Method, device and equipment for preventing malicious USB (Universal Serial Bus) HID (Human Interface Device) equipment from attacking computer

Abstract

The invention relates to a method, device and equipment for preventing a malicious USB HID device from attacking a computer and a storage medium, the method is applied to the device for preventing the malicious USB HID device from attacking the computer, the device is in communication connection with the computer, and the method comprises the steps that whether the equipment connected to the device is the USB HID device or not is detected, and if the equipment connected to the device is the USB HID device, the USB HID device is connected to the device; if yes, a sandbox is started to detect whether the USB HID equipment is malicious equipment or not, and if it is detected that the USB HID equipment is malicious equipment, the USB HID equipment is forbidden to send an instruction to the computer. According to the method, malicious USB equipment can be prevented from communicating with the computer, normal USB equipment can be released from communicating with the computer, the computer does not need to be configured additionally, software does not need to be installed additionally, Windows and Linux computer systems are supported, the universality is high, and the computer can have the capacity of preventing malicious USB HID equipment attacks.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a method, apparatus, device and storage medium for preventing malicious USB HID devices from attacking a computer. Background Art

[0002] Currently, in the field of computer security, there are many ways to use malicious USB devices to launch security attacks on computers. For example, the automatic play function of the computer system is used to automatically run malicious programs stored on the USB flash drive when the USB memory (U disk) is inserted into the computer. This type of attack can be mitigated by disabling the automatic play function. When the U disk is inserted into the computer, the antivirus software will also scan the files on the U disk, detect malicious programs and block them.

[0003] However, there is a new type of attack method, which is to use a USB device with a programmable microcontroller and a malicious program. Its appearance is disguised as a USB flash drive, and the microcontroller is used inside to define itself as a HID (Human Interface Device) keyboard. After the malicious USB HID device is inserted into the computer, the computer recognizes it as a HID standard keyboard. At this time, the antivirus software will not scan the malicious device and prevent its subsequent behavior like a USB flash drive. After the malicious device is connected to the computer, the malicious device executes its internal malicious program, simulates the keyboard to send key commands to the computer, and the computer system receives the key commands and responds, thereby executing malicious commands, such as calling the command line terminal to execute the attack command. For this attack of a malicious USB HID device disguised as a USB flash drive, there is currently no better identification method. The reason is that the computer recognizes it as a keyboard and believes that the key commands it issues are issued by manually operating the keyboard. This attack method is applicable to both Windows and Linux systems, with a wide range of impact and a high degree of harm.

[0004] Therefore, how to prevent malicious USB HID devices from attacking computers has become a technical problem that needs to be solved urgently by those skilled in the art. Summary of the invention

[0005] In view of the above, the present application provides a method, apparatus, device and storage medium for preventing malicious USB HID devices from attacking a computer, the purpose of which is to solve the above technical problems.

[0006] In a first aspect, the present application provides a method for preventing a malicious USB HID device from attacking a computer, which is applied to an apparatus for preventing a malicious USB HID device from attacking a computer, wherein the apparatus is communicatively connected to a computer, and the method comprises:

[0007] Detecting whether the device connected to the apparatus is a USB HID device;

[0008] If yes, start the sandbox to detect whether the USB HID device is a malicious device;

[0009] If the USB HID device is detected as a malicious device, the USB HID device is prohibited from sending instructions to the computer.

[0010] In a second aspect, the present application provides an apparatus for preventing a malicious USB HID device from attacking a computer, wherein the apparatus includes a unit for implementing the above method for preventing a malicious USB HID device from attacking a computer.

[0011] In a third aspect, the present application provides an electronic device, including a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other via the communication bus;

[0012] Memory, used to store programs;

[0013] The processor is used to implement the method of preventing a malicious USB HID device from attacking a computer as described in any one of the embodiments of the first aspect when executing a program stored in the memory.

[0014] In a fourth aspect, a computer-readable storage medium is provided, on which a program is stored. When the program is executed by a processor, the method for preventing a malicious USB HID device from attacking a computer as described in any embodiment of the first aspect is implemented.

