Fingerprinting Bluetooth Low Energy Devices via Active Automata Learning

Andrea Pferscher*, Bernhard Aichernig

*Corresponding author for this work

Research output: Chapter in Book/Report/Conference proceedingConference paperpeer-review


Active automata learning is a technique to automatically infer behavioral models of black-box systems. Today’s learning algorithms enable the deduction of models that describe complex system properties, e.g., timed or stochastic behavior. Despite recent improvements in the scalability of learning algorithms, their practical applicability is still an open issue. Little work exists that actually learns models of physical black-box systems. To fill this gap in the literature, we present a case study on applying automata learning on the Bluetooth Low Energy (BLE) protocol. It shows that not the size of the system limits the applicability of automata learning. Instead, the interaction with the system under learning, is a major bottleneck that is rarely discussed. In this paper, we propose a general automata learning architecture for learning a behavioral model of the BLE protocol implemented by a physical device. With this framework, we can successfully learn the behavior of five investigated BLE devices. The learned models reveal several behavioral differences. This shows that automata learning can be used for fingerprinting black-box devices, i.e., identifying systems via their specific learned models. Based on the fingerprint, an attacker may exploit vulnerabilities specific to a device
Original languageEnglish
Title of host publicationFormal Methods - 24th International Symposium, FM 2021, Proceedings
EditorsMarieke Huisman, Corina Păsăreanu, Naijun Zhan
Place of PublicationCham
Number of pages19
ISBN (Electronic)978-3-030-90870-6
ISBN (Print)978-3-030-90869-0
Publication statusPublished - 2021
Event24th International Symposium on Formal Methods: FM' 2021 - Virtuell, China
Duration: 20 Nov 202126 Nov 2021

Publication series

NameLecture Notes in Computer Science
ISSN (Print)0302-9743
ISSN (Electronic)1611-3349


Conference24th International Symposium on Formal Methods
Abbreviated titleFM' 2021


  • Active automata learning
  • Bluetooth Low Energy
  • Fingerprinting
  • IoT
  • Learning-based testing
  • Model inference

ASJC Scopus subject areas

  • Theoretical Computer Science
  • Computer Science(all)

Cite this