A method and device for identifying and dynamically blocking illegal access of a Bluetooth device

Abstract

The application discloses a kind of illegal access hardware identification and dynamic blocking method and device of bluetooth device, it is related to artificial intelligence technical field, the method includes the steady-state current response waveform and radio frequency IQ baseband signal of synchronous acquisition bluetooth device;Signal is preprocessed and respectively extracts cyclic stationary feature and joint time-frequency-cyclic feature;Adaptive multi-source feature fusion network of fusion channel and spatial attention is constructed, and classification is carried out in combination with double-branch convolution, protocol perception feature modulator and multi-scale hollow convolution pyramid.The application realizes multidimensional perception and cross-domain feature fusion of hardware fingerprint, enhances abnormal discrimination by protocol perception modulation, realizes the feature normalization of different working modes of same hardware and illegal equipment feature abnormal amplification, forms end-to-end active defense system from feature extraction to dynamic blocking.

Description

Technical Field

[0001] This invention relates to the field of artificial intelligence technology, and in particular to a method and apparatus for identifying and dynamically blocking unauthorized access to Bluetooth devices. Background Technology

[0002] With the rapid development of the Internet of Things (IoT) and mobile communications, Bluetooth technology has become one of the mainstream standards for short-range communication in various devices, widely used in consumer electronics, smart homes, industrial control, and medical equipment. However, the Bluetooth protocol, initially designed with ease of use and interoperability in mind, has inherent weaknesses in authentication and hardware security. Traditional Bluetooth security mechanisms rely primarily on link-layer pairing keys and encryption algorithms, but these methods often only verify the correctness of the protocol logic, not the uniqueness of the physical hardware. This has led to a surge in hardware clones, software imitations, and unauthorized Bluetooth devices on the market. These devices can easily access protected networks through protocol-level imitation, stealing sensitive data, launching man-in-the-middle attacks, or causing service disruptions, posing a serious threat to personal privacy, corporate assets, and even critical infrastructure.

[0003] The main shortcomings of existing technologies are as follows: they typically rely on a single signal source (such as radio frequency only or power consumption only), lacking cross-physical domain hardware feature fusion, resulting in insufficient distinguishing features for counterfeit hardware; feature extraction often uses conventional time-frequency transformation (such as short-time Fourier transform), ignoring the cyclostationary statistical characteristics in the signal, making it difficult to capture the periodic modulation patterns of hardware circuits and radio frequency; the identification models are mostly general neural network architectures, failing to consider the dynamic impact of Bluetooth protocol status on hardware response, and lacking dedicated convolutional designs for the spatiotemporal-frequency structure of hardware fingerprints; security mechanisms mostly remain at the offline identification stage, failing to form a closed loop with real-time blocking control, and lacking the ability to actively interfere with and dynamically defend against unauthorized access. Summary of the Invention

[0004] To address the technical problems in the prior art, the present invention provides a method and apparatus for identifying and dynamically blocking unauthorized access to Bluetooth devices.

[0005] This invention is achieved through the following technical solution:

[0006] A method for identifying and dynamically blocking unauthorized access to Bluetooth devices includes:

[0007] S1. Multi-source waveform data acquisition and training dataset construction: This includes acquiring steady-state current response waveforms and RF IQ baseband signal data and constructing a dataset proportionally.

[0008] S2. Signal preprocessing and feature extraction: This includes preprocessing, aligning, and denoising the original steady-state current response waveform and RF IQ baseband signal data, and extracting the cyclostationary features of the steady-state current response waveform and the joint time-frequency-cyclostationary features of the RF IQ baseband signal to form a preliminary joint feature tensor.

[0009] S3. Construction of a hardware identification model for illegal access to Bluetooth devices: This includes adaptive multi-source feature fusion based on channel attention and spatial attention mechanisms; and the construction and training of a model for Bluetooth device legality classification based on a neural network composed of a dual-branch convolutional module, a protocol-aware feature modulator, and a multi-scale dilated convolutional pyramid.

[0010] S4. Illegal Bluetooth Device Access Hardware Identification: This includes identifying Bluetooth devices attempting to access the network or communicate with monitoring devices based on a trained Bluetooth device illegal access hardware identification model. If the device is determined to be illegal, the blocking decision engine immediately generates a blocking command according to the preset security policy.

[0011] Furthermore, the cyclic stationary characteristics of the waveform are determined by the cyclic stationary characteristic spectrum of the steady-state current response waveform.

[0012] Furthermore, the joint time-frequency-cyclic features of the radio frequency IQ baseband signal are analyzed by performing cyclic spectrum analysis on the complex time-frequency matrix of the signal, extracting the cyclic spectrum feature tensor to obtain a three-dimensional complex feature tensor, separating the three-dimensional complex feature tensor into a real part tensor and an imaginary part tensor, and splicing them along the channel dimension to form the IQ joint real feature tensor.

[0013] Furthermore, the adaptive multi-source feature fusion based on channel attention and spatial attention mechanisms includes generating a channel attention weight map, generating a spatial attention weight map, and broadcasting the channel attention weight map and spatial attention weight map to the same dimension as the initial joint feature tensor, and then performing element-wise multiplication to obtain the enhanced feature tensor, as expressed below:

[0014]

[0015] In the formula, Represents the augmented feature tensor. This represents the channel attention weight map. Represents the spatial attention weight map. This indicates element-wise multiplication.

[0016] Furthermore, the channel attention weight map obtains the channel descriptor vector by performing global average pooling on the preliminary joint feature tensor, then learns the channel dependencies through two fully connected layers and the ReLU activation function, and finally generates it using the Sigmoid activation function;

[0017] The spatial attention weight map is obtained by performing average pooling and max pooling along the channel dimension on the preliminary joint feature tensor, respectively, to obtain two spatial feature maps. These two spatial feature maps are then concatenated and spatial information is fused through a convolutional layer. Finally, the Sigmoid activation function is used to generate the weight map.

[0018] Furthermore, the dual-branch convolutional module uses temporal strip convolutional kernels, frequency-shifted strip convolutional kernels, and square convolutional kernels respectively for parallel feature extraction, as shown below:

[0019]

[0020] In the formula, Indicates the first The output feature map of each dual-branch convolutional module; Indicates the layer index of the dual-branch convolutional module; Indicates batch standardized operations; This represents a square convolution operation with a kernel height of . Width is ; This represents a temporal strip convolution operation; This represents a frequency-shifted strip convolution operation; This represents an element-wise addition operation; Indicates input to the first The feature maps of each convolutional module; for the first convolutional module, its input... To enhance the feature tensor .