[0015] The above technical solution provided by the embodiment of the present application has the following advantages compared with the prior art:

[0016] The present application can identify and detect a USB device connected to a computer. If the connected device is detected to be a USB HID device, a sandbox is started to detect whether the USB HID device is a malicious device. If the USB HID device is detected to be a malicious device, the USB HID device is prohibited from sending instructions to the computer, thereby preventing the malicious USB device from communicating with the computer and allowing normal USB devices to communicate with the computer. The computer does not need to be additionally configured or additionally installed with software. The application supports Windows and Linux computer systems and has strong versatility, so that the computer can have the ability to prevent attacks by malicious USB HID devices. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0018] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0019] Figure 1 A flowchart of an embodiment of a method for preventing a malicious USB HID device from attacking a computer according to the present application;

[0020] Figure 2 A schematic diagram of a module of an embodiment of a device for preventing a malicious USB HID device from attacking a computer according to the present application;

[0021] Figure 3 A schematic diagram of an electronic device embodiment of the present application;

[0022] The realization of the purpose, functional features and advantages of this application will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0023] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.

[0024] The disclosure below provides many different embodiments or examples to realize the different structures of the present application. In order to simplify the disclosure of the present application, the parts and settings of specific examples are described below. Of course, they are only examples, and the purpose is not to limit the present application. In addition, the present application can repeat reference numbers and / or letters in different examples. This repetition is for the purpose of simplification and clarity, and does not itself indicate the relationship between the various embodiments and / or settings discussed.

[0025] The present application provides a method for preventing malicious USB HID devices from attacking a computer. Figure 1 , which is a method flow chart of an embodiment of the method for preventing malicious USB HID devices from attacking a computer. The method can be executed by a device for preventing malicious USB HID devices from attacking a computer, and the device can be implemented by software and / or hardware. The method for preventing malicious USB HID devices from attacking a computer includes:

[0026] Step S10: Detect whether the device connected to the apparatus is a USB HID device;

[0027] Step S20: If yes, start the sandbox to detect whether the USB HID device is a malicious device;

[0028] Step S30: If the USB HID device is detected as a malicious device, the USB HID device is prohibited from sending instructions to the computer.

[0029] In this embodiment, a device for preventing malicious USB HID devices (Universal Serial Bus-Human Interface Device, a device that directly interacts with people) from attacking a computer is used as a transfer station for connecting various USB devices to be detected to the computer. The device is connected to the USB interface of the computer through a cable upward, and provides multiple USB ports downward for other USB devices to be detected to be connected. The USB devices to be detected can be U disks, keyboards, mice, etc. The device can identify and detect the connected USB devices, thereby preventing malicious USB devices from communicating with the computer and allowing normal USB devices to communicate with the computer, so that the computer does not need to be additionally configured or installed with additional software. The device supports Windows and Linux computer systems and has strong versatility. When the device is connected to the USB interface of a computer, the computer can have the ability to prevent attacks by malicious USB HID devices.

[0030] Optionally, the external hardware interface of the device is 3 USB interfaces for connecting to the USB device to be detected. The device may also include 1 toggle switch, 1 confirmation button, a working status indicator light and 1 alarm indicator light. The toggle switch is used to switch between manual working mode and automatic working mode. The confirmation button is used to confirm whether the connected USB device is a keyboard in manual working mode. The working status indicator light is used to indicate the working status of the device. The alarm indicator light is used to indicate the type of the connected USB device. For example, when the alarm indicator light flashes, it indicates that the connected USB device is a malicious device.

[0031] The device can automatically identify the type of USB device connected, such as USB memory, USB HID device, etc. When a USB device is connected to the device, the device will automatically detect whether the connected device is a USB HID device. If the connected device is a USB HID device, the sandbox is started to detect whether the connected USB HID device is a malicious device. Sandbox is a security mechanism used to isolate and test untrusted or potentially harmful programs or codes. The sandbox can monitor and analyze the connected USB HID device to detect whether it is a malicious device. If the USB HID device connected to the device is detected to be a malicious device, the USB HID device is prohibited from sending instructions to the computer. If the USB HID device connected to the device is detected to be a non-malicious device, the USB HID device is allowed to send instructions to the computer. In addition, the device can also record information such as USB device access events, suspicious USB device behaviors, and suspicious keyboard key commands.

[0032] By starting the sandbox to detect the connected USB HID device, it can be determined whether the connected USB HID device is a malicious device, solving the problem that the computer antivirus software cannot identify and prevent the malicious USB device from disguising itself as a USB memory to attack the computer security. The device is easy to use and plug-and-play. The computer does not need to make additional configurations or install additional software. It has high security. When the USB device is connected, the sandbox is started first to take over, ensuring the security of the device itself and the computer.

