{"id":"https://openalex.org/W7213625229","doi":"https://doi.org/10.5281/zenodo.22842082","title":"FirmPilot: Evidence-Driven Validation of Vulnerability Reports in Linux-Based IoT Firmware","display_name":"FirmPilot: Evidence-Driven Validation of Vulnerability Reports in Linux-Based IoT Firmware","publication_year":2026,"publication_date":"2026-09-19","ids":{"openalex":"https://openalex.org/W7213625229","doi":"https://doi.org/10.5281/zenodo.22842082"},"language":"en","primary_location":{"id":"doi:10.5281/zenodo.22842082","doi":"https://doi.org/10.5281/zenodo.22842082","is_oa":true,"landing_page_url":"https://doi.org/10.5281/zenodo.22842082","pdf_url":null,"source":{"id":"https://openalex.org/S4306400562","display_name":"Zenodo (CERN European Organization for Nuclear Research)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I67311998","host_organization_name":"European Organization for Nuclear Research","host_organization_lineage":["https://openalex.org/I67311998"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"article-journal"},"volume":null,"type":"article","is_traditional":true,"indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.5281/zenodo.22842082","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5152169411","display_name":"Xuekang Peng","orcid":null,"observed_orcids":[]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Peng, Xuekang","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5133037894","display_name":"Haipeng Li","orcid":null,"observed_orcids":[]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Li, Haipeng","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5026966444","display_name":"Jingdian Ming","orcid":"https://orcid.org/0000-0001-8791-1576","observed_orcids":["https://orcid.org/0000-0001-8791-1576"]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Ming, Jingdian","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101875769","display_name":"Dandan Xu","orcid":"https://orcid.org/0000-0001-7289-1365","observed_orcids":["https://orcid.org/0000-0001-7289-1365"]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Xu, Dandan","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5153911518","display_name":"Wei Cheng","orcid":null,"observed_orcids":[]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Cheng, Wei","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5130625566","display_name":"Shuchao Pang","orcid":null,"observed_orcids":[]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Pang, Shuchao","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5016645765","display_name":"Zhichao Lian","orcid":"https://orcid.org/0000-0002-6643-8975","observed_orcids":["https://orcid.org/0000-0002-6643-8975"]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Lian, Zhichao","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5153738587","display_name":"Yongbing Zhou","orcid":null,"observed_orcids":[]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Zhou, Yongbin","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.0,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10743","display_name":"Software Testing and Debugging Techniques","score":0.5644999742507935,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10743","display_name":"Software Testing and Debugging Techniques","score":0.5644999742507935,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.36570000648498535,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10273","display_name":"IoT and Edge/Fog Computing","score":0.014399999752640724,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/iot-firmware","display_name":"IoT firmware","score":0.8809999823570251},{"id":"https://openalex.org/keywords/taint-analysis","display_name":"taint analysis","score":0.8579999804496765},{"id":"https://openalex.org/keywords/data-flow-analysis","display_name":"data flow analysis","score":0.8450000286102295},{"id":"https://openalex.org/keywords/vulnerability-reports","display_name":"vulnerability