1. At least one non-transitory machine readable storage medium, having instructions stored thereon, the instructions when executed on a machine, cause the machine to: collect a plurality of features of each of a plurality of processes; apply a plurality of classification rules to the plurality of features, wherein each of the plurality of classification rules corresponds to one or more of a plurality of process categories, and each of the plurality of classification rules comprises a logical combination of a set of the plurality of features; apply a plurality of weights to the plurality of classification rules to produce a plurality of weighted threat scores, wherein: each weighted threat score corresponds to one or more of the plurality of process categories; and at least one of the plurality of weights includes a combination weight applied to a determination of a logical combination of two or more specified features for a particular kind of threat, wherein the combination weight as applied to the logical combination of the two or more specified features is different than a sum of individual weights of the two or more specified features; compare the plurality of weighted threat scores to a plurality of threshold values, wherein each of the plurality of threshold values corresponds to one of the plurality of process categories; and classify the process in the one or more process categories based at least on the comparison of the plurality of weighted threat scores to the plurality of predetermined thresholds.