There is no mention of false-positive rates, one of the things about traditional antimalware software that tends to worry me a bit. Even "for low-level systems that follow a predictable and standard routine", things like spikes in load could look unusual.

Using "side channel" hints is actually what (some) humans do to suspect malware infection too - unusually large amounts of HDD or network activity while the system is idle, or CPU fans running much more than normal, tends to raise suspicion.