SIROCCO: A Dry Wind to Warn you from Bluetooth Attacks

Bluetooth Low Energy (BLE) has become ubiquitous in Internet of Things (IoT) devices, yet it remains vulnerable to sophisticated over-the-air attacks that can compromise data security. This paper introduces Sirocco, a novel host-based intrusion detection system that leverages the open source Zephyr RTOS to address critical security challenges in BLE communications. Sirocco provides a flexible and lightweight detection framework that integrates with the BLE protocol stack. It targets sophisticated and low-level attacks such as spoofing, signal injection, and key sharing vulnerabilities. By inserting lightweight metric collection functions directly into the BLE stack's interrupt service routines and employing a dedicated kernel thread for analysis, Sirocco minimizes performance overhead while maintaining real-time attack detection capabilities across different device roles. Experimental evaluation demonstrates the system's effectiveness, with the framework introducing minimal performance and power consumption overhead.