Detection, isolation, and mitigation of attacks on a file system

A data processing system, comprising:

• a processor;
• and
• a storage device coupled to the processor, wherein the storage device includes program code executable by the processor core that causes the data processing system to perform:
• establishing a plurality of time-based file access limits for a user ID, wherein all of the plurality of time-based file access limits are concurrently applicable to file access requests associated with the user ID;
• detecting an abnormal file system access pattern to a file system by applying statistical process control to network layer packets communicating file access requests, wherein applying statistical process control includes:
• comparing a number of file access requests by the user ID observed in an observation interval to the plurality of time-based file access limits, wherein the plurality of time-based file access limits including at least one of the following set:
• a first file access limit based on periodicity of file access requests;
• and
• a second file access limit based on age of accessed files;
• based on the comparing, generating an event based on each time-based file access limit that is satisfied;
• based on one or more events, detecting the abnormal file system access pattern;
• and
• initiating an action based on detection of the abnormal file system access pattern.

A program product, comprising:

• a storage device;
• and
• program code, stored within the storage device, which when executed by a processor of a data processing system serving a source host causes the data processing system to perform:
• establishing a plurality of time-based file access limits for a user ID, wherein all of the plurality of time-based file access limits are concurrently applicable to file access requests associated with the user ID;
• detecting an abnormal file system access pattern to a file system by applying statistical process control to network layer packets communicating file access requests, wherein applying statistical process control includes:
• comparing a number of file access requests by the user ID observed in an observation interval to the plurality of time-based file access limits, wherein the plurality of time-based file access limits including at least one of the following set:
• a first file access limit based on periodicity of file access requests;
• and
• a second file access limit based on age of accessed files;
• based on the comparing, generating an event based on each time-based file access limit that is satisfied;
• based on one or more events, detecting the abnormal file system access pattern;
• and
• initiating an action based on detection of the abnormal file system access pattern.