Real-Time Malware Process Detection and Automated Process Killing

Figure 2

Benignware sample, normalised process-level metrics, 6 observations made without process being killed.