Vehicle-end malicious BadUSB equipment detection method, device and equipment and medium
By determining the device type based on the HID USB protocol and selecting verification methods, the detection problem of malicious Bad USB devices in the vehicle USB interface is solved, efficient and accurate security detection is achieved, and the security and user experience of the vehicle system are improved.
Patent Information
- Application Number
- CN202510441277.6
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-04-09
- Publication Date
- 2025-08-08
AI Technical Summary
In the prior art, the vehicle USB interface cannot effectively identify and detect malicious Bad USB devices, resulting in potential data breaches and security threats.
By determining the device type based on the HID USB protocol and selecting the corresponding verification method, such as specific character input or graphic drawing, we can identify the type of device to be detected, and determine whether the device is a Bad USB device by calculating the accuracy or coincidence rate.
It improves the detection efficiency and accuracy of malicious Bad USB devices, reduces misjudgments and misjudgments, enhances the safety and user experience of the vehicle system, and has good compatibility and adaptability.
Smart Images
Figure CN120449222A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of vehicle safety detection technology, and in particular to a method, apparatus, device and medium for detecting malicious BadUSB devices on a vehicle. Background Art
[0002] In-car USB (Universal Serial Bus) interfaces bring numerous conveniences and benefits to various in-car interactions. Flexible data transmission, audio and video playback, and other functions are enabled through USB interfaces, improving device performance and stability while significantly enhancing the user experience. Whether it's data transmission, device connectivity, or functional expansion, in-car USB devices offer a convenient and efficient solution.
[0003] However, with the widespread use of USB protocols and interfaces, there are potential risks in the data exchange process between USB devices in vehicles. For example, the vehicle operating system may fail to verify or authenticate the validity of inserted USB devices, resulting in the inability to identify illegal devices such as BadUSB. Alternatively, external devices may be debugged directly without vehicle authentication, allowing external USB flash drives to illegally simulate USB devices such as keyboards and mice, maliciously stealing and leaking user data and forging user commands to the vehicle. Therefore, how to effectively detect malicious BadUSB devices on the vehicle side has become a pressing issue. Summary of the Invention
[0004] The present application provides a vehicle-side malicious BadUSB device detection method, apparatus, device, and medium. By selecting a corresponding verification method based on the device type to verify and judge the device to be detected, the detection efficiency and accuracy are improved. The verification method can be updated to adapt to new types of devices based on the device type, thereby improving the compatibility of detection and meeting the security needs of different users.
[0005] In a first aspect, an embodiment of the present application provides a method for detecting malicious BadUSB devices on a vehicle side, the method comprising:
[0006] Determine the device type of the device to be detected connected to the vehicle based on the HID USB protocol and select the verification method corresponding to the device type;
[0007] Verify the equipment to be tested based on the selected verification method, and summarize the verification process data to obtain the verification results;
[0008] The obtained verification result is analyzed and identified to determine whether the device to be detected is a BadUSB device.
[0009] In conjunction with the first aspect, in one embodiment, determining the device type of the device to be detected connected to the vehicle based on the HID USB protocol and selecting the verification method corresponding to the device type specifically includes:
[0010] Obtain the device to be detected connected to the vehicle, and determine the device type of the device to be detected through the devices and feature keywords in the HID USB protocol and the driver of the device to be detected;
[0011] Select the corresponding verification method based on the device type to be detected.
[0012] In combination with the first aspect, in one implementation, the device to be detected includes a mouse, a keyboard, and a game controller.
[0013] In conjunction with the first aspect, in one embodiment, the corresponding verification method is selected based on the device type of the device to be detected, specifically:
[0014] When the device to be detected is a keyboard, the selected verification method is to input specific characters;
[0015] When the device to be detected is a mouse or a game controller, the selected verification method is to draw a specific graphic.
[0016] In conjunction with the first aspect, in one embodiment, verifying the device to be detected based on the selected verification method and aggregating the verification process data to obtain a verification result specifically includes:
[0017] Operate the equipment to be tested according to the selected verification method to verify the equipment to be tested;
[0018] Based on the identification and summary of the operation results, the verification results are obtained.
