my (%current, %previous);
while (1)
{
   open PS, "ps -ef |" or die "Can't run ps: $!\n";
   while (<PS>)
   {
        # you need to do this with the correct column
        # widths; something like split won't work,
        # and a regex would be way too complicated.
        my ($pid, $time) = unpack '...';
        $current{$pid} = $time;
        if (exists $previous($pid})
        {
            # difference sub is an exercise for the reader....
            if (difference($current{$pid}, $previous{$pid}
                >= $threshold)
            {
                 warn "$pid is a piggy\n";
            }
        }
    }
    close PS;
    %previous = %current;
    sleep 3600;
}