vs-ble-monitor

BLE connection intrusion detection for Craton Shield.

Overview

Monitors Bluetooth Low Energy connections for security anomalies on IoT devices. Tracks per-peer state for RSSI, pairing, and GATT operation monitoring. All state is stack-allocated with fixed-size arrays.

Detection Mechanisms

Configuration

use vs_ble_monitor::{BleMonitor, MacAction};

let mut monitor = BleMonitor::new();             // allow-by-default
// let mut monitor = BleMonitor::new_deny_default(); // deny-by-default (allowlist only)

// MAC filters.
monitor.add_mac_filter([0xAA, 0xBB, 0xCC, 0x01, 0x02, 0x03], MacAction::Allow).unwrap();
monitor.add_mac_filter([0xDD, 0xEE, 0xFF, 0x04, 0x05, 0x06], MacAction::Block).unwrap();

// Tuning.
monitor.set_conn_storm_params(10, 30_000_000);    // 10 connections per 30 seconds
monitor.set_pairing_fail_threshold(3);             // 3 failures triggers alert
monitor.set_gatt_rate_threshold(100);              // 100 ops per 60-second window

Inspection

use vs_types_embedded::{BleEvent, BleEventType};

let result = monitor.inspect(&event);
// result.allowed     — whether the event should be processed
// result.alert_count — number of alerts (0-4)

Alert Source IDs

Limits

• 16 MAC filter entries
• 16 tracked peers (RSSI, pairing, GATT)
• 32 connection timestamps for storm detection
• 32 GATT handle permission policies
• 16 advertisement-replay digest ring slots

Tracked-peer and MAC-filter capacities (MAX_TRACKED_PEERS, MAX_MAC_FILTERS) are re-exported from vs-types-embedded and scale with the crate's capacity feature flags:

• default — values shown above.
• capacity-large — larger fixed-size tables suited for gateway-class devices.
• capacity-xl — largest tables; intended for aggregator nodes.

See core/docs/feature-flags.md for the exact constants per profile.

Errors

• VsError::ResourceExhausted — MAC filter capacity full

Changelog

See the workspace CHANGELOG for version history.

Feature Flags

See core/docs/feature-flags.md for the full workspace feature reference.

License

Apache-2.0. See LICENSE.