Learning to Link: Automatic Re-identification of BLE Devices Under MAC Address Randomisation

arXiv:2609.26079 · cs.CR · Submitted 2026-09-17 · Read on arXiv

cs.CR

Submitted: 2026-09-17

Updated: 2026-09-28

Comments: Accepted at WTMC 2026

DOI: 10.1145/3846375.3849104

License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/

Terminology

• Trace — 51× in this paper · explained in 2 episodes
• Advertising Data — 10× in this paper
• Bluetooth Low Energy — 8× in this paper
• Fingerprinting — 6× in this paper · explained in 2 episodes
• Resolvable Private Address — 5× in this paper
• Aggregation — 4× in this paper · explained in 1 episode
• Feature Extraction — 2× in this paper · explained in 2 episodes
• Identity Resolution Key — 2× in this paper
• Interpretability — 2× in this paper · explained in 15 episodes
• Alignment — 1× in this paper · explained in 1 episode
• BLE Extended Advertising — 1× in this paper
• Clustering — 1× in this paper · explained in 2 episodes
• Core — 1× in this paper · explained in 2 episodes
• Information Leakage — 1× in this paper · explained in 2 episodes
• Non-Resolvable Private Address — 1× in this paper
• Robustness — 1× in this paper · explained in 5 episodes

Sources

• IoTSense: Behavioral Fingerprinting of IoT Devices
• A Study of MAC Address Randomization in Mobile Devices and When it Fails
• Securing Bluetooth Low Energy: A Literature Review

Related papers

• SoK: AI-Augmented Binary Reversing
• Relaxed Sender Anonymity for CBDC Interbank Settlement: A Zero-Knowledge Approach on Permissioned EVM
• Calibration-Family Overfit: Why Trusted Sabotage Monitors Don't Transfer Across Lineages
• Efficient Fuzzy PSI under One-Sided Assumptions
• Sealing the Audit-Runtime Gap for LLM Skills
• Token Composition: A Graph Based on EVM Logs