[0019] In conjunction with the first aspect, in one embodiment,
[0020] The verification result is the correctness rate of input characters or the overlap rate of drawn graphics;
[0021] The correctness rate of input characters is obtained based on the number of correct input characters and the total number of input characters;
[0022] The overlap ratio of the drawn graphics is obtained based on the overlap between the drawn graphics and the original graphics.
[0023] In conjunction with the first aspect, in one embodiment, analyzing and identifying the obtained verification result to determine whether the device to be detected is a BadUSB device specifically includes:
[0024] The correct rate of input characters is compared with the set correct rate threshold or the overlap rate of drawn graphics is compared with the set overlap rate threshold to determine whether the device to be detected is a BadUSB device.
[0025] In a second aspect, an embodiment of the present application provides a vehicle-side malicious BadUSB device detection device, the vehicle-side malicious BadUSB device detection device comprising:
[0026] A determination module is used to determine the device type of the device to be detected connected to the vehicle based on the HID USB protocol and select a verification method corresponding to the device type;
[0027] A verification module is used to verify the equipment to be tested based on the selected verification method and to summarize the verification process data to obtain the verification results;
[0028] The determination module is used to analyze and identify the obtained verification result to determine whether the device to be detected is a BadUSB device.
[0029] In a third aspect, an embodiment of the present application provides a vehicle-side malicious BadUSB device detection device, which includes a processor, a memory, and a vehicle-side malicious BadUSB device detection program stored in the memory and executable by the processor. When the vehicle-side malicious BadUSB device detection program is executed by the processor, the steps of the above-mentioned vehicle-side malicious BadUSB device detection method are implemented.
[0030] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, on which a vehicle-side malicious BadUSB device detection program is stored. When the vehicle-side malicious BadUSB device detection program is executed by a processor, the steps of the above-mentioned vehicle-side malicious BadUSB device detection method are implemented.
[0031] The beneficial effects of the technical solutions provided in the embodiments of the present application include:
[0032] By selecting the corresponding verification method based on the device type to verify and judge the device to be tested, the detection efficiency and accuracy are improved, and the potential threats in USB devices, such as malware, viruses, etc., can be quickly scanned and identified, shortening the detection time and efficiency and guiding users to actively assist in judgment, effectively avoiding misjudgments and missed judgments in automatic detection; based on the device type, the verification method can be updated to adapt to new types of devices, improving the compatibility of detection and meeting the security needs of different users; the verification results are determined by calculating the accuracy rate, overlap rate, etc., and the corresponding judgment thresholds can be continuously optimized and updated according to user habits and preferences, further improving the user experience on the basis of security. BRIEF DESCRIPTION OF THE DRAWINGS
[0033] Figure 1 This is a flowchart of the vehicle-side malicious BadUSB device detection method of this application;
[0034] Figure 2 This is a functional module diagram of the vehicle-side malicious BadUSB device detection device of this application;
[0035] Figure 3 This is a hardware structure diagram of the vehicle-side malicious BadUSB device detection device for this application. DETAILED DESCRIPTION
[0036] In order to enable those skilled in the art to better understand the present invention, the following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.
[0037] In order to make the objectives, technical solutions and advantages of this application clearer, the implementation methods of this application will be further described in detail below with reference to the accompanying drawings.
[0038] On the first aspect, the embodiments of the present application provide a vehicle-side malicious BadUSB device detection method, which can filter and identify counterfeit HID (Human Interface Device) devices such as mice, keyboards, and handles, thereby enhancing the security and privacy of the vehicle system without affecting the user's normal use of USB devices.
[0039] In one embodiment, referring to Figure 1 , Figure 1 This is a flow chart of the vehicle-side malicious BadUSB device detection method of this application. Figure 1 As shown, the vehicle-side malicious BadUSB device detection method includes:
[0040] S1: Determine the device type of the device to be detected connected to the vehicle based on the HID USB protocol and select the verification method corresponding to the device type;
[0041] S2: Verify the equipment to be tested based on the selected verification method, and summarize the verification process data to obtain the verification results;
[0042] S3: Analyze and identify the verification results to determine whether the device under test is a BadUSB device. BadUSB is an attack technique that exploits firmware vulnerabilities in USB devices. BadUSB devices are typically disguised as HID devices such as keyboards and mice. When plugged into a target computer, they automatically execute malicious code pre-installed in the firmware, thereby performing various malicious operations.
