A method, a system and an apparatus for predicting abnormalities are provided. A controller analyzes a plurality of command logs to obtain a predictive rule for accessing a storage device. The controller performs an anomaly detection for the command logs based on the predictive rule so as to obtain at least one command cluster. The controller establishes policy data corresponding to the predictive rule based on the command logs included in each command cluster, and sends the policy data to a data transmission interface coupled to the storage device. The data transmission interface obtains a processing action for a received data access command according to the policy data.