Using a characteristic of a process input/output (i/o) activity and data subject to the i/o activity to determine whether the process is a suspicious process

A computer program product for detecting a security breach in a system managing access to a storage, the computer program product comprising a computer readable storage medium having computer readable program code embodied therein that when executed performs operations, the operations comprising:

• monitoring Input/Output (I/O) activity by a process accessing data in a storage;
• determining a characteristic of the data subject to the I/O activity from the process;
• determining whether a characteristic of the I/O activity as compared to the characteristic of the data satisfies a condition;
• characterizing the process as a suspicious process in response to determining that the condition is satisfied;
• and
• indicating a security breach in response to characterizing the process as the suspicious process.

A system detecting a security breach in a system managing access to a storage, comprising:

• a processor;
• and
• a computer readable storage medium having computer readable program code that when executed by the processor performs operations, the operations comprising:
• monitoring Input/Output (I/O) activity by a process accessing data in a storage;
• determining a characteristic of the data subject to the I/O activity from the process;
• determining whether a characteristic of the I/O activity as compared to the characteristic of the data satisfies a condition;
• characterizing the process as a suspicious process in response to determining that the condition is satisfied;
• and
• indicating a security breach in response to characterizing the process as the suspicious process.

A method for detecting a security breach in a system managing access to a storage, comprising:

• monitoring Input/Output (I/O) activity by a process accessing data in a storage;
• determining a characteristic of the data subject to the I/O activity from the process;
• determining whether a characteristic of the I/O activity as compared to the characteristic of the data satisfies a condition;
• characterizing the process as a suspicious process in response to determining that the condition is satisfied;
• and
• indicating a security breach in response to characterizing the process as the suspicious process.