Just some ideas to identify if the new USB could be a rubber ducky attacker:
- First verify if there are already HUID devices aktiv.
- You can set a limit to a number of allowed HUIDs, if the number is exceeded, new interfaces will be blocked.
Combined with your recognition method, it would be a good defense, when the system is already running.
Also you could watch a the input speed and set a limit to allowed keystrokes per second, not that you should watch every keystroke, only a adjustable number in a random time interval, like every x min watch the input speed for 100 strokes. If it is above a human level, disconnect the HUID.
Just some thoughts that quickly rushed through my mind. Sorry for my bad english, i hope you could guess what i mean ;-)