[0021] Furthermore, the protocol-aware feature modulator encodes the protocol state parsed from the synchronously captured data packets into a protocol state vector, and uses it as a modulation signal to generate channel scaling factors and bias vectors through a lightweight modulation network to perform adaptive channel modulation on the convolutional features.

[0022] Furthermore, the multi-scale dilated convolutional pyramid uses multiple convolutional layers with different dilation rates in parallel to process the protocol-aware modulated features, and then concatenates the outputs along the channel dimension and fuses them through convolution, as shown below:

[0023]

[0024] In the formula, Indicates the first Output feature map of multi-scale fusion; express Convolution operation; This indicates a splicing operation along the channel dimension; This represents a dilated convolution operation with a kernel height of . Width is void ratio ; This represents the void ratio parameter; Indicates the first after protocol-sensing modulation Layer feature map.

[0025] The present invention also provides a device for identifying and dynamically blocking unauthorized access to Bluetooth devices, based on the method for identifying and dynamically blocking unauthorized access to Bluetooth devices as described above, comprising:

[0026] A multi-source waveform data acquisition and training dataset construction module is used to acquire steady-state current response waveforms and RF IQ baseband signal data and divide them into training set, validation set and test set according to the proportions.

[0027] The signal preprocessing and feature extraction module is used for cyclic stationary feature extraction of steady-state current response waveform and joint time-frequency-cyclic feature construction of RF IQ baseband signal to form a preliminary joint feature tensor.

[0028] The module for constructing a Bluetooth device illegal access hardware identification model is used for adaptive multi-source feature fusion and enhancement. It constructs and trains a Bluetooth device illegal access hardware identification model based on a neural network model composed of a dual-branch convolution module, a protocol-aware feature modulator, and a multi-scale dilated convolution pyramid.

[0029] The Bluetooth device illegal access hardware identification module is used to identify Bluetooth devices illegally accessing hardware based on a trained model, and outputs the result of the legality judgment of the hardware identity of the device.

[0030] Furthermore, to achieve the above objectives, the present invention also provides a computer-readable storage medium storing program instructions for a method for identifying and dynamically blocking unauthorized access to Bluetooth devices. These program instructions can be executed by one or more processors to implement the steps of the method described above.

[0031] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0032] 1) By synchronously collecting the steady-state current response in the circuit domain and the IQ baseband signal in the radio frequency domain of Bluetooth devices, a multi-source training dataset across physical domains is constructed, realizing multi-dimensional perception of hardware fingerprints;

[0033] 2) Based on the physical characteristics of the two signals, a method for extracting cyclostationary features and constructing complex time-frequency-cyclospectral joint features was designed, which breaks through the limitation of traditional time-frequency analysis in its inability to distinguish subtle hardware defects.

[0034] 3) A protocol-aware dynamic feature modulation mechanism is proposed, which integrates the Bluetooth protocol stack state vector as context information into the neural network to achieve feature normalization for different working modes of the same hardware and amplification of abnormal features of illegal devices.

[0035] 4) Construct an adaptive neural network that integrates bi-branch convolution, multi-scale dilated convolution and attention mechanism, and optimize it specifically for the cross-domain correlation, multi-scale characteristics and noise sensitivity of hardware fingerprints, forming an end-to-end active defense system from feature extraction to dynamic blocking. Attached Figure Description

[0036] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0037] Figure 1 This is a schematic flowchart of a method for identifying and dynamically blocking unauthorized access to Bluetooth devices according to an embodiment of this application;

[0038] Figure 2 This is a schematic flowchart of a multi-source waveform data preprocessing and joint time-frequency-cyclic stationary feature extraction method according to an embodiment of this application;

[0039] Figure 3 This is a scatter plot showing the spatial distribution of features of legitimate and illegitimate devices according to embodiments of this application;

[0040] Figure 4 This is a kernel density map of the feature spatial distribution of legal and illegal devices according to embodiments of this application;

[0041] Figure 5 This is a schematic flowchart of a method for identifying unauthorized access to hardware by a Bluetooth device according to an embodiment of this application. Detailed Implementation

[0042] The embodiments of the present invention will now be described in detail with reference to the accompanying drawings.

[0043] The following specific examples illustrate the implementation of the present invention. Those skilled in the art can easily understand other advantages and effects of the present invention from the content disclosed in this specification. Obviously, the described embodiments are only a part of the embodiments of the present invention, and not all of them. The present invention can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed based on different viewpoints and applications without departing from the spirit of the present invention. It should be noted that, in the absence of conflict, the following embodiments and features in the embodiments can be combined with each other. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are within the scope of protection of the present invention.

[0044] It should also be noted that the illustrations provided in the following embodiments are only schematic representations of the basic concept of the present invention. The illustrations only show the components related to the present invention and are not drawn according to the actual number, shape and size of the components in the actual implementation. In the actual implementation, the shape, quantity and proportion of each component can be arbitrarily changed, and the layout of the components may also be more complex.

[0045] See Figure 1 A method for identifying and dynamically blocking unauthorized access to Bluetooth devices includes the following steps:

[0046] S1. Multi-source waveform data acquisition and training dataset construction

[0047] The differences in steady-state current response waveforms and RF IQ baseband signals exhibited by legitimate and illegitimate devices (counterfeit / cloned devices) fundamentally stem from physical and non-ideal differences in the hardware manufacturing process (i.e., "hardware fingerprints" or "physical non-cloning characteristics"). Software and protocol-level differences are secondary and can be circumvented, but hardware physical differences are inherent and difficult to completely replicate. Due to the physical characteristics of hardware manufacturing, semiconductor process deviations, passive component tolerances, PCB layout and parasitic parameters, and antenna characteristics, these physical differences are random, unique, and relatively stable throughout the device's lifecycle. They directly and inevitably map onto two types of signals during device operation:

[0048] 1) Steady-state current response waveform: When digital circuits (such as Bluetooth baseband processors) perform different operations (scanning, connecting, encryption), the switching states of their millions of transistors vary, resulting in a unique, dynamic "power fingerprint" of the current drawn from the power supply, synchronized with the clock and protocol frames. Hardware clones cannot replicate the transistor-level switching characteristics of the original device.

[0049] 2) RF IQ baseband signals: Physical defects in RF front-end circuits (such as voltage-controlled oscillators, mixers, and power amplifiers) can introduce unique nonlinear distortion, phase noise, I / Q imbalance (inconsistent amplitude and phase of the two quadrature modulation signals), and carrier leakage. These are the "RF fingerprints" of the hardware, which are difficult for high-quality replicas to completely replicate.

