Using a characteristic of a process input/output (I/O) activity and data subject to the I/O activity to determine whether the process is a suspicious process

1. A computer program product for detecting a security breach in a system managing access to a storage, the computer program product comprising a computer readable storage medium having computer readable program code embodied therein that when executed performs operations, the operations comprising:

monitoring process Input/Output (I/O) activity of a process accessing data in a storage;

determining a peak I/O rate during a time period which an I/O rate of data access was a highest I/O rate;

determining a timestamp of when the data was last accessed;

characterizing the process initiating the I/O activity as a suspicious process in response to determining a process I/O rate of the process I/O activity as compared to the peak I/O rate of the data satisfies a first condition and a process access time at which the process is accessing the data as compared to the timestamp satisfies a second condition; and

indicating a security breach in response to characterizing the process as the suspicious process.

2. A computer program product for detecting a security breach in a system managing access to a storage, the computer program product comprising a computer readable storage medium having computer readable program code embodied therein that when executed performs operations, the operations comprising:

monitoring a process Input/Output (I/O) rate of a process accessing data in a storage;

determining a peak I/O rate, comprising historical I/O activity of the data, during a time period during which an I/O rate of the data accessed by the process was a highest I/O rate;

determining whether the process I/O rate exceeds the peak I/O rate by a threshold;

characterizing the process as a suspicious process in response to determining that the process I/O rate exceeds the peak I/O rate by the threshold; and

indicating a security breach in response to characterizing the process as the suspicious process.

3. The computer program product of claim 2 , wherein the peak I/O rate comprises an average peak I/O rate of peak I/O rates measured during samples of the time period, wherein determining the peak I/O rate comprises determining a standard deviation of the peak I/O rates during the samples of the time period, wherein the threshold comprises a predetermined number of the standard deviation, wherein the threshold is exceeded in response to determining that the process I/O rate exceeds the peak I/O rate by the predetermined number of the standard deviation.

4. The computer program product of claim 2 , wherein the historical I/O activity comprises peak I/O rates during a plurality of time periods, wherein a peak I/O rate during each time period comprises a highest I/O rate for the time period, and wherein the determining whether the process I/O activity exceeds the peak I/O rate by the threshold comprises:

determining one of the time periods during which the process I/O activity was occurring; and

determining the peak I/O rate during the determined time period of the plurality of time periods during which the I/O activity was occurring, wherein the determining whether the process I/O rate exceeds the peak I/O rate by a threshold comprises determining whether the process I/O rate exceeds the determined peak I/O rate during the determined time period by the threshold.

5. The computer program product of claim 4 , wherein the peak I/O rate for each of the time periods comprises and average peak I/O rate of peak I/O rates measured during different samples of the time period, wherein the operations further comprise:

determining, for each of the time periods, a standard deviation of the peak I/O rate for the time period measured at different samples of the time period, wherein the determining whether the process I/O rate exceeds the peak I/O rate by the threshold comprises determining whether the process I/O rate exceeds the peak I/O rate by a predetermined number of the standard deviation for the time period during which the I/O activity was occurring, and wherein the threshold is exceeded in response to determining that the process I/O rate exceeds the peak I/O rate by the predetermined number of the standard deviation for the time period.

6. A system detecting a security breach in a system managing access to a storage, comprising:

a processor; and

a computer readable storage medium having computer readable program code that when executed by the processor performs operations, the operations comprising:

monitoring process Input/Output (I/O) activity of a process accessing data in a storage;

determining a peak I/O rate during a time period which an I/O rate of data access was a highest I/O rate;

determining a timestamp of when the data was last accessed;

characterizing the process initiating the I/O activity as a suspicious process in response to determining a process I/O rate of the process I/O activity as compared to the peak I/O rate of the data satisfies a first condition and a process access time at which the process is accessing the data as compared to the timestamp satisfies a second condition; and

indicating a security breach in response to characterizing the process as the suspicious process.

