Abstract: A system for providing a human interface device firewall (HID-F) is disclosed, including a device detector to detect the presence of a human interface device and to turn on a human interface device firewall if a human interface device is detected. An interceptor intercepts one or more inputs and transmit the one or more inputs to a malicious input engine configured to analyze the one or more inputs for malicious input. If the input is deemed safe the one or more inputs are sent to a host operating system for processing. An encrypted data store receives and stores the one or more inputs from the malicious input engine. An enforcer receives the one or more inputs if they are deemed malicious and shuts down the one or more malicious inputs such that they are not sent to the host operating system. The HID-F also has advanced optional features such as: support multiple payload analyses, optional enforcement options, historical payload analysis, and complex meta rules bases on analyses results.