Embodiments of the present disclosure relate to autonomous data protection. One or more input/output (I/O) streams can be received by one or more storage devices. One or more snapshots of each storage device can be obtained. One or more anomalies can be identified based on a change rate corresponding to each storage device's memory allocated to store user data included in the I/O streams.