Entropy for Processes for a given Host (Normalized Process Events)

'Entropy calculation used to help identify Hosts where they have a high variety of processes(a high entropy process list on a given Host over time). This helps us identify rare processes on a given Host. Rare here means a process shows up on the Host relatively few times in the the last 7days. The Weight is calculated based on the Entropy, Process Count and Distinct Hosts with that Process. The lower the Weight/ProcessEntropy the, more interesting. The Weight calculation increases the Weight if the process executes more than once on the Host or has executed on more than 1 Hosts. In general, this should identify processes on a Host that are rare and rare for the environment. References: https://medium.com/udacity/shannon-entropy-information-gain-and-picking-balls-from-buckets-5810d35d54b4 https://en.wiktionary.org/wiki/Shannon_entropy'