A Hardware-Assisted Insider Threat Detection and Prevention Framework

Authors

Kyle W. DenneyFollow

Document Type

Thesis

Degree

Master of Science (MS)

Major/Program

Computer Engineering

First Advisor's Name

A. Selcuk Uluagac

First Advisor's Committee Title

Committee Chair

Second Advisor's Name

Kemal Akkaya

Second Advisor's Committee Title

Committee Member

Third Advisor's Name

Alexander Perez-Pons

Third Advisor's Committee Title

Committee Member

Fourth Advisor's Name

Michael Vai

Fourth Advisor's Committee Title

Committee Member

Keywords

hardware security, machine learning, USB, intrusion detection

Date of Defense

6-28-2019

Abstract

Today, the USB protocol is among the most widely used protocols. However, the mass-proliferation of USB has led to a threat vector wherein USB devices are assumed innocent, leaving computers open to an attack. Malicious USB devices can disguise themselves as benign devices to insert malicious commands to connected end devices. A rogue device appears benign to the average OS, requiring advanced detection schemes to identify malicious devices. However, using system-level hooks, advanced threats may subvert OS-reliant detection schemes. This thesis showcases USB-Watch, a hardware-based USB threat detection framework. The hardware can collect live USB traffic before the data can be altered in a corrupted OS. Behavioral analysis of USB devices allows for a generalizable anomaly detection classifier in hardware that can detect abnormal behavior from USB devices. The framework tested achieves an ROC AUC of 0.99 against a testbed of live USB devices.

Identifier

FIDC007809

Recommended Citation

Denney, Kyle W., "A Hardware-Assisted Insider Threat Detection and Prevention Framework" (2019). FIU Electronic Theses and Dissertations. 4225.
https://digitalcommons.fiu.edu/etd/4225