[0033] In one embodiment, the starting sandbox detects whether the USB HID device is a malicious device, including:

[0034] The current working mode of the apparatus is determined, a sandbox is started, and based on the working mode, whether the USB HID device is a malicious device is detected.

[0035] The user can switch the device's working mode through the device's switch. In the manual working mode, the device will start the sandbox and detect whether the USB HID device is a malicious device in combination with the user's confirmation command. In the automatic working mode, the device can complete automatic detection without the user's confirmation command.

[0036] Furthermore, the above step of “starting the sandbox and detecting whether the USB HID device is a malicious device based on the working mode” specifically includes:

[0037] If the current working mode of the device is the manual mode, start the sandbox and detect whether the USB HID device is a malicious device based on the instruction issued by the confirmation button of the device;

[0038] If the current working mode of the device is the automatic mode, the sandbox is started and based on the instruction sent by the USB HID device, whether the USB HID device is a malicious device is detected.

[0039] If the current working mode of the device is manual mode, after the USB HID device is connected, the device's sandbox will take over the device. The user can manually press the confirmation button of the device to indicate that the USB HID device is not a malicious device. After the device receives the confirmation command, it will allow the USB HID device to connect to the computer. If the current working mode of the device is automatic mode, after the USB HID device is connected, the device's sandbox will also take over the device. When the USB HID device issues a command, the device automatically analyzes the command to determine whether the USB HID device is a malicious device. The connected USB HID device can be detected in both working modes.

[0040] Further, the detecting whether the USB HID device is a malicious device based on the instruction received by the device includes:

[0041] Intercepting the command sent by the USB HID device;

[0042] Whether the USB HID device is a malicious device is detected through the instruction sent by the USB HID device.

[0043] When the USB HID device type is a HID keyboard, the instructions issued by the keyboard keys will be intercepted and recorded by the sandbox, and the device's own operating system will not respond to these instructions, ensuring that the device itself will not be affected by the instructions and these instructions cannot reach the computer. For example, suppose there is a malicious USB HID device that looks like a USB flash drive, and its internal programmable controller defines itself as a HID keyboard. After the device is connected to this device, it is very easy to confirm that it is not a keyboard due to its appearance, so the user will not manually press the confirmation button, that is, the device will not receive the user's confirmation command. At this time, the key commands issued by the USBHID device to attack the computer will be intercepted by the sandbox, thereby protecting the computer.

[0044] Further, the detecting whether the USB HID device is a malicious device through the instruction issued by the USB HID device includes:

[0045] determining whether the apparatus receives a command issued by the USB HID device before receiving a confirmation command issued by the user through the apparatus;

[0046] If so, the USB HID device is detected as a malicious device.

[0047] If the USB HID device type is a HID keyboard, when the device recognizes that the HID keyboard is connected, if the sandbox has received the key command issued by the USB HID keyboard before the device has received the command issued by the user through the confirmation button, it means that the command is a suspicious keyboard key command, and the USB HID device can be judged as a malicious device.

[0048] Further, the detecting whether the USB HID device is a malicious device based on the instruction received by the device includes:

[0049] Determining whether a confirmation instruction issued by a user through the device is received within a preset time period;

[0050] If not, the USB HID device is detected as a malicious device.

[0051] For malicious HID devices disguised as USB storage devices, it is very easy for the naked eye to identify that the malicious device is not a normal keyboard, so the user will not press the confirmation key, and the malicious device cannot connect to the computer. Therefore, when the device recognizes that a USB HID device is connected and has not received a confirmation instruction from the user through the confirmation button within a period of time, the USB HID device can also be determined to be a malicious device. It is understandable that the preset time period can be set according to actual needs and is not specifically limited here.

[0052] Further, after detecting that the USB HID device is a malicious device, the method further includes:

[0053] The warning indicator light of the control device flashes.

[0054] After detecting that the USB HID device is a malicious device, the alarm indicator light of the control device can be flashed to remind the user that the device is suspected of being a malicious device. The alarm indicator light of the device can also be controlled to be always on to remind the user that the device is suspected of being a malicious device.

