1. A computer-implemented method for detecting malware on a computing system comprising: receiving a host-level I/O (input/output) log on a computing system; receiving a storage-level I/O log on the computing system; performing an analysis of the host-level I/O log and the storage-level I/O log; and detecting evidence of malware according to the analysis of the host-level I/O log and the storage-level I/O log, wherein the detecting evidence of malware according to the analysis of the host-level I/O log and the storage-level I/O log comprises detecting evidence of malware operational in a storage host, wherein the detecting evidence of malware operational in the storage host comprises detecting differences between the host-level I/O log and the storage-level I/O log, wherein the detecting differences between the host-level I/O log and the storage-level I/O log comprises identifying I/O requests logged at the storage-level I/O log and not logged in the host-level I/O log; and wherein the identifying I/O requests logged at the storage-level I/O log and not logged in the host-level I/O log comprises, for differences between write I/O requests, detecting any difference between the host-level I/O log and the storage-level I/O log.