INTEGRATED APPROACH TO DETECTING BLUETOOTH THREATS USING WIRESHARK AND SPLUNK SIEM

Abstract

In the modern world, the Bluetooth protocol is one of the most widespread wireless communication technologies used to transfer data between various devices, ensuring their mobility and functionality. Despite its numerous advantages, the Bluetooth protocol remains vulnerable to cyber threats such as DoS attacks, spoofing, and malicious file transfer. These threats pose risks to data confidentiality, integrity, and availability. They can also lead to device failures and hazards in critical systems such as medical equipment or IoT infrastructure. This article focuses on an integrated approach to Bluetooth security monitoring that combines the capabilities of Wireshark and Splunk SIEM. The attacker’s platform is based on the Kali Linux operating system, known for its comprehensive capabilities for implementing penetration tests and attack simulations, while the victim’s platform was running Windows 11, a modern operating system widely used in various environments. The main types of attacks analyzed are DoS attacks that cause denial of service due to system overload, spoofing attacks, which allow attackers to disguise their devices as legitimate, and transferring malicious files, which can lead to malicious code. For each type of attack, the corresponding Splunk SIEM correlation rules were developed and configured, which made it possible to automate the process of identifying suspicious activities. Wireshark was used for deep analysis of Bluetooth traffic, and Splunk provided prompt notification of anomalies, allowing a quick response to potential threats. The results of the experiment confirm the effectiveness of the proposed approach. For example, in the case of DoS attacks, a significant excess of L2CAP protocol packets was detected, making it possible to identify the source of the threat promptly. For spoofing attacks, rules for identifying unusual MAC addresses were used, and for the transfer of malicious files, data was filtered by specific criteria, such as file type or sender.