Automated Flaw Detection for Industrial Robot RESTful Service

This conference talk presents a novel testing technique called RobRest designed specifically for detecting security flaws in industrial robot RESTful services. Explore how researchers address three key challenges in robot security: high-quality test case generation, high-throughput testing, and anomaly detection. Learn about the unique complications posed by industrial robots compared to traditional cloud applications, including limited computational resources, unique controller states, and unclear API specifications. The presentation details how RobRest analyzes OpenAPI specifications to generate effective test cases, combines cyber and physical space states for anomaly detection, and customizes testing requests to minimize resource usage while bypassing controller restrictions. Discover how the application of this technique identified 19 system flaws (4 vulnerabilities and 15 bugs) in industrial robots, with 2 receiving CVE IDs, demonstrating potential impacts on numerous industrial robots in real-world manufacturing environments. This 24-minute talk was presented at the VMCAI conference in January 2025, sponsored by ACM SIGPLAN.