[0043] Furthermore, in one embodiment, the device type of the device to be detected connected to the vehicle is determined based on the HID USB protocol, and a verification method corresponding to the device type is selected, specifically including:
[0044] S101: Obtain the device to be detected connected to the vehicle, and determine the device type of the device to be detected through the devices and feature keywords in the HID USB protocol and the driver of the device to be detected;
[0045] S102: Select a corresponding verification method based on the device type of the device to be detected. In this application, the devices to be detected include mice, keyboards, and game controllers. The HID USB protocol is a communication protocol for connecting computers and external devices. It enables external devices (such as keyboards, mice, game controllers, etc.) to exchange data with the computer.
[0046] Specifically, after inserting the device to be detected, the device type of the device to be detected is determined through the HID USB protocol for devices (referring to physical devices or electronic devices), feature (referring to specific functions or attributes of devices or systems), and the driver of the device to be detected, such as various USB devices such as mice, keyboards, and game controllers. After identifying the type of the device to be detected, the verification method can be selected based on the device type.
[0047] In this application, the corresponding verification method is selected based on the device type to be detected, specifically:
[0048] When the device to be detected is a keyboard, the selected verification method is to input specific characters;
[0049] When the device to be detected is a mouse or a game controller, the selected verification method is to draw a specific graphic.
[0050] Specifically, for a keyboard, specific characters can be input during verification; for a mouse, game controller, etc., specific graphics can be drawn during verification.
[0051] Furthermore, in one embodiment, the device to be tested is verified based on the selected verification method, and the verification process data is summarized to obtain the verification result, which specifically includes:
[0052] S201: operating the device to be tested according to the selected verification method to verify the device to be tested;
[0053] S202: Based on the recognition and summary of the operation results, a verification result is obtained. The verification result is the input character accuracy rate or the drawn graphic overlap rate; the input character accuracy rate is obtained based on the number of correct input characters and the total number of input characters; the drawn graphic overlap rate is obtained based on the overlap between the drawn graphic and the original graphic.
[0054] Specifically, after selecting and confirming the verification method, the user is guided to use the corresponding verification method to perform verification operations on the device to be detected, and the corresponding verification results are summarized and saved, such as the correct rate of input characters and the overlap rate of drawn graphics.
[0055] Furthermore, in one embodiment, the obtained verification results are analyzed and identified to determine whether the device to be detected is a BadUSB device, specifically including: comparing the accuracy of the input characters with a set accuracy threshold or comparing the overlap rate of the drawn graphics with a set overlap rate threshold to determine whether the device to be detected is a BadUSB device.
[0056] For example, for a keyboard device, when the input character accuracy rate obtained after the verification operation is greater than the set accuracy threshold, the current device is determined not to be a BadUSB device; for devices such as a mouse and a game controller, when the drawing graphic overlap rate obtained after the verification operation is greater than the set overlap rate threshold, the current device is determined not to be a BadUSB device.
[0057] This application identifies the corresponding device type based on the protocol for interaction between the inserted device and the vehicle system end and the corresponding driver. It is necessary to clarify the transmission characteristics and keyword characteristics of various devices under the USB HID protocol; select the method for verifying the device according to the identified device type, and define the selection of differentiated methods based on the characteristics of various devices. One is the character comparison method, which uses the device to input specific characters for comparison, and then compares whether the required input value is consistent with the actual input value. The second is the trajectory overlap method, which uses the graphics drawn by the device according to the requirements to move and determine whether the directions and trajectories of the two coincide; guide the user to use the inserted device for differentiated verification according to the selected verification method, save the corresponding verification results and calculate the accuracy or overlap rate of this verification; determine whether the device is a malicious BadUSB device based on the verification results.
