2022 · Journal article
Fingerprinting and analysis of Bluetooth devices with automata learning
Learns Mealy-machine models of Bluetooth Low Energy implementations on physical peripherals by active automata learning. An nRF52840 central running SweynTooth-derived firmware sends abstract BLE inputs, with error handling, repeated queries and caching for lost packets and non-deterministic replies. The authors learn connection-procedure models of six devices and legacy-pairing models of three, and use model differences to fingerprint their SoCs.
Scope and limitations
Models are bounded by the chosen abstract alphabet and cover only connection and legacy pairing; message formats are not inferred, and secure pairing is left to future work. Equivalence was approximated with a small number of conformance tests per state, so models are hypotheses, not proofs. One SoC was learnable only with reduced alphabets, two were learned from an already-connected state, and some pairing runs needed manual hard resets. The fingerprinting sequence holds only for the tested SoCs. Apart from one crashing input sequence, the authors report no security vulnerabilities in the learned models.
Why it fits this collection
Reconstructs the protocol-state behavior of closed BLE implementations through black-box interaction with real devices, showing how learned state machines expose implementation differences and deviations from the specification.
Publication and review details
- Venue
- Formal Methods in System Design
- Status
- Journal article
- Publication / posting date
- August 2022
- Date source
- Springer-deposited Crossref metadata and the article page give the August 2022 issue date of volume 61, issue 1, represented at month precision; the 22 May 2023 online publication is recorded in metadata notes.
- First arXiv submission
- November 29, 2022
- arXiv
- 2211.16074
- Reviewed arXiv version
- v2
- DOI
- 10.1007/s10703-023-00425-y
Formal Methods in System Design 61(1), pages 35–62, published online on 22 May 2023 as an open-access CC BY 4.0 article. It extends the authors’ FM 2021 paper ‘Fingerprinting Bluetooth Low Energy Devices via Active Automata Learning’ (LNCS 13047, pages 524–542, DOI 10.1007/978-3-030-90870-6_28), which is not listed separately because no open copy was verified. The ble-learning README, linked from AALpy’s applications list, names this article ‘Identification and Analysis of Bluetooth Devices via Automata Learning’, unlike the published title. Springer’s PDF could not be fetched automatically, so its full-text page and arXiv v2, the accepted manuscript, were reviewed. The study used Python 3.9.0, AALpy 1.0.1 and a modified Scapy 2.4.4; the repository, pinned at a 2025 commit, now requires aalpy>=1.1.7 and scapy>=2.4.5. It needs an nRF52840 dongle or development kit flashed with the supplied SweynTooth-derived firmware, and pairing also needs Linux with SweynTooth’s BlueZ-based Security Manager module. The repository has no license file, so no reuse license is implied. No learning experiments were run.
Sources reviewed
Source review only; experiments were not rerun for this collection. Cite the original authors using the linked paper or BibTeX.
Primary sources
- https://doi.org/10.1007/s10703-023-00425-y
- https://api.crossref.org/works/10.1007/s10703-023-00425-y
- https://link.springer.com/article/10.1007/s10703-023-00425-y
- https://arxiv.org/abs/2211.16074
- https://arxiv.org/pdf/2211.16074v2
- https://api.crossref.org/works/10.1007/978-3-030-90870-6_28
- https://github.com/apferscher/ble-learning/blob/febd774109c41a6635659b8847cc766e667841dd/README.md
- https://github.com/apferscher/ble-learning/blob/febd774109c41a6635659b8847cc766e667841dd/requirements.txt
- https://github.com/DES-Lab/AALpy/blob/335c50a1b4b5a830d788f86b7c30a8cb6c73ecc0/README.md