# SCADE: Scalable Framework for Anomaly Detection in High-Performance System

arXiv: https://arxiv.org/abs/2412.04259 · HTML: https://mlsanity.com/paper/2412.04259/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 7 of its 39 references that are in the map.
- First posted on arXiv 5 Dec 2024.

## Builds on (most cited first, 7 of 7)

- [Graph-based Anomaly Detection and Description: A Survey](https://mlsanity.com/paper/1404.4679/) (2014)
- [A survey of dimensionality reduction techniques](https://mlsanity.com/paper/1403.2877/) (2014)
- [Living-Off-The-Land Command Detection Using Active Learning](https://mlsanity.com/paper/2111.15039/) (2021)
- [CmdCaliper: A Semantic-Aware Command-Line Embedding Model and Dataset for Security Research](https://mlsanity.com/paper/2411.01176/) (2024)
- [Anomaly Detection of Command Shell Sessions based on DistilBERT: Unsupervised and Supervised Approaches](https://mlsanity.com/paper/2310.13247/) (2023)
- [ProblemChild: Discovering Anomalous Patterns based on Parent-Child Process Relationships](https://mlsanity.com/paper/2008.04676/) (2020)
- [Intrusion Detection at Scale with the Assistance of a Command-line Language Model](https://mlsanity.com/paper/2404.13402/) (2024)

## Abstract (arXiv)

As command-line interfaces remain integral to high-performance computing environments, the risk of exploitation through stealthy and complex command-line abuse grows. Conventional security solutions struggle to detect these anomalies due to their context-specific nature, lack of labeled data, and the prevalence of sophisticated attacks like Living-off-the-Land (LOL). To address this gap, we introduce the Scalable Command-Line Anomaly Detection Engine (SCADE), a framework that combines global statistical models with local context-specific analysis for unsupervised anomaly detection. SCADE leverages novel statistical methods, including BM25 and Log Entropy, alongside dynamic thresholding to adaptively detect rare, malicious command-line patterns in low signal-to-noise ratio (SNR) environments. Experimental results show that SCADE achieves above 98% SNR in identifying anomalous behavior while minimizing false positives. Designed for scalability and precision, SCADE provides an innovative, metadata-enriched approach to anomaly detection, offering a robust solution for cybersecurity in high-computation environments. This work presents SCADE's architecture, detection methodology, and its potential for enhancing anomaly detection in enterprise systems. We argue that SCADE represents a significant advancement in unsupervised anomaly detection, offering a robust, adaptive framework for security analysts and researchers seeking to enhance detection accuracy in high-computation environments.