# Detecting part anomalies induced by cyber attacks on a powder bed fusion additive manufacturing system

Elizabeth Kurkowski, Mason Rice, Sujeet Shenoi

► To cite this version:

Elizabeth Kurkowski, Mason Rice, Sujeet Shenoi. Detecting part anomalies induced by cyber attacks on a powder bed fusion additive manufacturing system. 16th International Conference on Critical Infrastructure Protection (ICCIP), Mar 2022, Virtual Event, United States. pp.175-203, 10.1007/978-3-031-20137-0_7. hal-05397795

HAL Id: hal-05397795

https://inria.hal.science/hal-05397795v1

Submitted on 4 Dec 2025

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
<figure><img src="image_2.png" /></figure>

ifip

International Federation for Information Processing

This document is the original author manuscript of a paper submitted to an IFIP
conference proceedings or other IFIP publication by Springer Nature. As such, there
may be some differences in the official published version of the paper. Such
differences, if any, are usually due to reformatting during preparation for publication or
minor corrections made by the author(s) during final proofreading of the publication
manuscript.
Chapter 7

DETECTING PART ANOMALIES
INDUCED BY CYBER ATTACKS
ON A POWDER BED FUSION
ADDITIVE MANUFACTURING
SYSTEM

Elizabeth Kurkowski, Mason Rice and Sujeet Shenoi

**Abstract** Additive manufacturing systems are highly vulnerable to cyber attacks that sabotage parts and print environments during the designing, slicing and printing steps of the process chains. Due to the complex cyber-physical nature of additive manufacturing systems, cyber attacks are difficult to detect and mitigate, and impossible to eliminate entirely. Therefore, it is imperative to develop rapid and reliable non-destructive testing methods for detecting anomalies in printed parts.

This chapter describes a novel anomaly detection method developed for a selective laser sintering type of powder bed fusion system. The method does not engage computing-intensive machine learning to detect anomalies, relying instead on three side channels, print bed movement, laser firing time and print chamber temperature, that underlie the physics of selective laser sintering. The side channels provide adequate detection coverage while reducing the sensor requirements; they are also robust to noise, which enhances the detection of printed part anomalies. Experimental results demonstrate the efficacy of the anomaly detection method under attacks that target the mechanical properties of printed parts. The cost of the sensors and peripheral devices is minimal and anomaly detection for each test part requires less than three seconds.

**Keywords:** Additive manufacturing, powder bed fusion, anomaly detection

# 1. Introduction

Additive manufacturing (AM), also referred to as 3D printing, builds parts layer by layer by depositing materials ranging from plastics to met-
als. It offers several advantages over conventional subtractive manufac-
turing, including intricate customized parts with improved mechanical
properties, and rapid prototyping and flexible on-demand manufactur-
ing options, all with reduced material wastage. As a result, additive
manufacturing is used to create parts for critical infrastructure assets
such as wind turbines [19], jet engines [13] and nuclear reactors [7].

Although few, if any, real-world cyber attacks have been reported against additive manufacturing systems, it is a matter of time before these systems will be targeted by hackers, criminals and nation-state actors to sabotage printed parts and print environments. Indeed, the research literature in additive manufacturing abounds with viable attacks focused on part sabotage and/or print environment sabotage. These attacks focus on the three principal steps in the additive manufacturing process chain, for example, stereolithographic (STL) files in the designing step [4, 25], slicing software and toolpath (G-code) files in the slicing step [14], and printer firmware in the printing step [17, 18, 28].

Due to the complex cyber-physical nature of additive manufacturing
systems, cyber attacks are difficult to detect and mitigate, and impossi-
ble to eliminate entirely. Therefore, it is imperative to focus on methods
that can verify the integrity of printed parts. While quality control us-
ing destructive testing is always an option, to reduce the costs related to
resources and time, rapid and reliable non-destructive testing methods
are needed to detect anomalies in printed parts induced by cyber attacks
during the designing, slicing and/or printing steps.

This chapter describes a novel anomaly detection method developed
for powder bed fusion, one of the most popular additive manufacturing
processes after material extrusion [15]. Unlike material extrusion, which
typically extrudes plastic materials, powder bed fusion uses powdered
plastic or metallic materials to create parts. Powder bed fusion is gener-
ally more expensive than material extrusion, but it is increasingly used
to print mission-critical parts for critical infrastructure assets [12].

