A Conflict-Aware Active Automata Learning Approach for BLE Device Status Machine Construction
摘要
To identify potential security vulnerabilities in BLE devices, existing automated detection methods, including state machine learning, differential testing, and fuzz testing, face limitations. These approaches struggle with constrained interaction data and lack of timely feedback, making it difficult to accurately learn complex state machine models. Current fuzz testing methods are often restricted to shallow protocol states, overlooking deeper critical behaviors, and the impact of wireless communication can introduce uncertainty in device responses. To address these limitations, this paper introduces a conflict-aware active learning method. Based on the Minimally Adequate Teachers (MAT) framework, we designed a cache tree, discrimination tree, observation tree, and probabilistic model. Using the cache tree, we constructed an initial state machine for the BLE protocol. The discrimination tree generated an active learning query sequence, while the observation tree and probabilistic model were combined to create conflict detection and resolution algorithms. Finally, experiments demonstrated the effectiveness and robustness of the proposed method.