How j-525/mini-project works
This is a Linux BadUSB/HID keystroke-injection detector. Its runtime starts USB hotplug monitoring alongside keyboard event capture; newly detected keyboard insertion updates shared suspicion state, while keystroke windows feed behavioral risk scoring and then alert/log output. The README additionally documents HID identification and typing-speed/delay/frequency analysis, represented by the input-monitoring and scoring components. The separate shell-history scanner and USB simulator are present but are not invoked by the main runtime. Edges reflect calls or shared state explicitly visible in sampled files; unsampled behavior is not inferred.
Main entry points: keystroke_monitor.py Keystroke Monitor · main.py Runtime Entry · usb_monitory.py USB Hotplug Monitor · risk_engine.py Typing Risk Scoring
Components 13
Device and Input Monitoring
- Runtime Entry
badusb/main.py - USB Hotplug Monitor
badusb/usb_monitory.py - Keystroke Monitor
badusb/keystroke_monitor.py
Behavior and Risk Analysis
- Typing Risk Scoring
badusb/risk_engine.py - Risk Thresholds
badusb/config.py - Shell History Scanner
badusb/log.py
Alerting and Logging
- Alert Output
badusb/alert_engine.py - Alert Logger
badusb/logger.py
Shared State and Tools
- Suspicion State
badusb/sus.py - USB Attack Simulator
badusb/usb/sim.py
Other components
- Operator
- Linux Input Events
- Keyboard Event Devices
Connections 14
- Operator → Runtime Entry: starts
badusb/main.py - Runtime Entry → USB Hotplug Monitor: starts thread
badusb/main.py - Runtime Entry → Keystroke Monitor: runs
badusb/main.py - USB Hotplug Monitor → Linux Input Events: monitors
badusb/usb_monitory.py - USB Hotplug Monitor → Suspicion State: sets insertion state
badusb/usb_monitory.py - Keystroke Monitor → Keyboard Event Devices: reads key events
badusb/keystroke_monitor.py - Keystroke Monitor → Suspicion State: reads and resets
badusb/keystroke_monitor.py - Keystroke Monitor → Typing Risk Scoring: evaluates windows
badusb/keystroke_monitor.py - Typing Risk Scoring → Risk Thresholds: uses limits
badusb/risk_engine.py - Typing Risk Scoring → Suspicion State: checks suspicion
badusb/risk_engine.py - Keystroke Monitor → Alert Logger: logs alerts
badusb/keystroke_monitor.py - Keystroke Monitor → Alert Output: emits alert
badusb/keystroke_monitor.py - Shell History Scanner → Operator: prints findings
badusb/log.py - USB Attack Simulator → Linux Input Events: monitors devices
badusb/usb/sim.py