USB Device Intrusion Detection and Blocking Tool (Python)

The USB Device Intrusion Detection and Blocking Tool is a Python desktop service that guards a Windows computer against a classic attack route in labs and offices: the unknown pendrive. Students and staff routinely plug unfamiliar USB drives into shared machines, and a single compromised drive can silently drop malware or copy sensitive data. Windows mounts removable drives the moment they enumerate, often before the user questions where the drive came from. This tool closes that gap. It runs as a background service with administrator rights, subscribes to the operating system's own device-change notifications, and checks every arriving USB device against a locally stored allowlist before the user can interact with it. Devices that match are left alone; anything unrecognized is immediately blocked or quarantined, and the operator gets a tray alert and a permanent event-log entry. A live dashboard mirrors the service console, so the whole detection pipeline is visible end to end.

The USB Device Intrusion Detection and Blocking Tool works as an event-driven pipeline with no polling loop. Windows broadcasts a WM_DEVICECHANGE message the moment a USB device enumerates, and the Python service hooks that broadcast — subscribing through pywin32 to the WMI Win32_DeviceChangeEvent class with EventType 2, which signals device arrival — before the user ever opens Explorer. On each arrival the service extracts the device identity: vendor and product IDs, the device serial when the firmware reports one, and the Windows device instance ID. That identity is looked up in a local SQLite allowlist, which keys on the serial and falls back to the instance ID because many cheap pendrives report identical vendor/product IDs. A match means the device is allowed silently; a miss triggers the configured policy — full block via the OS device-management API, or quarantine with write access revoked — and raises a tray notification plus an alert record in the dashboard.

1. The service starts with administrator rights and registers a WMI event subscription: SELECT * FROM Win32_DeviceChangeEvent WHERE EventType = 2.
2. When a USB device enumerates, Windows broadcasts WM_DEVICECHANGE (0x0219) and the pywin32 hook wakes the handler immediately.
3. The handler reads the arriving device's identity — VID/PID, serial, Windows device instance ID and USB device class.
4. The identity is looked up in the local SQLite allowlist: serial match first, device instance ID as fallback.
5. A match means the device is allowed silently and the event is logged as allowed.
6. A miss triggers the policy engine: full block (device disabled through the OS device-management API) or quarantine (write access revoked), per the configured rule.
7. A tray notification fires and an alert is raised with severity until acknowledged.
8. Every event — allowed, blocked, quarantined, flagged — is written to the event log with its full device record for the operator to review.

Tech stack:

• Python 3
• pywin32 (Win32 API · WMI access)
• WMI Win32_DeviceChangeEvent subscription
• SQLite (local allowlist store)
• pystray (system-tray icon)
• HTML · CSS · JavaScript (operator dashboard)
• Windows device-management API (block action)

The USB Device Intrusion Detection and Blocking Tool combines event-driven USB monitoring, a serial-keyed device allowlist, policy-based blocking and quarantine, and a full operator console. Its core capability is detection speed: the service subscribes to the WMI Win32_DeviceChangeEvent notification for device arrival, so it flags an unrecognized insert in under ~2 s in the bench test — a design target, not a measured guarantee — before the removable media can be opened. The allowlist stores each trusted device by serial, falling back to the Windows device instance ID, which defeats the common trick of swapping in a lookalike pendrive with identical vendor/product IDs. Enforcement is configurable: full device block for strict labs, or quarantine that revokes write access while leaving the device readable for inspection. Every decision lands in a searchable event log with a tray alert, and the dashboard gives the operator allowlist management, rule toggles and alert history in one place.

• [Event-driven USB monitoring] The service subscribes to WMI Win32_DeviceChangeEvent with EventType 2 (device arrival) through pywin32 — no polling loop, so inserts are caught the moment Windows broadcasts the WM_DEVICECHANGE message.
• [Serial-keyed allowlist] Trusted devices are identified by device serial when the firmware reports one, falling back to the Windows device instance ID (USB\VID_xxxx&PID_xxxx\…) — because many cheap pendrives report identical vendor/product IDs.
• [Auto-block and quarantine policies] Unrecognized devices are either fully disabled through the OS device-management API or quarantined with write access revoked, per the operator's configured rule.
• [Live event log] Every arrival is recorded with timestamp, vendor, VID/PID, serial, device class and the action taken; the log supports status filtering and full-text search.
• [Alert system] Each block or quarantine raises an alert with severity until the operator acknowledges it; unacknowledged alerts stay visible in the dashboard badge.
• [Block-rule console] Toggles for auto-block, quarantine-instead-of-block, serial-first matching, monitored USB device classes and notification preferences, applied to the next device arrival.
• [System-tray integration] The service runs minimized with a tray icon; tray notifications fire on every block or quarantine event.
• [Allowlist manager] Add devices manually by VID/PID and serial, revoke entries, and promote a blocked device to the allowlist straight from its event record.

• Complete Python service source code (WMI monitor, policy engine, allowlist manager)
• Operator dashboard (event log, allowlist, alerts, block-rule console)
• System-tray integration module with notification support
• Setup and configuration guide (admin rights, WMI permissions, allowlist seeding)
• Project report PDF (background, OS event mechanism, methodology, testing procedure)
• PPT presentation for final review
• Viva Q&A preparation document (WMI, device instance IDs, allowlist design, limitations)
• Project abstract PDF