[0055] In one embodiment, the method further comprises:

[0056] If the USB HID device is detected to be a legal device, the USB HID device is allowed to connect to the computer and send instructions to the computer.

[0057] If the USB HID device is detected as a legitimate device, the device is removed from the sandbox, allowing the device to connect to the computer and send commands to the computer.

[0058] In one embodiment, the detecting whether the device connected to the apparatus is a USB HID device further includes:

[0059] If it is detected that the device connected to the device is not a USB HID device, but a USB memory;

[0060] The USB memory is allowed to connect to the computer.

[0061] When the device recognizes that the connected USB device is not a HID keyboard but a USB memory, the USB memory is removed from the sandbox and the USB memory is allowed to connect to the computer. In other embodiments, the files stored in the USB memory can also be scanned to determine whether there are malicious programs stored in the USB memory. If there are no malicious programs, the connection to the computer is allowed.

[0062] In one embodiment, the step of “detecting whether the USB HID device is a malicious device based on the instruction issued by the USB HID device” specifically includes:

[0063] Analyzing whether the instruction issued by the USB HID device is a malicious instruction through a pre-configured analysis model;

[0064] If so, the USB HID device is detected as a malicious device.

[0065] In the automatic working mode, the pre-configured analysis model can be used to analyze whether the instructions issued by the USB HID device are malicious instructions. The analysis model can be trained using a convolutional neural network. Even if the appearance of the malicious USB device is not disguised as a USB flash drive, but is modified using a real keyboard, if the malicious device has a programmable controller inside that sends key instructions for malicious attacks, the built-in analysis model of the device can also detect whether the key instructions are malicious instructions. If the instructions issued by the USB HID device are malicious instructions, the USB HID device is judged to be a malicious device.

[0066] Further, the analyzing whether the instruction issued by the USB HID device is a malicious instruction by using a pre-configured analysis model includes:

[0067] Extracting characteristic information of the instruction issued by the USB HID device;

[0068] Analyzing the characteristic information using the analysis model to obtain an analysis result of the instruction issued by the USB HID device;

[0069] According to the probability represented by the analysis result, it is determined whether the instruction issued by the USB HID device is a malicious instruction.

[0070] The feature extraction network of the analysis model can extract feature information of the command issued by the USB HID device. The feature extraction network can be a network composed of multiple convolutional layers. Since malicious commands may send a large number of key commands in a short period of time, the frequency of the malicious commands is usually different from that of normal key commands. Malicious commands may repeatedly send the same key sequence, while normal key commands usually do not. Therefore, the analysis model can obtain the probability of characterizing normal commands and malicious commands based on these feature information of malicious commands and normal commands, thereby determining whether the command issued by the USB HID device is a normal command issued by human use or a malicious command issued by a malicious program built into the USB HID device.

[0071] Furthermore, the training step of the analysis model includes:

[0072] Obtain a preset number of sample instructions and label each sample instruction;

[0073] Take each sample instruction as an independent variable and the label corresponding to each sample instruction as a dependent variable to generate a sample set;

[0074] Input each sample in the sample set into a pre-built neural network model to obtain a predicted category of each sample instruction in the sample set;

[0075] Reading the true category of each sample in the sample set based on the label of each sample in the sample set;

[0076] By minimizing the loss value between the predicted category and the true category, the structural parameters of the neural network model are determined to obtain a trained analysis model.

[0077] The neural network model can be a convolutional neural network, a recurrent neural network, or a long short-term memory neural network. The convolutional neural network has no concept of time series, and it recognizes the features in the sample as a whole. The recurrent neural network has the concept of time series, and it can associate each behavior in the time series data for recognition, while the long short-term memory neural network also has a good recognition effect on longer time series data. The sample instructions include normal sample instructions and malicious sample instructions. The loss value between the predicted category and the true category can be calculated using the cross entropy loss function.

[0078] Furthermore, the step of obtaining a preset number of sample instructions and labeling each sample instruction includes:

[0079] Acquire a first number of normal sample instructions, and label each normal sample instruction with a label of a normal instruction;

[0080] A second number of malicious sample instructions are obtained, and a label of the malicious instruction is marked for each malicious sample instruction.

