Protection against USB hid automation attacks

A method comprising, in an information handling system including at least one processor, an external peripheral port configured to couple to external peripheral devices, and a firewall physically coupled between the at least one processor and the external peripheral port:

• the firewall receiving a plurality of communications associated with the external peripheral port, wherein each communication has a time of transmission associated therewith, and wherein differences between subsequent ones of the times of transmissions indicate delays between corresponding subsequent ones of the transmissions;
• the firewall buffering the plurality of communications into a buffer while comparing the delays to a human input model to determine a likelihood that the communications were generated by a human;
• in response to the likelihood being above a threshold, the firewall reconstructing the plurality of communications from the buffer and passing the reconstructed communications to the at least one processor;
• and
• in response to the likelihood being below the threshold, the firewall blocking the communications from proceeding.

An article of manufacture comprising a non-transitory, computer-readable medium having computer-executable instructions thereon that are executable by a firewall of an information handling system, wherein the information handling system includes at least one processor and an external peripheral port configured to couple to external peripheral devices, and wherein the firewall is physically coupled between the at least one processor and the external peripheral port, the instructions being executable for:

• receiving a plurality of communications associated with the external peripheral port, wherein each communication has a time of transmission associated therewith, and wherein differences between subsequent ones of the times of transmissions indicate delays between corresponding subsequent ones of the transmissions;
• buffering the plurality of communications into a buffer while comparing the delays to a human input model to determine a likelihood that the communications were generated by a human;
• in response to the likelihood being above a threshold, reconstructing the plurality of communications from the buffer and passing the reconstructed communications to the at least one processor;
• and
• in response to the likelihood being below the threshold, blocking the communications from proceeding.