Publication

Abstract :

Malicious USB devices, such as Rubber Ducky and BadUSB, abuse the implicit trust of operating systems in Human Interface Devices (HIDs) to perform keystroke injection attacks without users' knowledge. These devices masquerade as normal peripherals, sending commands at high rates and completing payloads in seconds, far quicker than manual execution, which takes at least a minute. Because of the speed of execution, these devices are effective in privilege escalation, data exfiltration, credential theft, and system compromise with minimal user interaction. In this paper, we introduce a defensive tool that detects and blocks malicious HID-based attacks in real time. Our tool provides layers of defense, including behavior-based keystroke tracking, program blacklisting, and AutoType integration, to distinguish between authorized and unauthorized inputs. The tool enforces security policies to limit suspicious USB activity and block unauthorized essential system commands. This paper dis- cusses the architecture, implementation, and performance of the tool in addressing real-world scenarios. Additionally, this work discusses flexibility to evolving attack strategies and suggests future improvements in the context of USB security. Given this strong defense against keystroke injections, this work strengthens endpoint security and reduces the threat from malicious USB devices. Evaluations on 50 simulated attacks yielded a detection rate of more than 90%, false positives of less than 5%, detection latency of less than 15 ms, and blocking success of the payload above 85%, with minimal overhead less than 3.5% CPU. © 2026 IEEE.