  Bluetooth Low Energy (BLE) has become one of the most popular wireless
communication protocols and is used in billions of smart devices. Despite
several security features, the hardware and software limitations of these
devices makes them vulnerable to man-in-the-middle (MITM) attacks. Due to the
use of these devices in increasingly diverse and safety-critical applications,
the capability to detect MITM attacks has become more critical. To address this
challenge, we propose the use of the response time behavior of a BLE device
observed in relation to select read and write operations and introduce an
activeMITM attack detection system that identifies changes in response time.
Our measurements on several BLE devices show that theirresponse time behavior
exhibits very high regularity, making it a very reliable attack indicator that
cannot be concealed by an attacker. Test results show that our system can very
accurately and quickly detect MITM attacks while requiring a simple learning
approach.
