Energy-Efficient Multi-LLM Reasoning for Binary-Free Zero-Day Detection in IoT Firmware

2025-12-22

AI Summary

Existing IoT firmware zero-day vulnerability detection faces critical bottlenecks—including binary code unavailability, opacity of encrypted firmware, and poor cross-architecture compatibility. Method: This paper proposes the first binary-free detection method relying solely on high-level semantic descriptions. It introduces a tri-LLM collaborative reasoning architecture: LLaMA for configuration parsing, DeepSeek for structural abstraction, and GPT-4o for semantic fusion. We pioneer LLM-computed signatures—capturing latency, nondeterminism, and inference depth—and an energy-aware symbolic workload model. A theoretical framework is established, integrating monotonicity, divergence, and energy-efficiency–risk coupling. Results: Experiments show 20–35% improvement in zero-day risk prediction accuracy under high-exposure scenarios; GPT-4o demonstrates superior cross-layer semantic sensitivity; energy consumption and divergence metrics exhibit statistically significant predictive power (p < 0.01).

Technology Category

• Machine Learning: Hardware-aware ML
• Application Domains: Internet of Things, Sensor Networks & Smart Cities
• Data Mining & Knowledge Management: Anomaly/Outlier Detection

Application Category

• Graph Algorithms and Modeling for the Web: Foundation models and LLMs for Web-related graphs
• Semantics and Knowledge: Methods to enhance, augment, integrate or synergize semantic models such as knowledge graphs and LLMs
• Security and Privacy: Large-scale security measurements

Abstract

Securing Internet of Things (IoT) firmware remains difficult due to proprietary binaries, stripped symbols, heterogeneous architectures, and limited access to executable code. Existing analysis methods, such as static analysis, symbolic execution, and fuzzing, depend on binary visibility and functional emulation, making them unreliable when firmware is encrypted or inaccessible. To address this limitation, we propose a binary-free, architecture-agnostic solution that estimates the likelihood of conceptual zero-day vulnerabilities using only high-level descriptors. The approach integrates a tri-LLM reasoning architecture combining a LLaMA-based configuration interpreter, a DeepSeek-based structural abstraction analyzer, and a GPT-4o semantic fusion model. The solution also incorporates LLM computational signatures, including latency patterns, uncertainty markers, and reasoning depth indicators, as well as an energy-aware symbolic load model, to enhance interpretability and operational feasibility. In addition, we formally derive the mathematical foundations of the reasoning pipeline, establishing monotonicity, divergence, and energy-risk coupling properties that theoretically justify the model's behavior. Simulation-based evaluation reveals that high exposure conditions increase the predicted zero-day likelihood by 20 to 35 percent across models, with GPT-4o demonstrating the strongest cross-layer correlations and the highest sensitivity. Energy and divergence metrics significantly predict elevated risk (p < 0.01), reinforcing the effectiveness of the proposed reasoning framework.

Problem

• Detects zero-day vulnerabilities in IoT firmware without binary access
• Uses multi-LLM reasoning with energy-aware models for efficient analysis
• Addresses limitations of traditional methods like static analysis and fuzzing

Innovation

• Binary-free architecture-agnostic solution using high-level descriptors
• Tri-LLM reasoning architecture with configuration interpreter and semantic fusion
• Energy-aware symbolic load model with LLM computational signatures