reports","score":0.7160000205039978}],"concepts":[{"id":"https://openalex.org/C67212190","wikidata":"https://www.wikidata.org/wiki/Q104851","display_name":"Firmware","level":2,"score":0.9663000106811523},{"id":"https://openalex.org/C160145156","wikidata":"https://www.wikidata.org/wiki/Q778586","display_name":"Executable","level":2,"score":0.8264999985694885},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8001999855041504},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.6861000061035156},{"id":"https://openalex.org/C2780801425","wikidata":"https://www.wikidata.org/wiki/Q5164392","display_name":"Construct (python library)","level":2,"score":0.4844000041484833},{"id":"https://openalex.org/C48103436","wikidata":"https://www.wikidata.org/wiki/Q599031","display_name":"State (computer science)","level":2,"score":0.43790000677108765},{"id":"https://openalex.org/C9652623","wikidata":"https://www.wikidata.org/wiki/Q190109","display_name":"Field (mathematics)","level":2,"score":0.4375},{"id":"https://openalex.org/C167063184","wikidata":"https://www.wikidata.org/wiki/Q1400839","display_name":"Vulnerability assessment","level":3,"score":0.4023999869823456},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.3880000114440918},{"id":"https://openalex.org/C168167062","wikidata":"https://www.wikidata.org/wiki/Q1117970","display_name":"Component (thermodynamics)","level":2,"score":0.3434999883174896},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.33090001344680786},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.325300008058548},{"id":"https://openalex.org/C22174128","wikidata":"https://www.wikidata.org/wiki/Q175869","display_name":"Microcode","level":2,"score":0.3156999945640564},{"id":"https://openalex.org/C97686452","wikidata":"https://www.wikidata.org/wiki/Q7604153","display_name":"Static analysis","level":2,"score":0.31369999051094055},{"id":"https://openalex.org/C113843644","wikidata":"https://www.wikidata.org/wiki/Q901882","display_name":"Interface (matter)","level":4,"score":0.3068000078201294},{"id":"https://openalex.org/C63116202","wikidata":"https://www.wikidata.org/wiki/Q7676227","display_name":"Taint checking","level":3,"score":0.3005000054836273},{"id":"https://openalex.org/C149635348","wikidata":"https://www.wikidata.org/wiki/Q193040","display_name":"Embedded system","level":1,"score":0.2930000126361847},{"id":"https://openalex.org/C115903868","wikidata":"https://www.wikidata.org/wiki/Q80993","display_name":"Software engineering","level":1,"score":0.2840000092983246},{"id":"https://openalex.org/C2778755073","wikidata":"https://www.wikidata.org/wiki/Q10858537","display_name":"Scale (ratio)","level":2,"score":0.2824999988079071},{"id":"https://openalex.org/C184337299","wikidata":"https://www.wikidata.org/wiki/Q1437428","display_name":"Semantics (computer science)","level":2,"score":0.27810001373291016},{"id":"https://openalex.org/C132964779","wikidata":"https://www.wikidata.org/wiki/Q2110223","display_name":"Raw data","level":2,"score":0.26260000467300415},{"id":"https://openalex.org/C120314980","wikidata":"https://www.wikidata.org/wiki/Q180634","display_name":"Distributed computing","level":1,"score":0.2624000012874603},{"id":"https://openalex.org/C112968700","wikidata":"https://www.wikidata.org/wiki/Q11368","display_name":"Unix","level":3,"score":0.25450000166893005}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.5281/zenodo.22842082","doi":"https://doi.org/10.5281/zenodo.22842082","is_oa":true,"landing_page_url":"https://doi.org/10.5281/zenodo.22842082","pdf_url":null,"source":{"id":"https://openalex.org/S4306400562","display_name":"Zenodo (CERN European Organization for Nuclear Research)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I67311998","host_organization_name":"European Organization for Nuclear Research","host_organization_lineage":["https://openalex.org/I67311998"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"article-journal"},{"id":"doi:10.5281/zenodo.22842083","doi":"https://doi.org/10.5281/zenodo.22842083","is_oa":true,"landing_page_url":"https://doi.org/10.5281/zenodo.22842083","pdf_url":null,"source":{"id":"https://openalex.org/S4306400562","display_name":"Zenodo (CERN European Organization for Nuclear