Traffic and threat classification for short-range wireless channels

Abstract

Systems and methods can support identifying threats in short-range wireless communications, such as Bluetooth, using one or more radio frequency sensors to receive signals transmitted between a master device and a slave device. Packets can be identified within the received signals and designated as originating from the master device or from the slave device. The wireless interface can be identified as synchronous or asynchronous. Lengths of data may be identified for data payloads within the packets. Total aggregate data lengths may be calculated for both the master and the slave transmissions. Time slot utilization statistics can be computed. A connection type category may be determined using these wireless connection features. The connection type may be for peripherals, streaming audio, two-way headsets, object exchange, data tethering, and so forth. Potential security threats associated with the wireless interface may be identified from the determined connection type and from the wireless connection features.