Method and device for detecting malicious USB equipment

Abstract

The invention discloses a method and a device for detecting malicious USB equipment. The method comprises the steps as follows: white list configuration is carried out on a USB port of primary equipment, wherein a white list comprises access-allowed equipment types and execution-allowed operations of the equipment types; known hardware and firmware with a security threat are analyzed; feature information is extracted and stored into a black list; when the condition that the USB equipment is accessed to the primary equipment is monitored and found, the equipment type is identified and the operation behavior is recorded; the equipment type and the operation behavior are matched with those in the white list; processing operation is carried out on the basis of the matching result; hardware information of the USB equipment is obtained and comprises main control chip information, firmware version information or storage chip information; the hardware information is matched with that in the black list; and the processing operation is carried out on the basis of the matching result. According to the technical scheme, the USB equipment for implementing an attack by known hardware bug and firmware bug can be effectively identified.

Description

technical field [0001] The invention relates to the technical field of information security, in particular to a detection method and device for a malicious USB device. Background technique [0002] Thanks to the rapid development of processor technology, mobile storage technology, and network communication technology, hardware equipment has begun to move towards the direction of diversified functions and standardized interfaces. As an external bus standard, USB is most widely used in connection and communication between various devices. Due to the standardization and versatility of the USB bus, it has also become the main medium of malicious code transmission and the main means of malicious attacks. [0003] The traditional method of using USB devices to attack is generally realized by infecting the user storage area of ​​USB devices. Nowadays, with the development of anti-virus technology and the improvement of emergency response capabilities, the way of using traditional...

AI Technical Summary

Problems solved by technology

The first attack method may occur on any general-purpose USB device. The infected device cannot be found by the user as a general-purpose USB device, and the traditional virus scanning mechanism cannot detect the malicious code hidden in it, so it is extremely threatening

Although the second method is a self-made special device, its own hidden ability is weak, but the traditional virus scanning mechanism is also unable to detect

Images