QUACK! Making the (Rubber) Ducky Talk: A Systematic Study of Keystroke Dynamics for HID Injection Detection

1. Problem Statement

Modern computing systems implicitly trust Human Interface Devices (HIDs), such as keyboards. This trust creates a vulnerability exploited by HID emulation attacks (e.g., USB Rubber Ducky), where malicious devices impersonate keyboards to inject pre-programmed keystroke sequences at high speeds, bypassing traditional software defenses.

Existing countermeasures rely on simple heuristics (e.g., detecting abnormally high typing speeds or perfectly regular timing), which are easily evaded by attackers introducing random delays or slowing down input. While Keystroke Dynamics (analyzing timing features like Hold Time and Flight Time) is effective for user authentication, prior work frames it as a user-vs-user discrimination problem. This paper addresses the gap: Human-vs-Machine discrimination. The goal is to detect automated injection regardless of the user's identity, without accessing the semantic content of the typed text (to preserve privacy) and without requiring heavy computational resources.

2. Methodology

The authors propose a systematic evaluation pipeline to assess the feasibility of detecting HID injection attacks using lightweight, privacy-preserving models.

A. System and Threat Model

• Defender: A passive, background detector operating at the OS level. It extracts only timing features (Key Hold Time - HT, and Inter-key Flight Time - FT) from keystroke sequences. It does not access the text content (Virtual Key codes) or user identity.
• Attacker: An adversary with physical access using a malicious HID device. The attacker aims to inject a payload while mimicking human typing behavior. The threat model assumes the attacker does not need to impersonate a specific user, only to appear "human-like."

B. Synthetic Dataset Generation

To evaluate the detector against various evasion strategies, the authors generated three families of synthetic datasets based on a real human keystroke dataset (González et al.):

1. Naive Dataset (Zero/Minimal Effort): Uses Pseudorandom Number Generators (PRNGs) and simple statistical samplers (e.g., Empirical Pairs, Conditional Previous-Bin) that introduce variability without modeling complex temporal structures.
2. Statistical Dataset (Context-Aware): Uses finite-context generators (e.g., Histogram, Non-Stationary Histogram, Gaussian) that condition timing values on preceding keystrokes to preserve higher-order statistical dependencies.
3. Adaptive Dataset (Sophisticated): Uses Wasserstein GANs (WGAN-GP) (both unconditional and conditional) to learn and approximate complex human-like temporal dynamics directly from data.

C. Evaluation Framework

The study evaluates detection models across three stages:

1. Single-Generator Training: Training a detector on one specific generator to establish baseline performance and in-distribution separability.
2. Cross-Generator Generalization: Testing a detector trained on one generator against unseen generators to measure transferability and robustness.
3. Mixed-Generator Training: Training detectors on a mixture of generators (Balanced and Unbalanced configurations) to simulate real-world scenarios where the specific attack vector is unknown.

Models Tested: Random Forest (RF), Support Vector Machine (SVM), 1D-CNN, LSTM, and BiLSTM.
Input Variable: Keystroke sequence lengths ranging from 10 to 1000 keystrokes.

3. Key Contributions

1. First Systematic Characterization: The paper provides the first study framing keystroke injection detection as a privacy-preserving, user-agnostic human-vs-machine discrimination problem.
2. Lightweight & Privacy-Preserving Detection: Demonstrates that robust detection is achievable using timing features only (HT/FT) without accessing text content or user profiles, utilizing lightweight models like Random Forest.
3. Training Strategy Insight: Identifies that detection robustness is driven by coverage of structurally distinct attacker families rather than model complexity or training on the most sophisticated adversaries.
4. Latency vs. Reliability Trade-off: Quantifies the optimal observation window, finding that detection reliability saturates quickly, allowing for early interception.
5. Open Source: The experimental pipeline and code are released on GitHub to ensure reproducibility.

4. Key Results & Findings

A. Detection Feasibility (RQ1)

• Result: High detection reliability (ROC-AUC > 0.9) is achievable using lightweight models (specifically Random Forest) operating solely on timing features.
• Implication: Continuous background monitoring is feasible without invasive hardware or privacy-compromising content analysis.

B. Generalization & Training Strategy (RQ2 & RQ3)

• Clustering Effect: Generators within the same structural class (e.g., all PRNGs or all Histogram-based) generalize well to each other.
• Key Finding: Training on the most sophisticated model (GANs) does not guarantee protection against simpler, structurally distinct models. Conversely, training on specific statistical models (like Non-Stationary Histograms) often generalizes well to GAN-generated data.
• Optimal Strategy: Unbalanced Mixed Training (UC3) yielded the best results. By prioritizing generators with broader transferability (e.g., NS-Hist) and adding small fractions of other types, the model achieved robustness across all attacker families without needing to train on every possible generator.

C. Detection Timeliness (RQ4)

• Result: Detection performance saturates between 70 and 100 keystrokes.
• Implication: A defender can make a reliable decision after observing only ~70 keystrokes. Waiting for longer sequences (e.g., 200+) provides marginal gains but significantly increases the risk that the attacker completes the malicious payload before detection.

D. Attacker Sophistication (RQ5)

• Counter-Intuitive Finding: Increasing the statistical sophistication of the generator (e.g., moving from PRNG to GAN) does not monotonically improve evasion capability.
• Reasoning: While GANs produce realistic samples, they often concentrate on specific regions of the behavioral space. Simpler, structurally diverse strategies (like specific statistical samplers) can produce behaviors that are harder to comprehensively cover during training. Diversity of attack strategies is a bigger threat than complexity.

5. Significance and Conclusion

This paper fundamentally shifts the paradigm for HID injection defense:

• From Complexity to Coverage: It argues that defense mechanisms should not focus on building increasingly complex deep learning models to counter "smart" attackers. Instead, they should focus on statistical coverage of structurally distinct attack families.
• Practical Deployment: By proving that lightweight models (Random Forest) can detect attacks with high accuracy using only timing data within a short window (70 keystrokes), the paper paves the way for real-time, low-overhead, privacy-preserving intrusion detection systems for HID attacks.
• Adversarial Insight: It warns defenders that training solely on the "strongest" known adversary (GANs) creates a false sense of security, as it may fail to detect simpler, structurally different injection methods.

In summary, the paper demonstrates that "making the Rubber Ducky talk" (detecting its unnatural timing patterns) is a solvable problem using simple, efficient, and privacy-friendly techniques, provided the training data covers the structural diversity of potential attacks.