Patent ID: 8713683

Claim:
A method for protecting a host system from a first device connected to the host system, the method comprising: executing an extended protocol stack having security arrangements at a processor of the host system, compiling a first list of devices that are not authorized to communicate with the host system, the first list of devices maintained by the security arrangements of the extended protocol stack; compiling a second list of suspicious descriptors maintained by the security arrangements of the extended protocol stack, wherein devices with those descriptors are not authorized to communicate with the host system; identifying the first device and its descriptors, wherein the first device is a first USB device; comparing the first list and the second list to the identified device and its descriptors and, if there is a match, preventing communications between the first device and the host system; and detecting suspicious activities between a second USB device and the system through static analysis and heuristic analysis, wherein the heuristic analysis includes monitoring a rate of keystrokes originating from a third USB device identified as a keyboard and, if the keystroke rate exceeds a predetermined limit representing a maximum typing speed, flagging the third USB device as suspicious.