Needle in a Haystack: Detecting Subtle Malicious Edits to Additive Manufacturing G-Code Files

Increasing usage of digital manufacturing (DM) in safety-critical domains is increasing attention on the cybersecurity of the manufacturing process, as malicious third parties might aim to introduce defects in digital designs. In general, the DM process involves creating a digital object (as CAD files) before using a slicer program to convert the models into printing instructions (e.g., g-code) suitable for the target printer. As the g-code is an intermediate machine format, malicious edits may be difficult to detect, especially when the golden (original) models are not available to the manufacturer. In this work, we aim to quantify this hypothesis through a red team/blue team case study, whereby the red team aims to introduce subtle defects that would impact the properties (strengths) of the 3-D printed parts, and the blue team aims to detect these modifications in the absence of the golden models. The case study had two sets of models, the first with 180 designs (with two compromised using two methods) and the second with 4320 designs (with 60 compromised using six methods). Using statistical modeling and machine learning (ML), the blue team was able to detect all the compromises in the first set of data, and 50 of the compromises in the second.