[0050] It is important to emphasize that a highly sophisticated counterfeit device aims to perfectly mimic the legitimate device at the protocol and behavioral levels to pass authentication. Therefore, the innovation and value of this invention lies in its focus on the hard-to-forge physical hardware characteristics, rather than relying on easily cloned or simulated software / protocol layer features. In other words, no matter how well a counterfeit device disguises itself in terms of software and behavior, its unique hardware characteristics are difficult to fake, thus allowing the system to accurately identify it.

[0051] In a controlled laboratory environment, multi-source waveform data were synchronously acquired from various Bluetooth devices of known identities and origins. Specifically, the acquisition system consisted of a high-precision current probe and a software-defined radio platform, used to capture the steady-state current response waveform and the radio frequency IQ baseband signal transmitted over the air, respectively. During the acquisition process, the Bluetooth devices under test (including legitimate devices from authorized manufacturers and counterfeit, cloned, or other illegal hardware obtained from the market) were placed in standard operating mode and instructed to perform a series of communication tasks covering different protocol stack states (such as scanning, connection establishment, and encrypted data transmission). The current probe was connected in series with the device's power supply circuit at a high sampling rate to capture the dynamic current consumption of its circuit board during communication, forming the raw steady-state current response waveform data. Simultaneously, the software-defined radio platform was configured in the Bluetooth operating frequency band to capture the Bluetooth radio frequency signal in the air using a synchronized clock reference. After down-conversion and demodulation, the raw radio frequency IQ baseband signal data for the same time period was obtained. Ensuring strict time synchronization of the acquisition of the two signals is the foundation for subsequent joint analysis.

[0052] After the raw data collection is completed, it needs to be labeled. The labeling is based on the known source and identity of the devices: all devices from authorized manufacturers and that have been certified are labeled as "legitimate devices"; while all devices from unauthorized channels, hardware clones, or software counterfeits are labeled as "illegal devices".

[0053] In addition, to enrich the model's context awareness capabilities, it is also necessary to parse the Bluetooth protocol stack state information (such as connection status, whether it is encrypted, data packet type, etc.) corresponding to each segment of data from the captured data packets, and encode it into a protocol state vector, which is then stored as auxiliary information in association with the waveform data.

[0054] All synchronously acquired steady-state current response waveforms and RF IQ baseband signal data pairs with clear device legitimacy labels and protocol state vectors are divided into training sets, validation sets, and test sets according to proportions, thereby constructing a complete multi-source waveform training dataset that can be used for supervised learning.

[0055] S2. Multi-source waveform data preprocessing and joint time-frequency-cyclic stationary feature extraction

[0056] The training data consists of synchronously acquired steady-state current response waveforms and RF IQ baseband signals. These two signals originate from the circuit current domain and the RF complex baseband domain, respectively. They are characterized by being cross-physical domains, high-dimensional, and susceptible to environmental noise and hardware nonlinear distortion. Conventional techniques simply splice the two signals after performing short-time Fourier transforms, failing to effectively extract the cyclostationary characteristics of the steady-state current response waveform determined by the nonlinearity of the hardware circuit. This also destroys the joint structural information of the complex domain of the RF IQ baseband signal, resulting in insufficient ability to distinguish subtle waveform differences generated by counterfeit hardware.

[0057] This invention preprocesses, aligns, and denoises the raw dual-stream waveform data, and simultaneously extracts the cyclostationary characteristics of the steady-state current response waveform and the joint time-frequency-cyclic characteristics of the RF IQ baseband signal to fully exploit the hardware fingerprint information contained in different physical domains. Specific steps are as follows: Figure 2 As shown, it includes:

[0058] S201. Extraction of cyclic stationary features of steady-state current response waveform;

[0059] The statistical characteristics inherent in the steady-state current response waveform exhibit cyclostationarity due to the periodic frame structure of Bluetooth communication. This is a unique modulation feature of the hardware circuit. By calculating its cyclic spectrum to extract the cyclostationar features, robust extraction of the periodic modulation mode of the hardware circuit can be achieved, enhancing the ability to distinguish subtle waveform differences in high-quality counterfeit hardware. This can be represented as:

[0060]

[0061] In the formula, The cyclostationary characteristic spectrum of the steady-state current response waveform In time index and cycle frequency The value at that location represents a specific time delay. The second-order cyclic autocorrelation intensity can keenly capture the periodic modulation patterns of hardware circuits. It is a three-dimensional tensor with dimension . ;

[0062] This represents a time index, with a value range of [value range missing]. ;

[0063] The cycle frequency represents the frequency of periodic modulation components in the signal (such as the periodicity caused by the Bluetooth frame structure), and its value is selected from a first preset discrete set. , This represents the maximum cyclic frequency value in a first preset discrete set. The example value is 32;

[0064] This represents the pre-processed steady-state current response waveform. In the The complex values ​​at each sampling point are obtained from the original current signal after DC removal, alignment and noise reduction;

[0065] This represents a local time index within the sliding window, with values ​​ranging from... arrive ;

[0066] This indicates the length of the sliding window, used to control the smoothness of time; an example value is 64.

[0067] This represents the pre-processed steady-state current response waveform. In the Complex values ​​at each sampling point;

[0068] The preprocessed steady-state current response waveform is a complex numerical sequence obtained by performing DC removal, time alignment, and noise reduction on the original steady-state current response waveform. In one implementation, the preprocessing includes: DC component removal, time alignment based on the reference signal, and wavelet noise reduction, and the analytic signal is obtained through Hilbert transform.

[0069] Represents the complex conjugate operator;

[0070] express The complex conjugate;

[0071] Represents the natural constant;

[0072] Represents the imaginary unit, satisfying ;

[0073] This represents the time delay parameter, used to define the time difference between two sampling points when calculating correlation; its value is selected from a second preset discrete set. , This represents the maximum time delay value in the second preset discrete set. The example value is 8;

[0074] The total number of sampling points in the preprocessed steady-state current response waveform is determined by the sampling rate and the signal duration. ;

[0075] Indicates along the time axis The number of feature frames obtained after sliding calculation is expressed as follows: ;

[0076] Represents the second preset discrete set The maximum value in.

[0077] In one implementation, The set of values ​​is usually set within a range that is expected to include the main cycle frequency, based on prior knowledge (such as Bluetooth protocol frame period, symbol rate), and is then discretized uniformly or logarithmically.

