The USB Device Control & Monitoring Framework is a Python-based cybersecurity project designed to monitor USB storage device activity on a Windows system in real time. It detects USB device connection and removal events, identifies connected devices using Windows Management Instrumentation (WMI), checks device identifiers against predefined allowlists and blocklists, classifies devices as Authorized, Unauthorized, or Blocked, generates security alerts, maintains activity logs, and produces monitoring reports.
This project demonstrates practical Blue Team and endpoint-security concepts such as removable-device monitoring, access policy classification, security event logging, alert generation, and audit reporting.
- Real-time USB storage device monitoring
- USB device connection detection
- USB device removal detection
- USB device identification using WMI
- Allowlist-based device authorization
- Blocklist-based device classification
- Authorized USB detection
- Unauthorized USB detection
- Blocked USB device classification
- Security alert generation
- USB activity logging
- Alert logging
- Monitoring session report generation
- Monitoring statistics
- Aesthetic black-themed Tkinter GUI
- Start and Stop monitoring controls
- Log and report access through the GUI
- Python 3
- Windows Management Instrumentation (WMI)
- Tkinter
- Threading
- File Handling
- Datetime Module
- Time Module
USB-Device-Control-Monitoring/
│
├── main.py
├── gui.py
├── requirements.txt
├── README.md
│
└── screenshots/
- The program initializes USB monitoring using Windows Management Instrumentation (WMI).
- Currently connected USB storage devices are identified.
- The program continuously scans the system for USB storage devices.
- Newly connected devices are detected by comparing the current device list with the previous scan.
- Device information such as name, model, manufacturer, interface, and device ID is collected.
- The detected device ID is compared with the predefined allowlist and blocklist.
- The device is classified as Authorized, Unauthorized, or Blocked.
- USB connection and removal events are recorded in logs.txt.
- Unauthorized and Blocked devices generate entries in alerts.txt.
- Monitoring statistics are maintained during the session.
- When monitoring stops, a session report is generated in report.txt.
- A session report is generated when the program stops.
The project uses two policy files to classify USB devices: Allowlist
The allowlist.txt file contains authorized USB device IDs. Example: \.\PHYSICALDRIVE2
When a detected device matches an entry in the allowlist: Status : AUTHORIZED Blocklist The blocklist.txt file contains device IDs that should be classified as blocked. Example: \.\PHYSICALDRIVE3
When a detected device matches an entry in the blocklist: Status : BLOCKED Unauthorized Devices If a device ID does not appear in either list, it is classified as: Status : UNAUTHORIZED
An alert is also recorded for Unauthorized and Blocked devices. Note: The current implementation classifies and logs devices according to the configured policies. It does not physically disable or eject USB devices.
Stores USB connection and removal events with timestamps and device information. Example: 08-08-2026 06:44:09 PM | USB Connected | General UDisk USB Device | (Standard disk drives) | UNAUTHORIZED | \.\PHYSICALDRIVE2
Stores security alerts generated for Unauthorized and Blocked USB devices. Example: 08-08-2026 06:44:09 PM | UNAUTHORIZED USB Device | General UDisk USB Device | \.\PHYSICALDRIVE2
Stores a monitoring session summary including: USB Connected USB Removed Authorized Devices Unauthorized USBs Blocked USBs Date and Time
Clone the repository:
git clone https://github.com/SandeepSandy08/USB-Device-Control-Monitoring-Framework.git
Install the required package:
pip install -r requirements.txt
Run the project:
python main.py
This project helped me learn:
• Python programming fundamentals • Windows Management Instrumentation (WMI) • USB device monitoring • Hardware/device identification • Allowlist and blocklist policy implementation • Real-time system monitoring • Security event logging • Security alert generation • Session report generation • Python threading • Tkinter GUI development • Blue Team and endpoint-security concepts • Basic cybersecurity automation
- Automatic USB device blocking
- USB device enable/disable control
- More reliable device identification using Vendor ID, Product ID, and Serial Number
- File movement and data-transfer auditing
- USB file activity monitoring
- Database-backed logging
- Email notifications
- Desktop security notifications
- Advanced GUI dashboard integration
- PDF and Excel report generation
- User authentication and administrative controls
Sandeep Kumar J S Aspiring Cybersecurity Professional
This project is developed for educational and internship purposes.