基于取证日志的击键注入“BadUsb“攻击检测
Forensic Log Based Detection For Keystroke Injection "BadUsb" Attacks
摘要：
本文档描述了一个实验，主要目的是检测BadUSB攻击，该攻击利用外部人机交互设备硬件小工具注入恶意代码并获取远程代码执行。其中一个主要目标是基于行为因素来检测这种活动，并允许具有基本认知能力的每个人，无论用户是人类还是计算机，都可以识别异常速度相关指标，但也可以将这种速度变化与其他元素相关联，例如通常的恶意进程，如powershell进程，在非常接近的时间内被调用，与加载的驱动程序映像相关的Pendash设备事件发生。
英文摘要：
This document describes an experiment with main purpose to detect BadUSB attacks that utilize external Human Interaction Device hardware gadgets to inject keystrokes and acquire remote code execution. One of the main goals, is to detect such activity based on behavioral factors and allow everyone with a basic set of cognitive capabilities ,regardless of the user being a human or a computer, to identify anomalous speed related indicators but also correlate such speed changes with other elements such as commonly malicious processes like powershell processes being called in close proximity timing-wise, PnP device events occurring correlated with driver images loaded.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
