible Cyber Threat Lurking in Your System. https://socradar.io/living-off-the- land-lotl-the-invisible-cyber-threat-lurking-in-your-system/

2024
[40]

LOLBAS Project. n.d.. Living Off The Land Binaries And Scripts (LOLBAS). https://lolbas-project.github.io/ Accessed: 2024-11-18

2024
[41]

Ryan Stamp. 2022. Living-off-the-Land Abuse Detection Us- ing Natural Language Processing and Supervised Learning. arXiv:2208.12836 [cs.CR] https://arxiv.org/abs/2208.12836

2022 arXiv
[42]

Jinita Tamboli and Madhu Shukla. 2016. A survey of outlier detection algorithms for data streams. In 2016 3rd International Conference on Computing for Sustainable Global Development (INDIACom). IEEE, New Delhi, India 2016, 3535–3540

2016
[44]

C. O. S. Sorzano, J. Vargas, and A. Pascual Montano. 2014. A survey of dimensionality reduction techniques. arXiv:1403.2877 [stat.ML] https://arxiv.org/abs/1403.2877

2014 arXiv
[80]

https://cacm.acm.org/research/security-in-high-performance- computing-environments/
[2021]

In Proceedings of the 24th International Symposium on Research in Attacks, Intrusions and Defenses (San Sebastian, Spain) (RAID ’21)

Living-Off-The-Land Command Detection Using Active Learn- ing. In Proceedings of the 24th International Symposium on Research in Attacks, Intrusions and Defenses (San Sebastian, Spain) (RAID ’21). Association for Computing Machinery, New York, NY, USA, 442–455. https://doi.org...
[2024]

arXiv:2411.01176 [cs.CL] https://arxiv.org/abs/2411.01176

CmdCaliper: A Semantic-Aware Command-Line Embedding Model and Dataset for Security Research. arXiv:2411.01176 [cs.CL] https://arxiv.org/abs/2411.01176

arXiv

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.

[1] [1]

Shikha Agrawal and Jitendra Agrawal. 2015. Survey on Anomaly Detection using Data Mining Techniques. Procedia Computer Science 60 (2015), 708–713. https://doi.org/10.1016/j.procs.2015.08.220

work page doi:10.1016/j.procs.2015.08.220 2015

[2] [2]

Infermatic AI. 2024. How can log entropy be used to identify potential security threats in a system? https: //infermatic.ai/ask/?question=How+can+log+entropy+be+used+to+ identify+potential+security+threats+in+a+system%3F Accessed: 2024-11-20

work page 2024

[3] [3]

Leman Akoglu, Hanghang Tong, and Danai Koutra. 2015. Graph based anomaly detection and description: a survey. Data mining and knowledge discovery 29 (2015), 626–688

2015

[4] [4]

Almgren and E

M. Almgren and E. Jonsson. 2004. Using active learning in intrusion detection. In Proceedings. 17th IEEE Computer Security Foundations Workshop, 2004. IEEE, Pacific Grove, CA, USA, 88–98. https://doi.org/ 10.1109/CSFW.2004.1310734

arXiv 2004

[5] [5]

Microsoft Security Blog. 2018. Out of Sight but Not Invisible: Defeating Fileless Malware with Behavior Monitoring, AMSI, and Next-Gen AV. https://www.microsoft.com/en-us/security/blog/2018/09/27/out-of- sight-but-not-invisible-defeating-fileless-malware-with-behavior- monitoring-amsi-and-next-gen-av/

work page 2018

[6] [6]

Varun Chandola, Arindam Banerjee, and Vipin Kumar. 2009. Anomaly detection: A survey. ACM computing surveys (CSUR) 41, 3 (2009), 1–58

2009

[7] [7]

Communications of the ACM. 2024. Security in High-Performance Computing Environments. Commun. ACM 60, 9 (2024), 72–

work page 2024

[8] [8]

Wikipedia contributors. 2024. Okapi BM25. https://en.wikipedia.org/ wiki/Okapi_BM25

work page 2024