Cross-Layer BLE Device-Type Identification via Locality-Sensitive Hashing for IoT Security

Bluetooth Low Energy (BLE) devices are ubiquitous across consumer, industrial, and healthcare IoT ecosystems, yet their resource-constrained nature typically precludes conventional cryptographic authentication, leaving device identification as a security primitive for device management, access control, and threat detection in IoT environments. Current BLE fingerprinting techniques are restricted by rigid cryptographic hashes, machine learning models that require periodic retraining to cover new devices, or single-layer feature sets vulnerable to missing data. In response to these limitations, we introduce a Nilsimsa-based identification approach that performs BLE device type/manufacturer identification through merging link-layer features and advertised GATT service information before network access is granted to cope with missing or inaccessible data. We analyzed various combinations of features from different layers to assess how merging them impacts identification accuracy. The exhaustive analysis uses 10 test objects and 10 reference hashes. The large-scale evaluation uses 5000 test records and 10,000 reference hashes covering 104 device type–manufacturer pairs. Key findings highlight that cross-layer features are important to cope with missing features. The minimum subset size was found at k = 10 with a subset-coverage criterion: at least 95% of all subsets of 10 features reach an accuracy of 90% or more. Our proposal not only facilitates the seamless enrollment of new devices through reference-hash registration without retraining but also enables confidence-based anomaly detection using its similarity score, providing an incrementally extensible approach for BLE security monitoring. Overall, our approach advances BLE fingerprinting by introducing a schema-agnostic, retraining-free, cross-layer identification model tailored for the dynamic environment of IoT deployments.