Background
I developed this project as my Master’s thesis in Cybersecurity at the University of Alicante. The thesis, dated June 2026, is titled Intelligent system for forensic analysis and prevention of anomalous USB device use in Windows (translated title).
My goal was to combine a reconstruction of USB device activity with the detection of changes from a computer’s usual usage patterns. This is an academic defensive-security project developed and evaluated in an authorized test environment.
The problem
One device can leave traces in several Windows data sources. Looking at each source separately makes it harder to reconstruct a timeline and determine whether a connection fits the computer’s normal activity.
The tool combines these traces to support investigation. A deviation from the usual pattern is treated as a signal worth examining, not automatic proof of malicious activity.
How it works
- Collection. Reads Windows Registry artifacts, event logs, and SetupAPI information.
- Correlation. Normalizes identifiers and links records to reconstruct devices, connections, and sessions.
- Storage. Stores data in SQLite and includes SHA-256 hashes to detect later changes to saved records.
- Analysis. Establishes a baseline of regular usage and calculates an anomaly score using the device, time, and available context.
- Response and review. Displays results in a desktop interface, produces alerts and reports, and supports configurable preventive actions.
Analysis workflow
The tool collects Windows artifacts, correlates them, and stores them in SQLite. It then analyzes deviations, applies the configured policy, and presents the findings to the analyst.
The diagram loads when this section comes into view.
flowchart TD R["Registry"] --> B["USB correlation"] L["Event logs"] --> B S["SetupAPI"] --> B B --> C["SQLite and integrity"] C --> D["Anomaly analysis"] D --> E["Policies and alerts"] E --> F["UI and reports"]Thesis figures
These figures come from my thesis. The interface contains examples explicitly labeled DEMO; the screenshot does not depict a security incident.
Select an image to enlarge it. Use the arrow keys to navigate and Esc to close.
Technical decisions
- Python to integrate artifact acquisition, analysis, and automation on Windows.
- SQLite for local storage without requiring a separate database server.
- PyQt6 for a graphical interface displaying devices, alerts, and statistics.
- HTML and JSON reports to support review and further processing.
- Learning, monitoring, and strict modes to separate baseline creation, observation, and the application of responses.
The thesis also documents privilege handling and temporary blocking through PowerShell. Available features depend on the permissions under which the application runs.
Validation and results
The documented validation combines unit tests, integration tests, and experiments with synthetic data. It also includes functional checks of connection monitoring and system-signal storage.
The experiments show that the detector distinguishes anomalies more reliably when deviations from normal behavior are clear. Ambiguous cases involve a trade-off between detecting more anomalies and raising more false alerts. The decision threshold therefore needs tuning for each usage context.
Limitations and takeaways
- The quantitative evaluation uses synthetic data and controlled scenarios. Validation with more real activity and larger datasets remains future work.
- An unusual connection requires investigation; it does not prove intrusion or data exfiltration.
- USB artifacts alone cannot establish which files were copied.
- Hashes can help check for changes to stored data, but they do not replace a complete evidence-preservation and chain-of-custody process.
- Resource consumption over long-running sessions needs further measurement.
This project let me work on cross-source correlation, Windows evidence handling, and the design of a tool that explains to analysts why an alert was produced.