论文标题
具有自动机学习的蓝牙设备的指纹和分析
Fingerprinting and Analysis of Bluetooth Devices with Automata Learning
论文作者
论文摘要
自动机学习是一种自动推断黑盒系统行为模型的技术。当今的学习算法可以推论描述复杂系统属性（例如定时或随机行为）的模型。尽管最近的学习算法的可扩展性提高了，但它们的实际适用性仍然是一个空旷的问题。很少有实际学习物理黑盒系统模型的工作。为了填补文献中的这一空白，我们提出了一项有关在蓝牙低能（BLE）方案上应用自动机学习的案例研究。它表明，不仅系统的大小限制了自动机学习的适用性。 同样，与学习中的系统的互动会产生很少讨论的主要瓶颈。在本文中，我们提出了一种通用的自动机学习体系结构，用于学习由物理设备实现的BLE协议的行为模型。使用此框架，我们可以成功地学习六个研究的BLE设备的行为。此外，我们扩展了学习技术以学习安全关键行为，例如，加密通信的密钥交换程序。博学的模型描述了BLE规范的几种行为差异和不一致。这表明自动机学习可用于指纹识别黑盒设备，即通过其特定学习的模型来表征系统。此外，学习揭示了一种设备的崩溃场景。
Automata learning is a technique to automatically infer behavioral models of black-box systems. Today's learning algorithms enable the deduction of models that describe complex system properties, e.g., timed or stochastic behavior. Despite recent improvements in the scalability of learning algorithms, their practical applicability is still an open issue. Little work exists that actually learns models of physical black-box systems. To fill this gap in the literature, we present a case study on applying automata learning on the Bluetooth Low Energy (BLE) protocol. It shows that not only the size of the system limits the applicability of automata learning. Also, the interaction with the system under learning creates a major bottleneck that is rarely discussed. In this article, we propose a general automata learning architecture for learning a behavioral model of the BLE protocol implemented by a physical device. With this framework, we can successfully learn the behavior of six investigated BLE devices. Furthermore, we extended the learning technique to learn security critical behavior, e.g., key-exchange procedures for encrypted communication. The learned models depict several behavioral differences and inconsistencies to the BLE specification. This shows that automata learning can be used for fingerprinting black-box devices, i.e., characterizing systems via their specific learned models. Moreover, learning revealed a crashing scenario for one device.
