It seems like some key piece of information is missing here and I suspect that’s why they didn’t demonstrate the full exploit. With all the billions of apps and websites capable of being run in all their infinite combinations how does the pretrained system make the determination of what is being run with any accuracy, especially without knowing far more about the specific performance of the hardware it’s being run on? Given that this works best on people who leave things running it sounds like you would need to reprofile the performance every time a large program is closed. It seems to me that this would work to let you know that some small set of popular programs and sites were likely being run but not with any real confidence.