[0078] It should be noted that the cycle frequency It is not the frequency of the signal itself in the spectrum, but rather the frequency at which the statistical properties of the signal (such as mean and autocorrelation function) exhibit periodic changes. In communication signals, this periodicity is usually introduced by periodic processes such as frame structure, symbol rate, and carrier modulation. For example, the frame repetition period of a Bluetooth device will cause the autocorrelation function of its current waveform to exhibit the same periodicity, and the reciprocal of this period corresponds to the cycle frequency. Extracting cyclic stationary features can capture the unique correspondence between hardware circuits and this periodic modulation pattern, thereby distinguishing different hardware.

[0079] S202, RF IQ baseband signal joint time-frequency-cycle feature construction

[0080] The RF IQ baseband signal is essentially a complex baseband signal. A joint representation that simultaneously preserves its time-frequency characteristics and cyclostationarity needs to be constructed. This is achieved by calculating the complex time-frequency matrix of the analytic signal to obtain better time-frequency resolution. Furthermore, a cyclospectral density sensitive to hardware defects is extracted from this complex time-frequency matrix. The steps are as follows:

[0081] 1) Time-frequency analysis is performed on the preprocessed RF IQ baseband signal using S-transform to obtain a complex time-frequency matrix. The S-transform is based on a Gaussian window function, whose window width is adaptively adjusted according to the absolute value of the frequency. Time-frequency transformation is achieved by convolving the signal with the Gaussian window function, thus obtaining variable time-frequency resolution with high frequency resolution in the low-frequency region and high time resolution in the high-frequency region. This effectively captures the transient characteristics caused by hardware defects in the RF IQ baseband signal, expressed as:

[0082]

[0083] In the formula, The complex time-frequency matrix representing the RF IQ baseband signal In time and frequency The value at that location, The dimension is By adaptively varying the Gaussian window, it provides variable time-frequency resolution on the time-frequency plane, with high frequency resolution at low frequencies and high time resolution at high frequencies;

[0084] Represents a time variable;

[0085] Represents frequency variables. Represents frequency The absolute value;

[0086] Indicates the preprocessed RF IQ baseband signal At any moment The value;

[0087] This represents the preprocessed RF IQ baseband signal, in one implementation, It is a complex signal obtained by normalizing, bandpass filtering and synchronization preprocessing the original RF IQ baseband signal;

[0088] This represents the integral variable, which represents the time of the signal;

[0089] Represents the variable Integration operations from negative infinity to positive infinity.

[0090] It should be noted that, The term represents the Gaussian window function in the S-transform, whose width varies with frequency. It adapts to change, thus providing variable time-frequency resolution in the time-frequency plane and improving the ability to detect transient hardware defects.

[0091] 2) By performing cyclic spectrum analysis on the complex time-frequency matrix of the RF I / Q baseband signal, the cyclic spectrum feature tensor is extracted to achieve sensitive detection of RF hardware defects such as carrier leakage and I / Q imbalance, expressed as:

[0092]

[0093] In the formula, Cyclic spectral characteristic tensor representing the RF IQ baseband signal At the center frequency Spectral shift The value at this point characterizes the spectral correlation of the signal in the dimensions of cycle frequency, center frequency, and spectral shift. It is extremely sensitive to RF hardware defects such as carrier leakage and I / Q imbalance. It is a three-dimensional complex tensor with dimension . ;

[0094] This represents the spectral shift parameter, used to define the offset between two frequency components. Its value is selected from a preset discrete set and a third preset discrete set. , This represents the maximum spectral shift value in the third preset discrete set, and the size of the third preset discrete set. The example value is 16;

[0095] This represents the length of the complex time-frequency matrix on the time axis, i.e., the number of time sampling points;

[0096] Representing the complex time-frequency matrix In time and frequency The value at;

[0097] Representing the complex time-frequency matrix In time and frequency The value at;

[0098] express The complex conjugate;

[0099] As a complex exponential function, it is used to convert time... Switch to cycle frequency domain;

[0100] The length of the frequency dimension is determined by the number of frequency sampling points in the S-transform.

[0101] This indicates the number of cycle frequency parameters, with an example value of 16.

[0102] 3) Construction and Realization of Cyclic Spectral Density Tensor

[0103] For complex time-frequency matrices By slicing along the time axis and calculating the correlation of the cyclic spectrum (i.e., the cyclic spectrum), a three-dimensional complex feature tensor is obtained. ,Right now, It is made by all A tensor composed of values ​​is represented as Its dimensions are It characterizes the strength of spectral correlation of a signal in the dimensions of frequency, spectral shift, and cyclic frequency;

[0104] Furthermore, to facilitate neural network processing, the three-dimensional complex feature tensor is... Separate into real tensors and imaginary tensor They are then concatenated along the channel dimension to form the IQ joint real feature tensor. , dimension ;

[0105] S203, Forming a preliminary joint characteristic tensor

[0106] Cyclostationary characteristic spectrum of steady-state current response waveform Joint real feature tensor with IQ The spatial dimensions are uniformly adjusted to (Through interpolation or pooling operations), and then concatenated along the channel dimension to form a preliminary joint feature tensor. , dimension It represents a collection of hardware fingerprint information mined from different perspectives.

[0107] in, This represents the height of the feature map, corresponding to the number of time frames or frequency points. The width of the feature map corresponds to the time delay or spectral shift dimension. Represents the initial number of channels, defined , The cyclostationary characteristic spectrum of the steady-state current response waveform The number of channels.

[0108] S3. Construct a hardware identification model for unauthorized access to Bluetooth devices.

[0109] S301, Adaptive Multi-Source Feature Fusion and Noise Robustness Enhancement

[0110] Existing technologies for multi-source feature fusion typically employ simple splicing or fixed-weight fusion, failing to consider the differences in importance of different feature channels and spatial locations, and are sensitive to environmental noise and hardware nonlinear distortion, resulting in insufficient discriminative power of the fused features.

[0111] This invention adaptively weights important feature channels and spatial locations through channel attention and spatial attention mechanisms, suppressing noise interference and improving feature robustness and recognition performance. The specific steps are as follows:

[0112] 1) Generation of Channel Attention Weight Map

[0113] Global average pooling is performed on the initial joint feature tensor to obtain the channel descriptor vector. Then, the channel dependencies are learned through two fully connected layers and a ReLU activation function. Finally, a channel attention weight map is generated using a Sigmoid activation function, as shown below:

[0114]

[0115] In the formula, This represents the channel attention weight graph, with dimensions of [missing information]. Used for the initial joint feature tensor Each channel is weighted by importance; the larger the value, the more important the feature of the corresponding channel.