[0081] The ratio of the first number to the second number may be 1:1. Malicious instructions need to be generated by simulation software, so the number of malicious sample instructions may be relatively scarce. Therefore, the ratio of the first number to the second number may also be 3:1. A normal instruction label is marked for each normal sample instruction, for example, marked as 1. A malicious instruction label is marked for each malicious sample instruction, for example, marked as 0. Thus, a sample set for training can be generated.

[0082] Reference Figure 2 , which is a schematic diagram of the functional modules of the device for preventing malicious USB HID devices from attacking a computer according to the present application.

[0083] According to the implemented functions, the apparatus for preventing malicious USB HID devices from attacking a computer may include a first detection unit 110, a second detection unit 120, and a control unit 130. The unit described in the present application may also be referred to as a module. In other embodiments, a module or a unit may also refer to a series of program segments that can be executed by an electronic device processor and can complete a fixed function.

[0084] In this embodiment, the functions of each module / unit are as follows:

[0085] The first detection unit 110 is used to detect whether the device connected to the apparatus is a USB HID device;

[0086] The second detection unit 120 is used for starting a sandbox to detect whether the USB HID device is a malicious device if the device connected to the apparatus is a USB HID device;

[0087] The control unit 130 is configured to prohibit the USB HID device from sending instructions to the computer if the USB HID device is detected to be a malicious device.

[0088] Reference Figure 3 , which is a schematic diagram of a preferred embodiment of the electronic device of the present application.

[0089] The electronic device includes a processor 111, a communication interface 112, a memory 113 and a communication bus 114, wherein the processor 111, the communication interface 112, and the memory 113 communicate with each other via the communication bus 114;

[0090] The memory 113 is used to store programs, for example, programs for preventing malicious USB HID devices from attacking the computer;

[0091] In some embodiments, the processor 111 may be a central processing unit (CPU), a controller, a microcontroller, a microprocessor, or other data processing chips. The processor 111 is generally used to control the overall operation of the electronic device, such as performing control and processing related to data interaction or communication. In this embodiment, the processor 111 is used to run the program code stored in the memory 113 or process data, such as running the program code of a program that prevents malicious USB HID devices from attacking a computer.

[0092] The communication interface 112 may optionally include a standard wired interface, a wireless interface (such as a WI-FI interface), and the communication interface 112 may also be used to establish a communication connection between the electronic device and other electronic devices.

[0093] The memory 113 includes at least one type of readable storage medium, and the readable storage medium includes flash memory, hard disk, multimedia card, card-type memory (for example, SD or DX memory, etc.), random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), etc.

[0094] Figure 3 Only an electronic device having components 111 - 114 is shown, but it is understood that implementing all of the components shown is not a requirement, and more or fewer components may alternatively be implemented.

[0095] In one embodiment of the present application, the processor 111 is used to execute the program stored in the memory 113 to implement the method for preventing a malicious USB HID device from attacking a computer provided by any of the aforementioned method embodiments, including:

[0096] Detecting whether the device connected to the apparatus is a USB HID device;

[0097] If yes, start the sandbox to detect whether the USB HID device is a malicious device;

[0098] If the USB HID device is detected as a malicious device, the USB HID device is prohibited from sending instructions to the computer.

[0099] For a detailed description of the above steps, please refer to the above Figure 1 An illustration of a flow chart of an embodiment of a method for preventing malicious USB HID devices from attacking a computer.

[0100] In addition, the embodiment of the present application also proposes a computer-readable storage medium, which may be non-volatile or volatile. The computer-readable storage medium includes a data storage area and a program storage area, and the program storage area stores a program for preventing malicious USB HID devices from attacking a computer. When the program for preventing malicious USB HID devices from attacking a computer is executed by a processor, the following operations are implemented:

[0101] Detecting whether the device connected to the apparatus is a USB HID device;

[0102] If yes, start the sandbox to detect whether the USB HID device is a malicious device;

[0103] If the USB HID device is detected as a malicious device, the USB HID device is prohibited from sending instructions to the computer.

[0104] The specific implementation of the computer-readable storage medium of the present application is substantially the same as the specific implementation of the method for preventing malicious USB HID devices from attacking a computer, and will not be described in detail herein.

[0105] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0106] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a general hardware platform, and of course, by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the relevant technology can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0107] It should be noted that the descriptions involving "first", "second", etc. in this application are only for descriptive purposes and cannot be understood as indicating or implying their relative importance or implicitly indicating the number of technical features indicated. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In addition, the technical solutions between the various embodiments can be combined with each other, but they must be based on the ability of ordinary technicians in this field to implement them. When the combination of technical solutions is contradictory or cannot be implemented, it should be deemed that such combination of technical solutions does not exist and is not within the scope of protection required by this application.