The anomaly detection method, which is developed for a selective laser
sintering type of powder bed fusion system, leverages data from three
side channels, print bed movement, laser firing time and print chamber
temperature. The three side channels are robust to noise, which increases
the probability of detecting printed part anomalies while reducing the
number of sensors required to obtain feature data.

The anomaly detection method has two phases, baseline creation and
anomaly detection. The baseline creation phase, which involves limited
destructive testing of parts, constructs the ground truth for anomaly
detection. The non-destructive anomaly detection phase compares side-
channel data from test parts against the baseline to identify anoma-
lies. The proposed method does not engage computing-intensive ma-
chine learning, relying instead on the three side channels that underlie
the physics of selective laser sintering, enhancing anomaly detection cov-
erage as well as detectibility. Additionally, since the detection method
does not require access to toolpath control code, it is readily applied to
proprietary additive manufacturing systems.

Experimental results using a Sintratec Kit selective laser sintering
printer demonstrate the efficacy of the proposed anomaly detection meth-
od. Four anomaly creation attacks – void insertion, layer thickness al-
teration, temperature modification and scanning speed variation – were
executed to evaluate the anomaly detection method. The attacks, which
were selected based on their effects on the mechanical properties of
printed parts, were launched with varying degrees of severity to assess
the finest anomaly detection granularities. The proposed method yielded
96.9% accuracy in anomaly detection. The smallest discernible changes
were 1.29% for void insertion attacks, 5% for layer thickness alteration
attacks, 3.57% for temperature modification attacks and 4.55% for scan-
ning speed variation attacks. Just as significant, the total cost of the
sensors and peripheral devices is under $120 and anomaly detection for
each test part requires less than three seconds.

2. Related Work

Side-channel analysis is a well-known methodology that has been
leveraged to attack additive manufacturing and related systems [8, 11,
23]. However, it can also be applied to verify the integrity of additively-
manufactured parts with limited destructive testing. Vincent et al. [26]
proposed a side-channel scheme for detecting Trojans implanted in in-
tegrated circuits used in cyber-physical systems. They suggested using
structural health monitoring techniques, but did not conduct experi-
ments to demonstrate the effectiveness of the integrity detection scheme.

Wu et al. [27] investigated printed part defects that could be in-
troduced maliciously during the additive manufacturing process chain.
They proposed a method that uses machine learning and image classifi-
cation of software simulation screenshots to examine printed parts layer
by layer and detect anomalies.

Al Faruque et al. [1] employed image processing and machine learning
on thermal camera images to detect intellectual property theft and sabo-
tage in additive manufacturing systems. The images, which tracked noz-
zle motion in a fused filament fabrication printer, were essentially used
as a side channel to detect potential printed part anomalies. Chhetri et
al. [6] used statistical modeling to map toolpath (G-code) instructions to
analog (side-channel) emissions in order to detect anomalous operations of a fused filament fabrication printer.

Bayens et al. [2] developed a scheme for detecting malicious infill patterns in a fused filament fabrication printer. The scheme explicitly excluded the analysis of STL and G-code files, focusing instead on side-channel acoustic, magnetic and motion data to train a machine learning model that classified printed part layers as valid or anomalous.

Belikovetsky et al. [3] applied signal processing and machine learning to acoustic side-channel emanations from a fused filament fabrication printer to create a master audio signature for verifying printed part integrity. Gatlin et al. [9] presented a similar side-channel method but, instead of acoustic emanations, monitored the electric current delivered to the motors of a fused filament fabrication printer to detect sabotage attacks. Master power signatures for different types of printed parts were employed as baselines for anomaly detection.

Sturm et al. [24] explored the use of impedance-based monitoring to detect part defects during material jetting additive manufacturing. Sensors were attached directly to the print bed or permanently to parts as they were being printed. The method was able to detect void defects down to 2.28% of printed part volume.

Yu et al. [29] leveraged a multi-modal approach for detecting sabotage attacks on a fused filament fabrication printer. Side-channel data associated with vibrations, acoustics, magnetic fields and electric current were analyzed to obtain correlations between toolpath commands and physical parameters in order to identify anomalous parts.