[0116] This represents the Sigmoid activation function, which normalizes the output value to... interval;

[0117] Let represent the weight matrix of the first fully connected layer, which are trainable parameters with dimension . ;

[0118] Let represent the weight matrix of the second fully connected layer, which are trainable parameters with dimension . ;

[0119] This indicates a global average pooling operation. The term is used to convert the initial joint feature tensor Spatial Dimensions Compress to The output dimension is Channel descriptor vector The channel descriptor vector contains global statistics for each channel;

[0120] This represents the channel compression ratio, which is an integer hyperparameter greater than 1. It is used to reduce the computational complexity of the attention module, and the example value is 16.

[0121] This represents the ReLU activation function, which introduces nonlinearity to enhance the network's expressive power.

[0122] 2) Spatial attention weight map generation

[0123] The initial joint feature tensor is subjected to average pooling and max pooling along the channel dimension to obtain two spatial feature maps. These two spatial feature maps are then concatenated, and spatial information is fused through a convolutional layer. A spatial attention weight map is generated using the Sigmoid activation function, as shown below:

[0124]

[0125] In the formula, Represents a spatial attention weight graph, with dimensions of . Used for the initial joint feature tensor Each spatial location is weighted by importance;

[0126] Indicates the kernel size as The convolutional layers are used to perform convolution operations on the stitched feature maps to fuse spatial information;

[0127] This represents the average pooling operation along the channel dimension. The output dimension of the item is The feature map captures the average response of all channels at each spatial location;

[0128] This represents the max pooling operation along the channel dimension. The output dimension of the item is The feature map captures the most salient response of all channels at each spatial location;

[0129] This represents a concatenation operation along the channel dimension, used to concatenate the two feature maps output by average pooling and max pooling into a single feature map with a dimension of 1. The feature map.

[0130] 3) Adaptive feature weighting

[0131] The channel attention weight map and spatial attention weight map are broadcast to the same dimension as the initial joint feature tensor, and then element-wise multiplied to obtain the enhanced feature tensor, represented as:

[0132]

[0133] In the formula, The augmented feature tensor is a feature tensor weighted by channel and spatial attention, with dimension . ;

[0134] This indicates element-wise multiplication.

[0135] In practical implementation, Broadcast along spatial dimensions, Broadcast along the channel dimension, that is, from Broadcast to , from Broadcast to This enables adaptive weighting for each channel and each spatial location.

[0136] S302, Hardware Identification of Unauthorized Bluetooth Device Access

[0137] Conventional methods typically employ a general neural network architecture to process the concatenated features, failing to optimize for the high-dimensional, cross-domain, and noise-sensitive characteristics of Bluetooth hardware fingerprints. Furthermore, they neglect the crucial contextual information of the Bluetooth communication protocol stack state, resulting in blurred boundaries for identifying highly realistic illegitimate hardware.

[0138] This invention constructs a neural network model consisting of a dual-branch convolutional module, a protocol-aware feature modulator, and a multi-scale dilated convolutional pyramid. It deeply integrates physical layer hardware defect features and link layer protocol state information, fully exploits the cross-domain correlations inherent in the enhanced feature tensor, and dynamically modulates the features using the protocol state vector. This increases the distance between features of legitimate and illegitimate hardware devices in the feature space. The specific steps are as follows:

[0139] 1) Spatiotemporal-frequency spatiotemporal convolution feature extraction based on dual-branch convolution modules

[0140] Considering that the spatial dimensions of the enhanced feature tensor correspond to time or frequency and time delay or spectral frequency shift respectively, and that its local patterns have different correlation structures in the spatiotemporal and frequency-space subspaces, a dual-branch convolution module is adopted, using temporal strip convolution kernels, frequency-shift strip convolution kernels, and square convolution kernels respectively for parallel feature extraction, in order to accurately capture the local dependencies of hardware fingerprints in different physical domain subspaces, as expressed as:

[0141]

[0142] In the formula, Indicates the first The output feature map of each bi-branch convolutional module has a dimension equal to that of the input. Maintain consistency, dimension is By integrating local features of spatiotemporal and frequency-space subspaces, the representation capability of hardware fingerprints is effectively enhanced.

[0143] This represents the layer index of the dual-branch convolutional module, with a value range of 1. ;

[0144] This represents the total number of double-branch convolutional modules, i.e., the number of stacked module layers, with an example value of 4;

[0145] This indicates batch standardization operations, used to accelerate model training convergence and improve generalization ability;

[0146] This represents a square convolution operation with a kernel height of . Width is Preferred definition To capture local correlation patterns within the joint subspace of time and delay or frequency and spectral shift;

[0147] This represents a temporal strip convolution operation with a kernel size of [size missing]. It focuses on dependencies along the time or frequency axis to capture timing patterns in hardware responses;

[0148] This represents a frequency-shifted stripe convolution operation with a kernel size of [size missing]. It focuses on dependencies along the time delay or spectral frequency shift axis to capture the structure of features in the offset dimension;

[0149] This indicates an element-wise addition operation, used to fuse temporal and frequency-shift features extracted by the strip convolution branches;

[0150] Indicates input to the first The feature maps of each convolutional module; for the first convolutional module, its input... To enhance the feature tensor .

[0151] In its implementation, the dual-branch convolution module consists of two branches. Branch 1 uses a 3×3 square convolution kernel to perform standard convolution, capturing local correlations within the spatiotemporal or frequency-spatial joint subspace. Branch 2 uses two strip convolution kernels in parallel: a 1×3 temporal strip convolution kernel (focusing on feature dependencies along the time or frequency axis) and a 3×1 frequency-shifted strip convolution kernel (focusing on feature dependencies along the time delay or spectral frequency shift axis). The outputs of these two strip convolutions are summed element-wise. The outputs of the two branches are batch-normalized and then summed element-wise to form the output of the dual-branch convolution module.

[0152] It should be noted that the square convolution operation is a standard convolution using a 3×3 square convolution kernel, which is an existing technology used to capture local spatial patterns. The temporal strip convolution operation uses a 1×3 strip convolution kernel and focuses on dependencies along the time or frequency axis. The frequency shift strip convolution operation uses a 3×1 strip convolution kernel and focuses on dependencies along the time delay or spectral frequency shift axis.

