[RFE] When explicitly asked for using a rule, monitor the traffic to/from a USB device about usbguard HOT 4 OPEN

Related:
http://slashdot.org/story/15/07/28/1440210/chrome-extension-thwarts-user-profiling-based-on-typing-behavior

from usbguard.

One of the use cases is also monitoring of outgoing traffic to a USB flash stick (or whatever) for auditing purposes.

Unusually large traffic to a device could indicate an event of unauthorized data exfiltration. We could probably also implement the capability of limiting i/o traffic to certain devices in the rule language, e.g. when a device exceeds the limit, it'll be blocked, disconnected, blacklisted.

from usbguard.

Related:
https://github.com/radosroka/usbmon

from usbguard.

This sounds a lot like anti-virus heuristic scanning. Sure, you can theoretically catch naive implementations but it's a lot of work for something that's trivial to circumvent and likely to lead to a lot of false positives. I just don't see this as a high priority item....

from usbguard.