Abstract
The rapid growth of Internet of Things (IoT) devices introduces serious security risks, compounded by the heterogeneity of firmware across architectures, compilers, and optimization settings. Existing vulnerability detection methods struggle with efficiency, cross-platform generalization, and adversarial robustness. We present a large-language-model enhanced graph embedding method (LEGEM), a framework that integrates large language models (LLMs) with graph embedding to address these challenges. The LEGEM introduces two key framework components: 1) a multimodal dataset construction framework (MDCF) that unifies and standardizes data processing and adversarial example generation and 2) an adaptive training–validation loop (ATVL) that integrates hyperparameter optimization with adversarial validation to enhance both efficiency and robustness. By incorporating 96 797 LLM-generated adversarial samples with ensemble learning, the LEGEM improves precision and reduces false positives under attack. Experimental results show that the LEGEM achieves higher accuracy (receiver operating characteristic (ROC)–area under the curve (AUC) 0.973 versus 0.970 for GESS) and substantially faster matching (28.3% faster than GESS and 82.1% faster than Gemini). Cross-dataset evaluation on real IoT firmware further demonstrates strong generalization (AUC 0.998). Overall, the LEGEM delivers a practical and robust solution for IoT binary analysis, advancing detection efficiency and resilience compared to existing methods.