Keyblock: a software architecture to prevent keystroke injection attacks

Abstract

This work investigates a solution to mitigate the threat of keystroke injection attacks. Current defense mechanisms often require relatively expensive hardware and time consuming configuration. We describe and test the effectiveness of a software layer between USB input hardware and processes. Our software, Keyblock, intercepts events from newly connected devices and uses keystroke dynamics analysis to detect whether an attack is in course. By detecting and immediately disabling devices with anomalous typing patterns, Keyblock provides a software-only automatic solution to prevent keystroke injection.