# Fingerprinting and analysis of Bluetooth devices with automata learning

> Learns Mealy-machine models of Bluetooth Low Energy implementations on physical peripherals by active automata learning. An nRF52840 central running SweynTooth-derived firmware sends abstract BLE inputs, with error handling, repeated queries and caching for lost packets and non-deterministic replies. The authors learn connection-procedure models of six devices and legacy-pairing models of three, and use model differences to fingerprint their SoCs.

- Authors: Andrea Pferscher; Bernhard K. Aichernig
- Venue: Formal Methods in System Design
- Status: Journal article
- Publication / posting date: August 2022
- Date source: Springer-deposited Crossref metadata and the article page give the August 2022 issue date of volume 61, issue 1, represented at month precision; the 22 May 2023 online publication is recorded in metadata notes.
- First arXiv submission: November 29, 2022
- arXiv: 2211.16074
- Reviewed arXiv version: v2
- DOI: 10.1007/s10703-023-00425-y
- Sources reviewed: 2026-10-17
- Added to the catalog: 2026-10-17
- Original paper: <https://doi.org/10.1007/s10703-023-00425-y>
- PDF: <https://arxiv.org/pdf/2211.16074v2>
- Code: <https://github.com/apferscher/ble-learning>
- BibTeX: <https://awesomerea.org/papers/citations/paper-ble-automata-learning.bib>
- Catalog page: <https://awesomerea.org/papers/paper-ble-automata-learning/>
- Record JSON: <https://awesomerea.org/papers/paper-ble-automata-learning/record.json>
- Chinese version: [简体中文](https://awesomerea.org/zh/papers/paper-ble-automata-learning/index.md)

## Scope and limitations

Models are bounded by the chosen abstract alphabet and cover only connection and legacy pairing; message formats are not inferred, and secure pairing is left to future work. Equivalence was approximated with a small number of conformance tests per state, so models are hypotheses, not proofs. One SoC was learnable only with reduced alphabets, two were learned from an already-connected state, and some pairing runs needed manual hard resets. The fingerprinting sequence holds only for the tested SoCs. Apart from one crashing input sequence, the authors report no security vulnerabilities in the learned models.

## Why it fits this collection

Reconstructs the protocol-state behavior of closed BLE implementations through black-box interaction with real devices, showing how learned state machines expose implementation differences and deviations from the specification.

## Publication and review notes

Formal Methods in System Design 61(1), pages 35–62, published online on 22 May 2023 as an open-access CC BY 4.0 article. It extends the authors’ FM 2021 paper ‘Fingerprinting Bluetooth Low Energy Devices via Active Automata Learning’ (LNCS 13047, pages 524–542, DOI 10.1007/978-3-030-90870-6_28). The ble-learning README, linked from AALpy’s applications list, names this article ‘Identification and Analysis of Bluetooth Devices via Automata Learning’, unlike the published title. Springer’s PDF could not be fetched automatically, so its full-text page and arXiv v2, the accepted manuscript, were reviewed. The study used Python 3.9.0, AALpy 1.0.1 and a modified Scapy 2.4.4; the repository, pinned at a 2025 commit, now requires aalpy>=1.1.7 and scapy>=2.4.5. It needs an nRF52840 dongle or development kit flashed with the supplied SweynTooth-derived firmware, and pairing also needs Linux with SweynTooth’s BlueZ-based Security Manager module. The repository has no license file.

## Primary sources

1. <https://doi.org/10.1007/s10703-023-00425-y>
2. <https://api.crossref.org/works/10.1007/s10703-023-00425-y>
3. <https://link.springer.com/article/10.1007/s10703-023-00425-y>
4. <https://arxiv.org/abs/2211.16074>
5. <https://arxiv.org/pdf/2211.16074v2>
6. <https://api.crossref.org/works/10.1007/978-3-030-90870-6_28>
7. <https://github.com/apferscher/ble-learning/blob/febd774109c41a6635659b8847cc766e667841dd/README.md>
8. <https://github.com/apferscher/ble-learning/blob/febd774109c41a6635659b8847cc766e667841dd/requirements.txt>
9. <https://github.com/DES-Lab/AALpy/blob/335c50a1b4b5a830d788f86b7c30a8cb6c73ecc0/README.md>

## About this entry

Reviewed against the paper and its primary sources. Cite the original authors using the linked paper or BibTeX.
Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.