[0153] 2) Protocol-aware dynamic feature modulation

[0154] The circuit and RF response characteristics of Bluetooth devices are affected by their current protocol stack state. Utilizing this prior knowledge, the protocol state parsed from the synchronously captured data packets is encoded into a protocol state vector, which is then used as a modulation signal. A lightweight modulation network generates channel scaling factors and bias vectors, adaptively modulating the convolutional features. This enables the model to distinguish feature changes of the same hardware under different protocol states and amplifies the feature anomalies caused by differences in protocol stack implementations in illegitimate devices, represented as:

[0155]

[0156] In the formula, Indicates the first after protocol-sensing modulation Layer feature map, dimension is Based on the protocol state vector, the features are channel scaled and biased to highlight the abnormal features of illegal devices under specific protocol states.

[0157] This indicates a channel-by-channel multiplication broadcast operation;

[0158] Indicates the first The layer's channel scaling factor vector is derived from the protocol state vector. Generated through a modulation network for use with feature maps Each channel is scaled for importance, and the calculation method is expressed as follows: ;

[0159] Indicates the first The layer's channel bias vector is derived from the protocol state vector. Generated through a modulation network for use with feature maps Each channel undergoes offset adjustment, calculated as follows: ;

[0160] The protocol state vector, obtained by parsing captured data packets, contains information such as the current connection state of the encoding device, encryption mode, and data packet type. In one implementation, the protocol state vector... Encode the current protocol stack state information of the Bluetooth device, including connection state (such as standby, scanning, connected, encrypted), encryption mode (such as no encryption, AES encryption), and data packet type (such as broadcast packet, ACL data packet, SCO voice packet).

[0161] The weight matrix of the first fully connected layer is a trainable parameter used to map the protocol state vector to the hidden layer and learn an abstract representation of the protocol state.

[0162] The weight matrix of the second fully connected layer is a trainable parameter used to map the hidden layer to the scaling factor vector and the bias vector to achieve channel modulation.

[0163] The weight matrix of the third fully connected layer is a trainable parameter used to map the protocol state vector to the hidden layer and learn an abstract representation of the protocol state.

[0164] The weight matrix of the fourth fully connected layer is a trainable parameter used to map the hidden layer to the scaling factor vector and the bias vector to achieve channel modulation.

[0165] This represents the LeakyReLU activation function, used to introduce nonlinearity into the modulation network.

[0166] It should be noted that, in During the calculation process, adding 1 ensures that the scaling factor varies around 1, avoiding excessive distortion of the features, while allowing adaptive fine-tuning based on the protocol state to enhance the model's ability to distinguish feature changes of the same hardware under different protocol states.

[0167] It should also be noted that, in During the calculation process, a bias vector is directly generated to compensate for the feature offset caused by the protocol state, thereby enhancing the feature anomalies caused by the differences in protocol stack implementation of illegal devices.

[0168] 3) Multi-scale dilated convolution pyramid fusion

[0169] Hardware defects may manifest as transient features at different time or frequency scales in signals. To expand the receptive field and capture multi-scale contextual information without significantly increasing parameters, a multi-scale dilated convolutional pyramid is constructed. This pyramid uses multiple convolutional layers with different dilation rates in parallel to process features modulated by protocol awareness, and the outputs are concatenated along the channel dimension and then fused through convolution. This enhances the model's ability to perceive hardware fingerprint patterns at various scales, from subtle transients to macroscopic distortions, and is represented as follows:

[0170]

[0171] In the formula, Indicates the first The output feature map of multi-scale fusion has a dimension of 1. By integrating multi-scale contextual information captured by convolutions with different dilation rates, the ability to perceive hardware fingerprint patterns at various scales, from subtle transients to macroscopic distortions, is enhanced.

[0172] express Convolutional operations are used to perform channel fusion and dimensionality reduction on the spliced ​​multi-scale features;

[0173] This indicates a splicing operation along the channel dimension;

[0174] This represents a dilated convolution operation with a kernel height of . Width is void ratio ,when This is the standard convolution, while dilated convolution can expand the receptive field while keeping the number of parameters constant;

[0175] This represents the hole rate parameter, which controls the spacing between weights within the convolution kernel. Examples of values ​​are 1, 2, and 4, corresponding to standard convolution, moderate receptive field expansion, and large receptive field expansion, respectively.

[0176] 4) Global feature aggregation and legality classification judgment

[0177] go through After stacking the above modules, we get the first... Output feature map of multi-scale fusion ,right Global average pooling is used to obtain the global feature vector. Then The input is fed into a fully connected classifier to determine the legality of the hardware identity, and the output is the legality category of the hardware identity, including two categories: "legal device" and "illegal device".

[0178] In one embodiment, the ability of the features extracted by the method of the present invention to distinguish between legitimate and illegitimate devices is analyzed through feature space visualization. In the experimental configuration, the method of the present invention is used to extract high-dimensional features of 200 legitimate devices and 200 illegitimate devices, where illegitimate devices include both high-imitation and low-imitation devices. To visualize the high-dimensional features, a feature reduction technique (t-SNE algorithm) is used to project them onto a two-dimensional plane, preserving the main structural information of the original feature space.

[0179] like Figure 3As shown, the scatter plot illustrates the distribution of devices in the feature space: legitimate devices (blue dots) are densely clustered in a relatively compact area, forming a clear cluster structure; illegitimate devices (red dots) are distributed in a relatively dispersed area. It can be inferred that low-imitation devices are far from the legitimate device cluster, while high-imitation devices are close to but not completely mixed into the legitimate device area; where feature dimension 1 represents the first feature dimension after t-SNE dimensionality reduction, and feature dimension 2 represents the second feature dimension after t-SNE dimensionality reduction.

[0180] like Figure 4 As shown, the kernel density map further illustrates the density of device distribution in the feature space using contour lines and color fills. The density difference map uses color gradients to represent the difference between the density of legal and illegal devices; blue areas indicate regions where the density of legal devices is significantly higher than that of illegal devices, while red areas indicate the opposite. Feature dimension 1 represents the first feature dimension after t-SNE dimensionality reduction, and feature dimension 2 represents the second feature dimension after t-SNE dimensionality reduction. The color represents the density difference. The figure shows that the overlap area between the density distributions of the two types of devices is small, indicating that the features extracted by the method of this invention can effectively increase the distance between legal and illegal devices in the feature space, reducing the classification difficulty. This demonstrates that the feature space obtained by the method of this invention has a large inter-class distance and a small intra-class dispersion.