[0058] The vehicle-side malicious BadUSB device detection method of the embodiment of the present application improves detection efficiency and accuracy by selecting the corresponding verification method based on the device type to verify and judge the device to be detected, and can quickly scan and identify potential threats in USB devices, such as malware, viruses, etc., shortening detection time and efficiency and guiding users to actively assist in judgment, effectively avoiding misjudgments and missed judgments in automatic detection; the verification method can be updated to adapt to new types of devices based on the device type, thereby improving detection compatibility and meeting the security needs of different users; the verification results are determined by calculating the accuracy rate, overlap rate, etc., and the corresponding judgment thresholds can be continuously optimized and updated according to user habits, preferences, etc., further improving user experience on the basis of security.
[0059] In a second aspect, an embodiment of the present application further provides a vehicle-side malicious BadUSB device detection device.
[0060] In one embodiment, referring to Figure 2 , Figure 2 This is a functional module diagram of the vehicle-side malicious BadUSB device detection device of this application. Figure 2 As shown, the vehicle-side malicious BadUSB device detection device includes: a determination module, a verification module, and a judgment module.
[0061] The determination module is used to determine the device type of the device to be detected connected to the vehicle end based on the HID USB protocol, and select the verification method corresponding to the device type; the verification module is used to verify the device to be detected based on the selected verification method, and summarize the verification process data to obtain the verification result; the judgment module is used to analyze and identify the obtained verification result to determine whether the device to be detected is a BadUSB device.
[0062] In this application, the device type of the device to be detected connected to the vehicle is determined based on the HID USB protocol, and the verification method corresponding to the device type is selected, including:
[0063] Obtain the device to be detected connected to the vehicle, and determine the device type of the device to be detected through the devices and feature keywords in the HID USB protocol and the driver of the device to be detected;
[0064] Select the corresponding verification method based on the device type to be detected.
[0065] Specifically, after inserting the device to be detected, the device type of the device to be detected is determined through the devices and feature keywords in the HID USB protocol and the driver of the device to be detected, such as various USB devices such as mice, keyboards, and game controllers. After identifying the type of the device to be detected, the verification method can be selected based on the device type.
[0066] In this application, the devices to be detected include a mouse, a keyboard, and a game controller.
[0067] In this application, the corresponding verification method is selected based on the device type to be detected, specifically:
[0068] When the device to be detected is a keyboard, the selected verification method is to input specific characters;
[0069] When the device to be detected is a mouse or a game controller, the selected verification method is to draw a specific graphic.
[0070] In this application, the equipment to be tested is verified based on the selected verification method, and the verification process data is summarized to obtain the verification results, which specifically include:
[0071] Operate the equipment to be tested according to the selected verification method to verify the equipment to be tested;
[0072] Based on the identification and summary of the operation results, the verification results are obtained.
[0073] Specifically, after selecting and confirming the verification method, the user is guided to use the corresponding verification method to perform verification operations on the device to be detected, and the corresponding verification results are summarized and saved, such as the correct rate of input characters and the overlap rate of drawn graphics.
[0074] In this application, the verification result is the correctness of the input characters or the overlap rate of the drawn graphics;
[0075] The correctness rate of input characters is obtained based on the number of correct input characters and the total number of input characters;
[0076] The overlap ratio of the drawn graphics is obtained based on the overlap between the drawn graphics and the original graphics.
[0077] In this application, the obtained verification results are analyzed and identified to determine whether the device to be detected is a BadUSB device, specifically including:
[0078] The correct rate of input characters is compared with the set correct rate threshold or the overlap rate of drawn graphics is compared with the set overlap rate threshold to determine whether the device to be detected is a BadUSB device.
[0079] The vehicle-side malicious BadUSB device detection device of the present application verifies and judges the detected device by selecting the corresponding verification method based on the device type, thereby improving detection efficiency and accuracy. It can quickly scan and identify potential threats in USB devices, such as malware, viruses, etc., shorten detection time and efficiency, and guide users to actively assist in judgment, effectively avoiding misjudgments and missed judgments in automatic detection; it can update the verification method to adapt to new types of devices based on the device type, improve the compatibility of detection, and meet the security needs of different users; determine the verification results by calculating the accuracy rate, overlap rate, etc., and can continuously optimize and update the corresponding judgment threshold according to user habits, preferences, etc., further improving the user experience on the basis of security.
