: Reduced false positives by better distinguishing between clean programs and legitimate system processes.