[0181] S303, Loss Function Calculation and Trainable Parameter Update

[0182] During model training, after each forward propagation to obtain the legality category prediction result of the hardware identity, a loss function needs to be calculated to measure the gap between the prediction and the true label.

[0183] This invention employs the cross-entropy loss function, which is suitable for binary classification tasks involving "legitimate devices" and "illegitimate devices." This function effectively measures the difference between the probability distribution predicted by the model and the one-hot encoding of the true labels. The calculated loss value reflects the performance of the recognition system under the current model parameters.

[0184] Then, using the backpropagation algorithm, the gradients of the loss function with respect to all trainable parameters in the model are calculated. These gradients indicate the direction and magnitude in which each parameter should be adjusted to reduce the loss and improve the model's discriminative ability. Using stochastic gradient descent or its variants (such as the Adam optimizer) combined with the calculated gradients, all trainable parameters in the model are iteratively updated. The optimizer adaptively adjusts the learning rate of each parameter based on the first and second moments of the gradient, thereby achieving more stable and efficient parameter updates. Throughout the training process, model performance is periodically evaluated on the validation set, monitoring metrics such as loss and accuracy.

[0185] Training will continue until a preset stopping condition is met. The stopping condition is set as follows: the loss function value on the validation set no longer decreases significantly for several consecutive training epochs (rounds), or the accuracy metric enters a plateau, indicating that the model may have learned sufficiently and is beginning to overfit, or the preset maximum number of training rounds has been reached.

[0186] After training terminates, a snapshot of the model parameters with the best performance on the validation set is saved as the final trained Bluetooth device illegal access hardware identification model, which will be used for subsequent identification and blocking tasks.

[0187] S4, Hardware Identification of Unauthorized Bluetooth Device Access

[0188] like Figure 5 As shown, once the Bluetooth device unauthorized access hardware identification model is trained, it can be deployed in actual network access points or security monitoring devices to perform online or offline unauthorized hardware identification tasks. The identification process begins with signal capture of the target Bluetooth device. When a Bluetooth device attempts to access the network or communicate with the monitoring device, the system simultaneously collects the steady-state current response waveform generated during the communication process and the radio frequency IQ baseband signal in the air.

[0189] Then, strictly following the process defined in the training phase, the two raw waveform data streams are preprocessed, aligned, and subjected to joint time-frequency-cyclic stationary feature extraction to generate a preliminary joint feature tensor consistent with the training data format. This feature tensor is fed into the recognition model, which has been loaded with the aforementioned trained parameters. The model performs forward inference, sequentially undergoing feature enhancement, spatiotemporal-frequency feature extraction, protocol state dynamic modulation, and multi-scale contextual information fusion. Finally, through global feature aggregation and a fully connected classifier, it outputs a result determining the legality of the device's hardware identity, i.e., whether it is a "legitimate device" or an "illegal device." Based on the identification result of illegal access to Bluetooth devices, the system can activate a dynamic blocking mechanism to proactively defend against the access and communication of unauthorized hardware.

[0190] Specifically, the dynamic blocking of unauthorized access to Bluetooth devices is a closed-loop control process. When the identification model determines that a Bluetooth device that is communicating or attempting to access is an "unauthorized device", the blocking decision engine will immediately generate a blocking instruction according to the preset security policy. This instruction is sent to the network access control entity or a dedicated signal jamming unit.

[0191] Specific blocking actions can take several forms: for unauthorized devices in the connection establishment phase, the access point can reject their connection request and immediately disconnect any established link-layer connections; for unauthorized devices already connected to the network, the network firewall can discard all their data packets and blacklist their media access control addresses, prohibiting all future access attempts; at the more proactive radio frequency layer, the system can control the radio frequency front-end to emit friendly blocking signals on specific channels to interfere with the communication of the unauthorized device, forcing it to back off or fail to connect. Simultaneously, all identification events, blocking actions, and related protocol states and fingerprint information of unauthorized devices are recorded in the security log for auditing and subsequent analysis.

[0192] The dynamic blocking mechanism is not a one-time operation. The system continuously monitors the channel status and performs real-time feature extraction and identification of any new or repeated communication attempts, realizing a cycle of "identification-blocking-monitoring".

[0193] This dynamic blocking mechanism, which involves real-time identification and rapid response, effectively enhances the Bluetooth network's proactive defense capabilities against unauthorized access at the hardware level.

[0194] In this embodiment, by synchronously acquiring the steady-state current response in the circuit domain and the IQ baseband signal in the radio frequency domain of the Bluetooth device, a multi-source training dataset across physical domains is constructed, realizing multi-dimensional perception of hardware fingerprints. For the physical characteristics of the two signals, cyclostationary feature extraction and complex time-frequency-cyclospectral joint feature construction methods are designed respectively, overcoming the limitation of traditional time-frequency analysis in its insufficient ability to distinguish subtle hardware defects. A protocol-aware dynamic feature modulation mechanism is proposed, integrating the Bluetooth protocol stack state vector as contextual information into the neural network to achieve feature normalization for different operating modes of the same hardware and amplification of abnormal features of illegal devices. An adaptive neural network integrating bi-branch convolution, multi-scale dilated convolution, and attention mechanisms is constructed, specifically optimized for the cross-domain correlation, multi-scale characteristics, and noise sensitivity of hardware fingerprints, forming an end-to-end active defense system from feature extraction to dynamic blocking.

[0195] This invention also proposes a hardware identification and dynamic blocking device for unauthorized access to Bluetooth devices, based on the above-described method for identifying and dynamically blocking unauthorized access to Bluetooth devices, including:

[0196] A multi-source waveform data and training dataset construction module is used to collect steady-state current response waveforms and RF IQ baseband signal data and divide them into training set, validation set and test set according to the proportions.

[0197] The signal preprocessing and feature extraction module is used for cyclic stationary feature extraction of steady-state current response waveform, joint time-frequency-cyclic feature construction of RF IQ baseband signal, and finally forming a preliminary joint feature tensor.

[0198] The module for constructing a Bluetooth device illegal access hardware identification model is used for adaptive multi-source feature fusion and enhancement. It constructs and trains a Bluetooth device illegal access hardware identification model based on a neural network model composed of a dual-branch convolution module, a protocol-aware feature modulator, and a multi-scale dilated convolution pyramid.

[0199] The Bluetooth device illegal access hardware identification module is used to identify Bluetooth devices illegally accessing hardware based on a trained model, and outputs the result of the legality judgment of the hardware identity of the device.

