Copyright © 2026 Authors retain the copyright of this article. This article is an open access article distributed under the Creative Commons Attribution License which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.

@article{200457,
        author = {Om Lambade and Nidhiba Parmar},
        title = {A Hybrid Rule-Based and Machine Learning Approach for Detecting USB HID Injection Attacks in Enterprise Systems},
        journal = {International Journal of Innovative Research in Technology},
        year = {2026},
        volume = {12},
        number = {12},
        pages = {2536-2543},
        issn = {2349-6002},
        url = {https://ijirt.org/article?manuscript=200457},
        abstract = {Universal Serial Bus (USB) Human Interface Devices (HIDs) such as keyboards and mice are inherently trusted by modern operating systems, creating a critical security vulnerability that adversaries exploit through HID injection attacks (e.g., BadUSB and Rubber Ducky). These attacks emulate legitimate input devices and execute automated command sequences without deploying traditional malware, thereby bypassing signature-based detection mechanisms. Existing defenses, including port-level blocking and log-based monitoring, either disrupt normal operations or fail to provide real-time protection. This paper presents HID-Defender, a kernel-level behavioral detection framework designed to identify and mitigate USB HID injection attacks in real time. The proposed approach captures high-resolution keystroke events using a custom Windows Driver Model (WDM) filter driver and models user behavior through Inter-Keystroke Interval (IKI) analysis. Shannon entropy is employed to quantify the randomness of typing patterns, enabling effective differentiation between human-generated and machine-injected inputs. A hybrid detection mechanism integrates rule-based anomaly filtering with supervised machine learning classifiers, including Random Forest and K-Nearest Neighbours (KNN), to enhance detection robustness and reduce false positives. Experimental evaluation demonstrates that the proposed system achieves an accuracy of 96.8%, with a false positive rate of 2.1% and detection latency below 420 ms, satisfying real-time enterprise requirements. Additionally, a selective interface-level blocking mechanism ensures minimal disruption to legitimate USB functionality. The results highlight the effectiveness of behavioral biometrics and kernel-level monitoring in addressing emerging hardware-based attack vectors.},
        keywords = {USB Security, HID Injection Attacks, BadUSB, Behavioral Biometrics, Inter-Keystroke Interval (IKI), Shannon Entropy, Machine Learning, Random Forest, Kernel-Level Detection, USB Forensics},
        month = {May},
        }