1. A method for unsupervised anomaly-based malware detection using hardware features, the method comprising: obtaining current hardware performance data, including hardware performance time-varying counter data, for a hardware device executing a first process associated with recorded hardware performance data representative of the first process' normal behavior; identifying a set of hardware performance data from the obtained current hardware performance data based at least on a quantitative measure of how effective one or more features associated with the current hardware performance data can discriminate between hardware performance data obtained during clean execution of a victim process and hardware performance data obtained during infected execution of the victim process, wherein the quantitative measures are computed for both an exploitation stage and a take-over stage of a multi-stage malware infection that hijacks control of the victim process, and wherein the quantitative measures taken at both the exploitation stage and the take-over stage enable the determination of which features are most useful in differentiating clean execution for the victim process from infected execution of the victim process; aggregating the identified set of hardware performance data; transforming the aggregated set of hardware performance data based on one or more transform functions, the transforming the aggregated set of hardware performance data comprising deriving a normalized hardware performance value, normalized i , for an event i, from hardware performance data value, raw i for the event i, according to: normalized i = ( raw i - min i max i ) λ i where min i and max i are respective minimum and maximum values for the event i, and λ i is a power parameter for the event i; determining whether an anomalous process is affecting performance of the first process based on a determination of an extent of deviation of the transformed set of hardware performance data corresponding to the first process from the recorded hardware performance data representative of the normal behavior of the first process, wherein the anomalous process is a multi-stage malware infection having an exploitation stage and a take-over stage; obtaining updates for at least the recorded hardware performance data representative of the normal behavior of the first process, wherein obtaining the updates comprises: downloading encrypted data for the updates to an antivirus engine in communication with the hardware device providing the current hardware performance data; decrypting at the antivirus engine the downloaded encrypted data for the updates; and updating a revision counter maintained by the antivirus engine indicating a revision number of a most recent update.