Abstract: Disclosed are systems and methods for generating rules for detecting modified or corrupted external devices connected to a computer system. An exemplary method includes analyzing data associated with the external device connected to the computer system based on stored data associated with one or more other devices; identifying at least one anomaly associated with the analyzed data that indicates the detected external device is modified or corrupted; generating at least one rule in response to the identified anomaly, wherein the at least one rule is based on the external device; and storing the at least one rule in a database accessible to the computer system.

Abstract: Disclosed are systems and methods for generating rules for detecting modified or corrupted external devices connected to a computer system. An exemplary method includes analyzing data associated with the external device connected to the computer system based on stored data associated with one or more other devices; identifying at least one anomaly associated with the analyzed data that indicates the detected external device is modified or corrupted; generating at least one rule in response to the identified anomaly, wherein the at least one rule is based on the external device; and storing the at least one rule in a database accessible to the computer system.

Abstract: Disclosed are systems and methods for detecting modified or corrupted external devices connected to a computer system. An exemplary method includes storing in a database, data that relates to devices previously connected to the computer system and rules that specify conditions that indicate when the device should be further analyzed as being possibly corrupted. The method further includes receiving from the device data that relates to the device or to a connection between the device and the computer system; performing an analysis of the received data by comparing the received data and the stored data relating to devices previously connected to the computer system; and applying results of the analysis of the received data to the rules to determine whether the at least one condition is satisfied that indicates that the device is possibly modified or corrupted and should be further analyzed for presence of malware.