FlagThis

Abstract

Securing Internet of Things (IoT) firmware remains inherently challenging due to proprietary binaries, stripped symbols, heterogeneous hardware architectures, and restricted access to executable code. Established analysis techniques, including static analysis, symbolic execution, and fuzzing, rely on binary transparency together with accurate emulation. When firmware images are encrypted and only partially accessible, the reliability of these methods declines markedly. To address this structural constraint, we introduce a binary-free, architecture-agnostic system that estimates the likelihood of conceptual zero-day exploits from high-level firmware descriptors. The system employs a tri-LLM reasoning architecture comprising an LLaMA 3-8B configuration interpreter, a DeepSeek-v3 structural abstraction analyzer, and a GPT-4o semantic fusion module. Each component provides a distinct analytical perspective, enabling synthesis of configuration semantics, structural patterns, and cross-layer dependencies without reliance on executable artifacts. The system also captures computational signatures produced during LLM inference, including latency dynamics, uncertainty indicators, reasoning-depth traces, and an energy-aware symbolic load formulation. Simulation-based evaluation shows that incremental descriptor perturbations produce a consistent 2035% increase in predicted conceptual zero-day likelihood across models. Among the evaluated systems, GPT-4o exhibits stronger cross-layer sensitivity to descriptor variation. Statistical analysis further shows that divergence measures and energy-correlated signals are significantly associated with elevated conceptual risk (p < 0.01), supporting descriptor-level triage under binary opacity without claiming to detect exploits.