Security-Bag: A Specification-based Intrusion Detection System Applied to Star Topology BLE Networks

Bluetooth Low Energy (BLE), a protocol widely used in IoT applications, enables efficient data exchange with low-cost, resource-constrained devices. Unfortunately, BLE’s numerous vulnerabilities and poor vendor patching policies, combined with the lack of seamless update mechanisms for BLE devices, expose these systems to various wireless attacks, jeopardizing the safety and security of IoT applications. This underscores the need for an Intrusion Detection System (IDS). However, IPbased IDS systems have limited BLE attack detection scope, and existing BLE-specific IDS solutions, particularly those using unreliable, Received Signal Strength Indication (RSSI)-dependent sniffers/probes and static thresholds in attack detection, suffer from limitations due to the dynamic aspects of BLE devices, such as device mobility and connection parameters update, in their designs. In this paper, we propose the Security Bag component: a specification-based IDS applied to star topology BLE networks that implements security rules derived from the BLE specifications. We validate this Security Bag by simulating spoofing attacks on a BLE sensor node using the Contiki Cooja simulator. The obtained results show that the Security Bag promptly detects the injected attack, opening avenues for applications on other wireless networks and deployment in real systems.