Automated Flaw Detection for Industrial Robot RESTful Service
summary
Built a tool called RobRest that uses OpenAPI description extraction plus an LLM to pick realistic parameter values, generates dependent request sequences, and injects them via a session-reuse forwarding proxy to bypass controller rate limits. It observes both HTTP statuses and cyber+physical anomaly signals (socket error codes, robot closed state) and automates controller reset. Applied to ABB services for 12-hour runs, it finds 19 flaws (4 vulns, 15 bugs) and reports a ~31% API-coverage gain.
AI-written summary · about
chapters (16)
- 0:00Automated flaw detection intro
- 1:48Security risks in open networks
- 3:35REST APIs for robot control
- 5:19Security in robot REST services
- 6:24Challenges in flaw detection
- 7:48Motivations for robust system
- 9:10Robust system overview
- 10:15Extracting from OpenAPI specs
- 11:41Dependency relationships in APIs
- 12:47Generating test sequences
- 14:32Bypassing limits with forward module
- 15:58Detecting anomalies with metrics
- 17:26Restoring controller state
- 18:10Evaluating Robust
- 19:59Summary and impact
- 21:34Q&A
related talks
39mAutomating Your Security Checks: Stop Hiding Your Flaws Next to the Monsters...
45mFuzz Testing Web APIs: Overview of Existing Tools
32mAutomating Web Application Bug Hunting
40mRobots with Pentest Recipes
48mThe Need for Automation in API Security
08mAutomated Security Testing for JS Apps
43mDesigning REST APIs for the age of AI agents
45mProtection and Verification of Security Design Flaws