1*c29d5175SchristosProc - Process based analysis 2*c29d5175Schristos 3*c29d5175Schristos This would include activity by PID, and syscall analysis. 4