{
  "added_at": "2026-10-17",
  "arxiv_id": "2211.16074",
  "arxiv_version_reviewed": "v2",
  "authors": [
    "Andrea Pferscher",
    "Bernhard K. Aichernig"
  ],
  "bibtex_url": "https://awesomerea.org/papers/citations/paper-ble-automata-learning.bib",
  "code_url": "https://github.com/apferscher/ble-learning",
  "date_basis": "Springer-deposited Crossref metadata and the article page give the August 2022 issue date of volume 61, issue 1, represented at month precision; the 22 May 2023 online publication is recorded in metadata notes.",
  "date_basis_zh": "Springer 向 Crossref 提交的元数据及文章页面将第 61 卷第 1 期的刊期标为 2022 年 8 月，本目录采用月份精度；2023 年 5 月 22 日的在线出版日期另在元数据说明中记录。",
  "date_precision": "month",
  "description_en": "Learns Mealy-machine models of Bluetooth Low Energy implementations on physical peripherals by active automata learning. An nRF52840 central running SweynTooth-derived firmware sends abstract BLE inputs, with error handling, repeated queries and caching for lost packets and non-deterministic replies. The authors learn connection-procedure models of six devices and legacy-pairing models of three, and use model differences to fingerprint their SoCs.",
  "description_zh": "通过主动自动机学习，为实体外设上的低功耗蓝牙（BLE）协议实现推断 Mealy 状态机模型。运行 SweynTooth 衍生固件的 nRF52840 中心设备发送抽象 BLE 输入，并以错误处理、重复查询和缓存应对丢包与不确定的响应。作者学习了六款设备的连接过程模型和其中三款的传统配对（legacy pairing）模型，并利用模型差异识别各设备的 SoC。",
  "doi": "10.1007/s10703-023-00425-y",
  "entry_url": "https://awesomerea.org/papers/paper-ble-automata-learning/",
  "entry_url_zh": "https://awesomerea.org/zh/papers/paper-ble-automata-learning/",
  "evidence_urls": [
    "https://doi.org/10.1007/s10703-023-00425-y",
    "https://api.crossref.org/works/10.1007/s10703-023-00425-y",
    "https://link.springer.com/article/10.1007/s10703-023-00425-y",
    "https://arxiv.org/abs/2211.16074",
    "https://arxiv.org/pdf/2211.16074v2",
    "https://api.crossref.org/works/10.1007/978-3-030-90870-6_28",
    "https://github.com/apferscher/ble-learning/blob/febd774109c41a6635659b8847cc766e667841dd/README.md",
    "https://github.com/apferscher/ble-learning/blob/febd774109c41a6635659b8847cc766e667841dd/requirements.txt",
    "https://github.com/DES-Lab/AALpy/blob/335c50a1b4b5a830d788f86b7c30a8cb6c73ecc0/README.md"
  ],
  "first_arxiv_date": "2022-11-29",
  "id": "paper-ble-automata-learning",
  "json_url": "https://awesomerea.org/papers/paper-ble-automata-learning/record.json",
  "kind": "research",
  "markdown_url": "https://awesomerea.org/papers/paper-ble-automata-learning/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/papers/paper-ble-automata-learning/index.md",
  "metadata_notes": "Formal Methods in System Design 61(1), pages 35–62, published online on 22 May 2023 as an open-access CC BY 4.0 article. It extends the authors’ FM 2021 paper ‘Fingerprinting Bluetooth Low Energy Devices via Active Automata Learning’ (LNCS 13047, pages 524–542, DOI 10.1007/978-3-030-90870-6_28). The ble-learning README, linked from AALpy’s applications list, names this article ‘Identification and Analysis of Bluetooth Devices via Automata Learning’, unlike the published title. Springer’s PDF could not be fetched automatically, so its full-text page and arXiv v2, the accepted manuscript, were reviewed. The study used Python 3.9.0, AALpy 1.0.1 and a modified Scapy 2.4.4; the repository, pinned at a 2025 commit, now requires aalpy>=1.1.7 and scapy>=2.4.5. It needs an nRF52840 dongle or development kit flashed with the supplied SweynTooth-derived firmware, and pairing also needs Linux with SweynTooth’s BlueZ-based Security Manager module. The repository has no license file.",
  "metadata_notes_zh": "发表于 Formal Methods in System Design 第 61 卷第 1 期，35–62 页，于 2023 年 5 月 22 日在线出版，为 CC BY 4.0 开放获取论文。本文是作者 FM 2021 论文“Fingerprinting Bluetooth Low Energy Devices via Active Automata Learning”（LNCS 13047，524–542 页，DOI 10.1007/978-3-030-90870-6_28）的扩展版。AALpy 应用列表链接的 ble-learning README 将本文称为“Identification and Analysis of Bluetooth Devices via Automata Learning”，与正式标题不同。Springer 的 PDF 无法自动获取，因此核查的是出版方全文页面和 arXiv v2（作者接收稿）。研究使用 Python 3.9.0、AALpy 1.0.1 和修改版 Scapy 2.4.4；固定在 2025 年提交的仓库目前要求 aalpy>=1.1.7 和 scapy>=2.4.5。运行需要一块刷入仓库所附 SweynTooth 衍生固件的 nRF52840 Dongle 或开发板，配对实验另需 Linux 及 SweynTooth 基于 BlueZ 的安全管理器（Security Manager）模块。仓库没有许可证文件。",
  "pdf_url": "https://arxiv.org/pdf/2211.16074v2",
  "project_url": null,
  "publication_date": "2022-08",
  "publication_status": "journal-article",
  "record_type": "paper",
  "runtime_tested": false,
  "scope_limitations_en": "Models are bounded by the chosen abstract alphabet and cover only connection and legacy pairing; message formats are not inferred, and secure pairing is left to future work. Equivalence was approximated with a small number of conformance tests per state, so models are hypotheses, not proofs. One SoC was learnable only with reduced alphabets, two were learned from an already-connected state, and some pairing runs needed manual hard resets. The fingerprinting sequence holds only for the tested SoCs. Apart from one crashing input sequence, the authors report no security vulnerabilities in the learned models.",
  "scope_limitations_zh": "模型受所选抽象输入字母表限制，仅覆盖连接过程和传统配对；不推断报文格式，安全配对留待后续研究。等价性仅以每个状态少量的一致性测试近似检验，因此模型只是假设而非证明。其中一款 SoC 只能缩减输入字母表后学习，两款设备从已建立连接的状态开始学习，部分配对实验还需人工硬重置设备。所得指纹识别序列仅适用于受测 SoC。除一条会导致设备崩溃的输入序列外，作者未在学习所得模型中发现安全漏洞。",
  "targets": [
    "protocol"
  ],
  "title": "Fingerprinting and analysis of Bluetooth devices with automata learning",
  "title_zh": "基于自动机学习的蓝牙设备指纹识别与分析",
  "url": "https://doi.org/10.1007/s10703-023-00425-y",
  "venue": "Formal Methods in System Design",
  "verification": "source-reviewed",
  "verified_at": "2026-10-17",
  "why_fits_en": "Reconstructs the protocol-state behavior of closed BLE implementations through black-box interaction with real devices, showing how learned state machines expose implementation differences and deviations from the specification.",
  "why_fits_zh": "通过与真实设备的黑盒交互重建封闭 BLE 实现的协议状态行为，展示学习所得的状态机如何揭示不同实现之间的差异及其与规范的偏离。",
  "year": 2022
}