The invention discloses a
USB interface
information security prevention and control method and
system, and relates to the technical field of computer
information security. A security control module is connected in series between a
USB port of a monitoring host and a
peripheral, and protection is moved forward to the early stage of power-on and enumeration, so that access and permission limitation with equipment fingerprints and industrial
semantics as cores are realized, and the security of the
USB interface is ensured. The
attack surface is converged at the access moment; performing
fingerprint comparison by using information such as VID / PID, descriptor consistency, PD / CC
handshake and the like, so that the
camouflage equipment is difficult to pass initial identification; enumeration limit and endpoint-level bandwidth / type control are adopted for the released equipment,
mass storage is forbidden by default, only HID and authorized necessary endpoints are reserved, and harm of instruction injection and high-frequency burst is weakened from the source; in a session stage, a normal behavior model is constructed by endpoint access distribution,
function code transfer and frame interval statistics, and identification of instructions with compliant formats and abnormal
semantics is realized based on a deviation degree
score and an adaptive threshold.