[0080] In a third aspect, an embodiment of the present application provides a vehicle-side malicious BadUSB device detection device, which can be a device with data processing capabilities, such as a personal computer (PC), a laptop computer, or a server.
[0081] Reference Figure 3 , Figure 3 FIG2 is a schematic diagram of the hardware structure of the vehicle-side malicious BadUSB device detection device involved in the embodiment of the present application. In the embodiment of the present application, the vehicle-side malicious BadUSB device detection device may include a processor, a memory, a communication interface, and a communication bus.
[0082] The communication bus may be of any type and is used to interconnect the processor, memory, and communication interface.
[0083] Communication interfaces include input / output (I / O) interfaces, physical interfaces, and logical interfaces, used to interconnect components within the vehicle-side malicious BadUSB device detection device, as well as interfaces used to interconnect the vehicle-side malicious BadUSB device detection device with other devices (such as other computing devices or user devices). Physical interfaces can be Ethernet, fiber, or ATM interfaces; user devices can be displays, keyboards, and other devices.
[0084] The memory can be various types of storage media, such as random access memory (RAM), read-only memory (ROM), non-volatile RAM (NVRAM), flash memory, optical storage, hard disk, programmable ROM (PROM), erasable PROM (EPROM), electrically erasable PROM (EEPROM), etc.
[0085] The processor may be a general-purpose processor that can invoke a vehicle-side malicious BadUSB device detection program stored in a memory and execute the vehicle-side malicious BadUSB device detection method provided in the embodiments of the present application. For example, the general-purpose processor may be a central processing unit (CPU). The method executed when the vehicle-side malicious BadUSB device detection program is invoked can be referred to in the various embodiments of the vehicle-side malicious BadUSB device detection method of the present application and will not be further described here.
[0086] Those skilled in the art will understand that Figure 3 The hardware structure shown in the figure does not constitute a limitation to the present application and may include more or fewer components than shown in the figure, or a combination of certain components, or a different arrangement of components.
[0087] In a fourth aspect, an embodiment of the present application also provides a computer-readable storage medium.
[0088] The computer-readable storage medium of the present application stores a vehicle-side malicious BadUSB device detection program, wherein when the vehicle-side malicious BadUSB device detection program is executed by a processor, the steps of the vehicle-side malicious BadUSB device detection method as described above are implemented.
[0089] Among them, the method implemented when the vehicle-side malicious BadUSB device detection program is executed can refer to the various embodiments of the vehicle-side malicious BadUSB device detection method of this application, and will not be repeated here.
[0090] The terms "including" and "having" and any variations thereof in the specification and claims of this application and the above-mentioned drawings are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not limited to the listed steps or units, but optionally includes steps or units that are not listed, or optionally includes other steps or units inherent to these processes, methods, products or devices. The terms "first", "second" and "third" are used to distinguish different objects, etc., and do not represent a sequence, nor do they limit the "first", "second" and "third" to different types.
[0091] In the description of the embodiments of this application, the words "exemplary," "for example," or "for example" are used to indicate examples, illustrations, or descriptions. Any embodiment or design described as "exemplary," "for example," or "for example" in the embodiments of this application should not be construed as being preferred or advantageous over other embodiments or designs. Rather, the use of words such as "exemplary," "for example," or "for example" is intended to present the relevant concepts in a concrete manner.
[0092] In the description of the embodiments of the present application, unless otherwise specified, “ / ” means or, for example, A / B can mean A or B; “and / or” in the text is merely a description of the association relationship of associated objects, indicating that three relationships may exist, for example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. In addition, in the description of the embodiments of the present application, “multiple” refers to two or more than two.
[0093] In some processes described in the embodiments of the present application, multiple operations or steps are included that appear in a specific order. However, it should be understood that these operations or steps may not be performed in the order in which they appear in the embodiments of the present application or may be performed in parallel. The sequence numbers of the operations are only used to distinguish between different operations, and the sequence numbers themselves do not represent any order of execution. In addition, these processes may include more or fewer operations, and these operations or steps may be performed in sequence or in parallel, and these operations or steps may be combined.
