Beyond Signatures: A hybrid framework for privacy and security analysis of BLE advertising traffic in heterogeneous IoT environments

The security and privacy of wireless channels represent a critical challenge in IoT ecosystems. Bluetooth Low Energy (BLE) advertising constitutes a sensitive attack surface: a high-frequency, passively observable stream emitted by smartphones, wearables, and smart-home devices, where unauthorized identity exposure and behavioral inference pose significant risks. Yet BLE traffic analysis remains dominated by signature-based reasoning: packets matching known structures are decoded, while traffic outside available signatures is left unresolved, a key limitation in heterogeneous IoT deployments. This paper presents Beyond Signatures, a hybrid framework combining cross-ecosystem parsing, one-class anomaly detection, density-based clustering, and supervised fingerprinting. The central premise is that unresolved BLE traffic should be treated as an analytical target whose uncertainty is progressively reduced, rather than as a residual parsing failure. The framework is evaluated on 290,409 BLE advertising packets from 51 real captures. The parsing stage achieves a decoded rate of 90.33%. A one-class autoencoder achieves a false-positive rate of 3.14% on held-out devices, detects 76.33% of Unknown traffic, and separates 97.73% of known non-core traffic. Density-based clustering organizes anomalous traffic into 57 coherent families from 1,945 unique payloads. A debiased Random Forest attribution layer interprets a substantial fraction of Unknown traffic as likely-known or uncertain-known while preserving a genuinely unexplained residual. Beyond Signatures outperforms a narrow signature-based baseline: covered rate rises from 55.36% to 97.71%, and actionable rate reaches 93.99%. Concrete findings include clear-text name leakage, stable identifier-like structures, and undocumented payload format, with implications for IoT security auditing, wireless forensics, and smart-environment privacy monitoring.