Fingerprinting Bluetooth Low Energy Devices via Active Automata Learning

Abstract

Automata learning is a technique to automatically infer behavioral models of black-box systems. Today's learning algorithms enable the deduction of models that describe complex system properties, e.g., timed or stochastic behavior. Despite recent improvements in the scalability of learning algorithms, their practical applicability is still an open issue. Little work exists that actually learns models of physical black-box systems. To fill this gap in the literature, we present a case study on applying automata learning on the Bluetooth Low Energy (BLE) protocol. It shows that not only the size of the system limits the applicability of automata learning. Also, the interaction with the system under learning creates a major bottleneck that is rarely discussed. In this article, we propose a general automata learning architecture for learning a behavioral model of the BLE protocol implemented by a physical device. With this framework, we can successfully learn the behavior of six investigated BLE devices. Furthermore, we extended the learning technique to learn security critical behavior, e.g., key-exchange procedures for encrypted communication. The learned models depict several behavioral differences and inconsistencies to the BLE specification. This shows that automata learning can be used for fingerprinting black-box devices, i.e., characterizing systems via their specific learned models. Moreover, learning revealed a crashing scenario for one device.

Active vs. Passive: A Comparison of Automata Learning Paradigms for Network Protocols

“…To maintain our black-box assumption, we do not access any further properties of the given models. Our previous work [28] introduces the BLE case study which we extended in a follow-up work [29] by learning-based fuzzing. For this evaluation, we consider the BLE devices from our learning-based fuzzing case study [29].…”

“…Note that passive learning algorithms can only model behavior that is included in Note that after the initiation of the connection both devices could send requests that must be replied to by the other party. This figure is taken from [28].…”

“…From the practical perspective, previous work [28,36] showed that active automata learning could successfully create behavioral models of the actual black-box systems. However, the required active interaction and the error recovery mechanisms during learning hampered the applicability of active learning.…”

“…To treat non-deterministic behavior, the implementation of faulttolerant mechanisms is necessary. Such mechanisms [28,13] include, e.g., the repetition of queries or the introduction of a cache to determine the correct output for a repeated input.…”

AALpy: an active automata learning library

“…The literature frequently denotes learning-based testing techniques on communication protocols as state fuzzing. Recently, Pferscher and Aichernig [28] used AALpy to learn the connection interface of BLE devices. Using a learning library implemented in Python creates the opportunity for a smooth integration of handy communication package libraries like Scapy [31].…”