arXiv: Statistical Analysis of Executability and Program Equivalence in Decompilation for IoT Vulnerability Detection

This publication presents a statistical analysis of decompilation techniques used to detect vulnerabilities in Internet of Things (IoT) devices. The research evaluates how reliably decompiled code can be executed and whether different decompilation tools produce functionally equivalent programs. It introduces a framework for measuring the accuracy of these tools when analyzing firmware from embedded systems, which is critical for identifying security flaws in devices that lack standard software update mechanisms.

The findings are relevant to any organization that manufactures, distributes, or manages IoT hardware, including industrial control systems, medical devices, smart home products, and automotive components. Regulatory compliance teams in these sectors should pay attention because the research highlights potential gaps in current vulnerability assessment methods. If decompilation tools produce inconsistent results, automated security scanning may miss critical flaws, leading to non-compliance with emerging cyber resilience regulations such as the EU Cyber Resilience Act or sector-specific standards.

Compliance teams should review their current firmware testing procedures and verify that their vulnerability detection tools are validated against known benchmarks. They should also document any reliance on decompilation in their risk assessments and consider adding manual verification steps for high-risk devices. Finally, they should monitor future updates to this research, as it may inform best practices for IoT security testing and regulatory expectations around tool reliability.