Process anomaly detector for Linux - identifies suspicious processes by analyzing provenance, behavior, and trust levels