[0108] It should be understood that the terms used in the text are only for the purpose of describing specific example embodiments, and are not intended to be limiting. Unless the context clearly indicates otherwise, the singular forms "one", "an" and "said" as used in the text may also be meant to include plural forms. The terms "include", "comprise", "contain", and "have" are inclusive, and therefore specify the existence of stated features, steps, operations, elements and / or parts, but do not exclude the existence or addition of one or more other features, steps, operations, elements, parts, and / or combinations thereof. The method steps, processes, and operations described herein are not interpreted as necessarily requiring them to be performed in the specific order described or illustrated, unless the execution order is clearly indicated. It should also be understood that additional or alternative steps may be used.

[0109] The above description is only a specific implementation of the present application, so that those skilled in the art can understand or implement the present application. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein can be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to the embodiments shown herein, but will conform to the widest range consistent with the principles and novel features applied for herein.

Claims

1. A method for preventing malicious USB HID devices from attacking a computer, characterized in that: A device for preventing malicious USBHID devices from attacking a computer, wherein the device is communicatively connected to the computer, and the method comprises: Detecting whether the device connected to the apparatus is a USB HID device; If yes, start the sandbox to detect whether the USB HID device is a malicious device; If the USB HID device is detected as a malicious device, the USB HID device is prohibited from sending instructions to the computer.

2. The method for preventing malicious USB HID devices from attacking a computer as claimed in claim 1, characterized in that: The starting sandbox detects whether the USB HID device is a malicious device, including: The current working mode of the apparatus is determined, a sandbox is started, and based on the working mode, whether the USB HID device is a malicious device is detected.

3. The method for preventing malicious USB HID devices from attacking a computer as claimed in claim 2, characterized in that: The starting the sandbox and detecting whether the USB HID device is a malicious device based on the working mode includes: If the current working mode of the device is the manual mode, start the sandbox and detect whether the USB HID device is a malicious device based on the instruction issued by the confirmation button of the device; If the current working mode of the device is the automatic mode, the sandbox is started and based on the instruction sent by the USB HID device, whether the USB HID device is a malicious device is detected.

4. The method for preventing malicious USB HID devices from attacking a computer as claimed in claim 3, characterized in that: The detecting whether the USB HID device is a malicious device based on the instruction received by the device includes: Intercepting the command issued by the USB HID device; Whether the USB HID device is a malicious device is detected through the instruction sent by the USB HID device.

5. The method for preventing malicious USB HID devices from attacking a computer as claimed in claim 4, characterized in that: The detecting, by means of an instruction issued by the USB HID device, whether the USB HID device is a malicious device comprises: Determining whether the device receives a command issued by the USBHID device before receiving a confirmation command issued by the user through the device; If so, the USB HID device is detected as a malicious device.

6. The method for preventing malicious USB HID devices from attacking a computer as claimed in claim 3, characterized in that: The detecting whether the USB HID device is a malicious device based on the instruction received by the device includes: Determining whether a confirmation instruction issued by a user through the device is received within a preset time period; If not, the USB HID device is detected as a malicious device.

7. The method for preventing malicious USB HID devices from attacking a computer as claimed in claim 3, characterized in that: The detecting, based on the instruction issued by the USB HID device, whether the USB HID device is a malicious device comprises: Analyzing whether the instruction issued by the USB HID device is a malicious instruction through a pre-configured analysis model; If so, the USB HID device is detected as a malicious device.

8. A device for preventing malicious USB HID devices from attacking a computer, characterized in that: The device comprises a unit for implementing the method for preventing malicious USB HID devices from attacking a computer according to any one of claims 1 to 7.

9. An electronic device, characterized in that: It includes a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other through the communication bus; Memory, used to store programs; The processor is used to implement the method for preventing a malicious USB HID device from attacking a computer as described in any one of claims 1 to 7 when executing a program stored in the memory.

10. A computer-readable storage medium having a program stored thereon, characterized in that: When the program is executed by a processor, the method for preventing a malicious USB HID device from attacking a computer according to any one of claims 1 to 7 is implemented.

Images