[0094] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus the necessary general hardware platform, of course, it can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) as described above, and includes a number of instructions for enabling a terminal device to execute the methods described in each embodiment of the present application.
[0095] The above are only preferred embodiments of the present application and do not limit the patent scope of the present application. Any equivalent structure or equivalent process transformation made using the contents of the present application specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present application.
Claims
1. A method for detecting malicious BadUSB devices on a vehicle, characterized in that: The vehicle-side malicious BadUSB device detection method includes: Determine the device type of the device to be detected connected to the vehicle based on the HID USB protocol and select the verification method corresponding to the device type; Verify the equipment to be tested based on the selected verification method, and summarize the verification process data to obtain the verification results; The obtained verification result is analyzed and identified to determine whether the device to be detected is a BadUSB device.
2. A method for detecting malicious BadUSB devices on a vehicle as claimed in claim 1, characterized in that: The device type of the device to be detected connected to the vehicle is determined based on the HIDUSB protocol, and the verification method corresponding to the device type is selected, specifically including: Obtain the device to be detected connected to the vehicle, and determine the device type of the device to be detected through the devices and feature keywords in the HID USB protocol and the driver of the device to be detected; Select the corresponding verification method based on the device type to be detected.
3. The method for detecting malicious BadUSB devices on a vehicle as claimed in claim 2, wherein: The devices to be detected include a mouse, a keyboard, and a game controller.
4. A method for detecting malicious BadUSB devices on a vehicle side as claimed in claim 3, characterized in that: The device type to be detected is based on which verification method is selected. Specifically: When the device to be detected is a keyboard, the selected verification method is to input specific characters; When the device to be detected is a mouse or a game controller, the selected verification method is to draw a specific graphic.
5. A method for detecting malicious BadUSB devices on a vehicle side as claimed in claim 4, characterized in that: The verification method selected is used to verify the equipment to be tested, and the verification process data is summarized to obtain the verification results, which specifically includes: Operate the equipment to be tested according to the selected verification method to verify the equipment to be tested; Based on the identification and summary of the operation results, the verification results are obtained.
6. The method for detecting malicious BadUSB devices on a vehicle as claimed in claim 5, wherein: The verification result is the correctness rate of input characters or the overlap rate of drawn graphics; The correctness rate of input characters is obtained based on the number of correct input characters and the total number of input characters; The overlap ratio of the drawn graphics is obtained based on the overlap between the drawn graphics and the original graphics.
7. A method for detecting malicious BadUSB devices on a vehicle side as claimed in claim 6, characterized in that: The analysis and identification of the obtained verification result to determine whether the device to be detected is a BadUSB device specifically includes: The correct rate of input characters is compared with the set correct rate threshold or the overlap rate of drawn graphics is compared with the set overlap rate threshold to determine whether the device to be detected is a BadUSB device.
8. A vehicle-side malicious BadUSB device detection device, characterized in that: The vehicle-side malicious BadUSB device detection device includes: A determination module is used to determine the device type of the device to be detected connected to the vehicle based on the HID USB protocol and select a verification method corresponding to the device type; A verification module is used to verify the equipment to be tested based on the selected verification method and to summarize the verification process data to obtain the verification results; The determination module is used to analyze and identify the obtained verification result to determine whether the device to be detected is a BadUSB device.
9. A vehicle-side malicious BadUSB device detection device, characterized in that: The vehicle-side malicious BadUSB device detection device includes a processor, a memory, and a vehicle-side malicious BadUSB device detection program stored in the memory and executable by the processor. When the vehicle-side malicious BadUSB device detection program is executed by the processor, the steps of the vehicle-side malicious BadUSB device detection method as described in any one of claims 1 to 7 are implemented.
10. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a vehicle-side malicious BadUSB device detection program, wherein when the vehicle-side malicious BadUSB device detection program is executed by the processor, the steps of the vehicle-side malicious BadUSB device detection method according to any one of claims 1 to 7 are implemented.