[0200] Furthermore, this invention also proposes a computer-readable storage medium storing program instructions for a method for identifying and dynamically blocking unauthorized access to Bluetooth devices. These program instructions can be executed by one or more processors to implement the steps of the method described above.

[0201] The embodiments described above are merely preferred embodiments of the present invention and are not intended to limit the scope of the present invention. Various modifications and improvements made by those skilled in the art to the technical solutions of the present invention without departing from the spirit of the present invention should fall within the protection scope defined by the claims of the present invention.

Claims

1. A method for identifying and dynamically blocking unauthorized access to Bluetooth devices, characterized in that, include: S1. Multi-source waveform data acquisition and training dataset construction: This includes acquiring steady-state current response waveforms and RF IQ baseband signal data and constructing a dataset proportionally. S2. Signal preprocessing and feature extraction: This includes preprocessing, aligning, and denoising the original steady-state current response waveform and RF IQ baseband signal data, and extracting the cyclostationary features of the steady-state current response waveform and the joint time-frequency-cyclostationary features of the RF IQ baseband signal to form a preliminary joint feature tensor. S3. Construction of a hardware identification model for illegal access to Bluetooth devices: This includes adaptive multi-source feature fusion based on channel attention and spatial attention mechanisms; and the construction and training of a model for Bluetooth device legality classification based on a neural network composed of a dual-branch convolutional module, a protocol-aware feature modulator, and a multi-scale dilated convolutional pyramid. The adaptive multi-source feature fusion based on channel attention and spatial attention mechanisms includes generating a channel attention weight map, generating a spatial attention weight map, and broadcasting the channel attention weight map and the spatial attention weight map to the same dimension as the initial joint feature tensor, and then performing element-wise multiplication to obtain the enhanced feature tensor, as expressed below: In the formula, Represents the augmented feature tensor. This represents the channel attention weight map. Represents the spatial attention weight map. This represents element-wise multiplication; Represents the initial joint feature tensor; The dual-branch convolutional module uses temporal strip convolution kernels, frequency-shifted strip convolution kernels, and square convolution kernels respectively for parallel feature extraction, as shown below: In the formula, Indicates the first The output feature map of each dual-branch convolutional module; Indicates the layer index of the bi-branch convolutional module; This indicates a batch of standardized operations; This represents a square convolution operation with a kernel height of . Width is ,in, This represents a temporal strip convolution operation. This represents a frequency-shifted strip convolution operation; This represents an element-wise addition operation; Indicates input to the first The feature maps of each convolutional module; for the first convolutional module, its input... To enhance the feature tensor ; S4. Illegal Bluetooth Device Access Hardware Identification: This includes identifying Bluetooth devices attempting to access the network or communicate with monitoring devices based on a trained Bluetooth device illegal access hardware identification model. If the device is determined to be illegal, the blocking decision engine immediately generates a blocking command according to the preset security policy.

2. The method for identifying and dynamically blocking unauthorized access to Bluetooth devices according to claim 1, characterized in that, The cyclostationary characteristics of the waveform are determined by the cyclostationary characteristic spectrum of the steady-state current response waveform.

3. The method for identifying and dynamically blocking unauthorized access to Bluetooth devices according to claim 2, characterized in that, The joint time-frequency-cyclic features of the radio frequency IQ baseband signal are obtained by performing cyclic spectrum analysis on the complex time-frequency matrix of the signal, extracting the cyclic spectrum feature tensor, obtaining a three-dimensional complex feature tensor, separating the three-dimensional complex feature tensor into real part tensor and imaginary part tensor, and splicing them along the channel dimension to form the IQ joint real feature tensor.

4. The method for identifying and dynamically blocking unauthorized access to Bluetooth devices according to claim 3, characterized in that, The channel attention weight map is obtained by global average pooling of the preliminary joint feature tensor to obtain the channel descriptor vector, and then the channel dependencies are learned through two fully connected layers and the ReLU activation function. Finally, the Sigmoid activation function is used to generate the channel attention weight map. The spatial attention weight map is obtained by performing average pooling and max pooling along the channel dimension on the preliminary joint feature tensor, respectively, to obtain two spatial feature maps. These two spatial feature maps are then concatenated and spatial information is fused through a convolutional layer. Finally, the Sigmoid activation function is used to generate the weight map.

5. The method for identifying and dynamically blocking unauthorized access to Bluetooth devices according to claim 4, characterized in that, The protocol-aware feature modulator encodes the protocol state parsed from the synchronously captured data packets into a protocol state vector, and uses it as a modulation signal to generate channel scaling factors and bias vectors through a lightweight modulation network to perform adaptive channel modulation on the convolutional features.

6. The method for identifying and dynamically blocking unauthorized access to Bluetooth devices according to claim 5, characterized in that, The multi-scale dilated convolutional pyramid uses multiple convolutional layers with different dilation rates in parallel to process the protocol-aware modulated features, and then concatenates the outputs along the channel dimension and fuses them through convolution, as shown below: In the formula, Indicates the first Output feature map of multi-scale fusion; express Convolution operation; This indicates a splicing operation along the channel dimension; This represents a dilated convolution operation with a kernel height of . Width is void ratio ; This represents the void ratio parameter; Indicates the first after protocol-sensing modulation Layer feature map.

7. A Bluetooth device unauthorized access hardware identification and dynamic blocking device, based on the Bluetooth device unauthorized access hardware identification and dynamic blocking method as described in any one of claims 1 to 6, comprising: A multi-source waveform data acquisition and training dataset construction module is used to acquire steady-state current response waveforms and RF IQ baseband signal data and divide them into training set, validation set and test set according to the proportions. The signal preprocessing and feature extraction module is used for cyclic stationary feature extraction of steady-state current response waveform and joint time-frequency-cyclic feature construction of RF IQ baseband signal to form a preliminary joint feature tensor. The module for constructing a Bluetooth device illegal access hardware identification model is used for adaptive multi-source feature fusion and enhancement. It constructs and trains a Bluetooth device illegal access hardware identification model based on a neural network model composed of a dual-branch convolution module, a protocol-aware feature modulator, and a multi-scale dilated convolution pyramid. The Bluetooth device unauthorized access hardware identification module is used to identify unauthorized access hardware of Bluetooth devices based on a trained model, and outputs the result of the judgment on the legality of the hardware identity of the device.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores program instructions for a method of identifying and dynamically blocking unauthorized access to Bluetooth devices, which can be executed by one or more processors to implement the steps of the method of identifying and dynamically blocking unauthorized access to Bluetooth devices as described in any one of claims 1 to 6.

Images