Bluetooth Low Energy (BLE) Dataset: Raw-Capture for Intrusion Analysis

We produced a novel dataset comprising raw BLE advertisement traffic collected across a variety of scenarios designed to reflect both ambient and malicious behavior. The dataset includes unfiltered advertisement packets recording key BLE-Layer fields. These features provide critical visibility into the structure and dynamics of BLE broadcasting, enabling fine-grained analysis of anomalous behaviors such as packet flooding, MAC spoofing and unusual transmission patterns.

This dataset provides a foundation for exploring BLE-specific threat detection by offering access to advertisement-layer traffic under both benign and adversarial conditions. It includes granular packet-level information such as MAC addresses, PDU types, and payload contents, enabling the study of broadcast anomalies, spoofing behaviors, and traffic manipulation patterns.

******************** Data Statistics *******************

The dataset comprises two categories of BLE traffic captures collected in a controlled testbed with realistic ambient noise.

***Extended captures: (~24 hours total)***
were recorded overnight to minimize interference. Two adversarial sessions captured BLE spam attacks using randomized MAC addresses: the first ran for ~6 hours yielding 1,488,501 packets, and the second for ~5.5 hours yielding 1,769,635 packets. A 12-hour benign baseline session captured ambient traffic only from idle smartphones, smart home devices, and BLE accessories, producing 977,187 packets.

***Short captures***
consist of four one-hour segments with MAC randomization disabled to enable deterministic packet attribution. These include one attack-free baseline (210,107 packets), one high-frequency spam session at 20 ms intervals (661,873 packets), and two sessions at 100 ms intervals (333,919 and 305,790 packets), representing stealthy and maximal attack profiles respectively.

Together, the extended captures reveal longer-term behavioral trends while the short sessions enable precise cross-condition comparison, supporting use cases such as anomaly detection and behavioral modeling.