A new Linux kernel driver called <code>hid-omg-detect</code> is under development that passively monitors USB HID devices — keyboards, mice, and similar peripherals — for signs of malicious behavior, like BadUSB attacks or <a href="http://O.MG" target="_blank" rel="noopener nofollow">O.MG</a> cables.
The driver doesn’t block anything. Instead, it scores devices based on a few behavioral and structural signals:
<ul>
<li>Keystroke timing entropy — legitimate human typists are irregular; automated injection is not</li>
<li>Plug-and-type latency — a device that starts sending keystrokes immediately after enumeration is suspicious</li>
<li>USB descriptor fingerprinting — known bad vendor/product IDs and unusual HID descriptor patterns</li>
</ul>
When a device’s suspicion score crosses a threshold, the driver fires a kernel warning. For actual blocking, it’s designed to work alongside USBGuard in userspace — the driver detects, USBGuard acts.
The patch series is on its second revision after feedback on the mailing list, mostly around global state management and spinlock logging. It’s still a proposal waiting on kernel maintainer approval, so don’t expect it in a stable release anytime soon.
The approach is interesting because it targets behavior rather than identity — a device can have a clean vendor ID and still get flagged if it types like a robot the moment it’s plugged in. That said, the real-world false positive rate on this kind of heuristic scoring remains to be seen once it gets broader testing.

Collections

A new Linux kernel driver called hid-omg-detect is being developed to passively detect suspicious USB HID devices such as keyboards and mice. It scores devices based on keystroke timing entropy, plug-and-type latency, and USB descriptor fingerprinting to identify potential BadUSB attacks or O.MG cables. The driver fires a kernel warning when a suspicion threshold is crossed, and is designed to work alongside USBGuard for actual blocking. Currently on its second patch revision awaiting kernel maintainer approval, it targets behavioral patterns rather than device identity, though real-world false positive rates remain untested.

hid-omg-detect: A Linux kernel driver to flag suspicious HID devices