Fingerprinting and Analysis of Bluetooth Devices with Automata Learning

TL;DR

This paper demonstrates how automata learning can be applied to model and analyze Bluetooth Low Energy devices, revealing behavioral differences, security issues, and potential for device fingerprinting.

Contribution

It introduces a general automata learning framework for BLE devices, including security-critical behaviors, and shows its effectiveness in modeling and analyzing physical black-box systems.

Findings

Successfully learned models for six BLE devices

Identified behavioral differences and inconsistencies with specifications

Discovered a crashing scenario in one device

Abstract

Automata learning is a technique to automatically infer behavioral models of black-box systems. Today's learning algorithms enable the deduction of models that describe complex system properties, e.g., timed or stochastic behavior. Despite recent improvements in the scalability of learning algorithms, their practical applicability is still an open issue. Little work exists that actually learns models of physical black-box systems. To fill this gap in the literature, we present a case study on applying automata learning on the Bluetooth Low Energy (BLE) protocol. It shows that not only the size of the system limits the applicability of automata learning. Also, the interaction with the system under learning creates a major bottleneck that is rarely discussed. In this article, we propose a general automata learning architecture for learning a behavioral model of the BLE protocol implemented by a physical device. With this framework, we can successfully learn the behavior of six investigated BLE devices. Furthermore, we extended the learning technique to learn security critical behavior, e.g., key-exchange procedures for encrypted communication. The learned models depict several behavioral differences and inconsistencies to the BLE specification. This shows that automata learning can be used for fingerprinting black-box devices, i.e., characterizing systems via their specific learned models. Moreover, learning revealed a crashing scenario for one device.