Sentinel - HID Attack Detection Framework
Cybersecurity Framework•2026
Overview
Sentinel is a defensive security framework developed to counter automated keystroke injection hardware (such as BadUSB, USB Rubber Ducky, and malicious microcontroller firmware). While traditional endpoint protection tools inspect process binaries and filesystem activity, Sentinel analyzes input subsystem telemetry at the hardware-driver layer.
Micro-Timing Anomaly Detection Engine
Human typing exhibits natural biometric entropy—dynamic inter-key latencies, flight times, and digram variance. Malicious automated HID devices inject keystrokes at superhuman rates (sub-5 millisecond static intervals) with near-zero jitter.
Sentinel continuously measures inter-keystroke intervals (IKIs) using high-precision hardware timestamps, computing rolling standard deviations and Shannon entropy metrics across input streams.
Sentinel continuously measures inter-keystroke intervals (IKIs) using high-precision hardware timestamps, computing rolling standard deviations and Shannon entropy metrics across input streams.
Automated Mitigation & Alert Daemon
Upon detecting an injection threshold breach, Sentinel triggers instantaneous defensive countermeasures:
• Dynamic USB Port Lockout: Suspends or resets the offending USB hub port via OS subsystem hooks.
• Terminal Focus Severance: Minimizes active privileged terminals (PowerShell, Command Prompt, bash) to prevent code execution.
• Forensic Snapshotting: Captures the full payload buffer, timestamp delta, and hardware vendor/product IDs for incident response.
• Dynamic USB Port Lockout: Suspends or resets the offending USB hub port via OS subsystem hooks.
• Terminal Focus Severance: Minimizes active privileged terminals (PowerShell, Command Prompt, bash) to prevent code execution.
• Forensic Snapshotting: Captures the full payload buffer, timestamp delta, and hardware vendor/product IDs for incident response.
Timing Anomaly Detection Algorithm
sentinel_detector.py
1import time
2from collections import deque
3import numpy as np
4
5class SentinelDetector:
6 def __init__(self, threshold_ms=12.0, entropy_cutoff=1.8):
7 self.key_timestamps = deque(maxlen=30)
8 self.threshold_ms = threshold_ms
9 self.entropy_cutoff = entropy_cutoff
10
11 def process_key_event(self, key_code):
12 now = time.perf_counter() * 1000.0 # ms
13 self.key_timestamps.append(now)
14
15 if len(self.key_timestamps) >= 15:
16 deltas = np.diff(list(self.key_timestamps))
17 mean_interval = np.mean(deltas)
18 std_dev = np.std(deltas)
19
20 # Detect superhuman burst or zero-jitter injection
21 if mean_interval < self.threshold_ms and std_dev < 2.0:
22 self.trigger_mitigation(deltas, mean_interval)
23
24 def trigger_mitigation(self, deltas, mean_speed):
25 print(f"[!] HID INJECTION DETECTED: {mean_speed:.2f}ms/key avg. Isolating input!")