Research)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I67311998","host_organization_name":"European Organization for Nuclear Research","host_organization_lineage":["https://openalex.org/I67311998"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"article-journal"}],"best_oa_location":{"id":"doi:10.5281/zenodo.22842082","doi":"https://doi.org/10.5281/zenodo.22842082","is_oa":true,"landing_page_url":"https://doi.org/10.5281/zenodo.22842082","pdf_url":null,"source":{"id":"https://openalex.org/S4306400562","display_name":"Zenodo (CERN European Organization for Nuclear Research)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I67311998","host_organization_name":"European Organization for Nuclear Research","host_organization_lineage":["https://openalex.org/I67311998"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"article-journal"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":["https://openalex.org/W7161044925","https://openalex.org/W4415727679","https://openalex.org/W4400885425","https://openalex.org/W4391623949","https://openalex.org/W7221649361","https://openalex.org/W4415398364","https://openalex.org/W4415388688","https://openalex.org/W4388925627","https://openalex.org/W4410774465","https://openalex.org/W3201858020"],"abstract_inverted_index":{"Firmware":[0],"vulnerability":[1,112,115,129],"discovery":[2,113],"does":[3],"not":[4,69],"necessarily":[5],"produce":[6],"an":[7],"executable":[8,36,174],"proof":[9],"of":[10,45,101,182],"concept":[11],"(PoC).":[12],"Dynamic":[13],"techniques,":[14],"such":[15,61],"as":[16,62,202],"rehosting":[17],"and":[18,41,65,75,114,139,151,159,169,177,217],"greybox":[19],"fuzzing,":[20],"can":[21,47],"provide":[22],"strong":[23],"evidence":[24,220],"when":[25,212],"they":[26,32],"successfully":[27],"trigger":[28,160],"a":[29,105,107,124,136,140,165,213],"vulnerability,":[30,166],"but":[31],"often":[33],"depend":[34],"on":[35,195],"services,":[37],"faithful":[38],"device":[39,96],"environments,":[40],"runtime":[42],"feedback,":[43],"all":[44],"which":[46,89],"be":[48],"difficult":[49],"to":[50,86,163,172,189],"obtain":[51],"reliably":[52],"for":[53,126],"commodity":[54],"IoT":[55],"firmware.":[56],"In":[57],"contrast,":[58],"static":[59],"techniques":[60],"taint":[63,142],"analysis":[64,67],"data-flow":[66],"do":[68],"require":[70],"executing":[71],"the":[72,132,156,179],"target":[73],"program":[74],"therefore":[76],"scale":[77],"more":[78],"effectively.":[79],"However,":[80],"their":[81,186,190],"outputs":[82],"are":[83,221],"typically":[84],"limited":[85],"source-to-sink":[87],"reports,":[88],"may":[90],"suffer":[91],"from":[92,185],"over-approximated":[93],"paths,":[94],"missing":[95],"state,":[97],"or":[98,205],"backend":[99,170],"transformations":[100],"attacker-controlled":[102,183],"inputs.":[103],"As":[104],"result,":[106],"practical":[108],"gap":[109],"remains":[110],"between":[111],"validation.":[116],"To":[117],"bridge":[118],"this":[119,196],"gap,":[120],"we":[121],"present":[122],"FIRMPILOT,":[123],"framework":[125],"validating":[127],"firmware":[128,137],"reports":[130],"beyond":[131],"single-final-request":[133],"assumption.":[134],"Given":[135],"image":[138],"reported":[141],"slice,":[143],"FIRMPILOT":[144,198],"sequentially":[145],"recovers":[146],"interaction":[147,215],"dependencies,":[148],"request":[149,175],"templates,":[150],"field":[152],"semantics.":[153],"It":[154],"identifies":[155],"prerequisite":[157],"state":[158],"mechanisms":[161],"required":[162],"exercise":[164],"correlates":[167],"frontend":[168],"logic":[171],"construct":[173],"skeletons,":[176],"tracks":[178],"semantic":[180],"evolution":[181],"inputs":[184],"raw":[187],"form":[188],"final":[191],"consumed":[192],"values.":[193],"Based":[194],"evidence,":[197],"classifies":[199],"each":[200],"report":[201,208],"confirmed,":[203],"rejected,":[204],"unresolved.":[206],"A":[207],"is":[209],"confirmed":[210],"only":[211],"replayable":[214],"sequence":[216],"sink-level":[218],"corroborating":[219],"both":[222],"available.":[223]},"counts_by_year":[],"updated_date":"2026-10-28T10:33:24.094632","created_date":"2026-09-20T00:00:00"}