7. A system detecting a security breach in a system managing access to a storage, comprising:

a processor; and

a computer readable storage medium having computer readable program code that when executed by the processor performs operations, the operations comprising:

monitoring a process Input/Output (I/O) rate for a process accessing data in a storage;

determining a peak I/O rate, comprising historical I/O activity of the data, during a time period during which an I/O rate of the data accessed by the process was a highest I/O rate;

determining whether the process I/O rate exceeds the peak I/O rate by a threshold;

characterizing the process as a suspicious process in response to determining that the process I/O rate exceeds the peak I/O rate by the threshold; and

indicating a security breach in response to characterizing the process as the suspicious process.

8. The system of claim 7 , wherein the peak I/O rate comprises an average peak I/O rate of peak I/O rates measured during samples of the time period, wherein determining the peak I/O rate comprises determining a standard deviation of the peak I/O rates during the samples of the time period, wherein the threshold comprises a predetermined number of the standard deviation, wherein the threshold is exceeded in response to determining that the process I/O rate exceeds the peak I/O rate by the predetermined number of the standard deviation.

9. The system of claim 7 , wherein the historical I/O activity comprises peak I/O rates during a plurality of time periods, wherein a peak I/O rate during each time period comprises a highest I/O rate for the time period, and wherein the determining whether the process I/O activity exceeds the peak I/O rate by the threshold comprises:

determining one of the time periods during which the process I/O activity was occurring; and

determining the peak I/O rate during the determined time period of the plurality of time periods during which the I/O activity was occurring, wherein the determining whether the process I/O rate exceeds the peak I/O rate by a threshold comprises determining whether the process I/O rate exceeds the determined peak I/O rate during the determined time period by the threshold.

10. A method for detecting a security breach in a system managing access to a storage, comprising:

monitoring process Input/Output (I/O) activity of a process accessing data in a storage;

determining a peak I/O rate during a time period which an I/O rate of data access was a highest I/O rate;

determining a timestamp of when the data was last accessed;

characterizing the process initiating the I/O activity as a suspicious process in response to determining a process I/O rate of the process I/O activity as compared to the peak I/O rate of the data satisfies a first condition and a process access time at which the process is accessing the data as compared to the timestamp satisfies a second condition; and

indicating a security breach in response to characterizing the process as the suspicious process.

11. A method for detecting a security breach in a system managing access to a storage, comprising:

monitoring a process Input/Output (I/O) rate of a process accessing data in a storage;

determining a peak I/O rate, comprising historical I/O activity of the data, during a time period during which an I/O rate of the data accessed by the process was a highest I/O rate;

determining whether the process I/O rate exceeds the peak I/O rate by a threshold;

characterizing the process as a suspicious process in response to determining that the process I/O rate exceeds the peak I/O rate by the threshold; and

indicating a security breach in response to characterizing the process as the suspicious process.

12. The method of claim 11 , wherein the peak I/O rate comprises an average peak I/O rate of peak I/O rates measured during samples of the time period, wherein determining the peak I/O rate comprises determining a standard deviation of the peak I/O rates during the samples of the time period, wherein the threshold comprises a predetermined number of the standard deviation, wherein the threshold is exceeded in response to determining that the process I/O rate exceeds the peak I/O rate by the predetermined number of the standard deviation.

13. The method of claim 11 , wherein the historical I/O activity comprises peak I/O rates during a plurality of time periods, wherein a peak I/O rate during each time period comprises a highest I/O rate for the time period, and wherein the determining whether the process I/O activity exceeds the peak I/O rate by the threshold comprises:

determining one of the time periods during which the process I/O activity was occurring; and

determining the peak I/O rate during the determined time period of the plurality of time periods during which the I/O activity was occurring, wherein the determining whether the process I/O rate exceeds the peak I/O rate by a threshold comprises determining whether the process I/O rate exceeds the determined peak I/O rate during the determined time period by the threshold.