Brandman et al. [5] generated physical hash values (QR codes) of process parameters and toolpath code for detecting attacks on additive manufacturing systems. Their approach secures proprietary process parameters and printing instructions while performing quality control of printed parts.

Rais et al. [20] developed a framework for detecting low-profile sabotage attacks on fused filament fabrication printers. They analyzed G-code and created a model of expected printer behavior based on nozzle temperature, extruder head position and extruded filament quantity, which is used as a baseline to detect sabotage.

The review of the literature reveals that side-channel data captured during additive manufacturing can be leveraged to detect potential sabotage attacks on printed parts and print environments. The method described in this chapter leverages side-channel print bed movement, laser firing time and print chamber temperature data collected from a selective laser sintering printer to detect printed part anomalies introduced
by part and print environment sabotage attacks during the designing,
slicing and printing steps.

Much of the previous research relies on side-channel data (e.g., acous-
tics and magnetic fields) with high levels of noise that negatively impact
machine-learning-based anomaly detection. In contrast, the proposed
side-channel method does not engage computationally-intensive signal
processing and machine learning, and can be applied to proprietary ad-
ditive manufacturing systems without accessing part designs or toolpath
code.

Additionally, practically all the research efforts have focused on fused
filament fabrication belonging to the material extrusion class of additive
manufacturing processes [16] whereas this work focuses on selective laser
sintering, a powder bed fusion process. Finally, the proposed method
for detecting the sabotage of selective laser sintering printed parts and
environments is applicable to metal powder bed fusion processes such
as selective laser melting and direct metal laser sintering used to create
mission-critical metal parts for critical infrastructure assets.

3. Powder Bed Fusion

This section describes the powder bed fusion additive manufacturing
process and the selective laser sintering printer employed in this research.

## 3.1 Powder Bed Fusion Process

Powder bed fusion is one of the most popular types of additive manu-
facturing processes after material extrusion [15]. It is generally more
expensive than material extrusion, but is increasingly used to print
mission-critical parts for critical infrastructure assets [12].

Powder bed fusion conforms to the same additive manufacturing pro-
cess chain as material extrusion, which includes the designing, slicing,
printing and post-processing steps (Figure 1). However, each step in
powder bed fusion may include additional considerations depending on
the printing technology and print materials. For example, the designing
step in powder bed fusion is distinctive because the printing process al-
lows for more durable parts due to the properties of the print materials
employed and increased control over part resolution. Therefore, parts
can be designed with finer details for diverse applications.

As in material extrusion, the slicing step in powder bed fusion yields
toolpath code that conveys detailed printing information. However, the
toolpath commands differ because a laser is used instead of an extruder
in the case of material extrusion.
<figure><img src="image_3.png" /><figcaption>Figure 1. Additive manufacturing process chain.</figcaption></figure>

The printing step in powder bed fusion differs considerably from ma-
terial extrusion. Figure 2 presents a generic powder bed fusion process.
During the printing step, powder particles are fused on a print bed using
a laser. The powder delivery system raises fresh powder in the powder
bed, following which a rake or roller deposits the powder on top of the
fused material in the print bed, creating the base for the next layer of
the printed part.

The principal variations in powder bed fusion processes, such as selective laser sintering and selective laser melting, arise from the print material properties and laser power. Selective laser sintering uses a low power laser to sinter layers of plastic particles whereas selective laser melting uses a high power laser to melt metal particles to create parts with smooth surfaces.

The post-processing step in powder bed fusion depends on the print
materials. For example, printed parts are annealed in the print bed
to obtain the desired mechanical properties. Following annealing, the
printed parts are removed and cleaned of excess powder.

**3.2 Selective Laser Sintering Printer**

This research employed a Sintratec Kit selective laser sintering print-
er [22] that uses (PA 12) polyamide material to print parts. The powder
<figure><img src="image_4.png" /><figcaption>Figure 2. Powder bed fusion process.</figcaption></figure>

delivery system engages a rake to move particles from the powder bed to the print bed, following which galvanometer mirrors deflect beams from a proprietary laser to sinter layers of powder to create a printed part.

A Sintratec Kit has a list price of $6,000, making it the first relatively-affordable selective laser sintering system in the market [21]. However, more important is the fact that the Sintratec Kit research can be leveraged to develop reliable anomaly detection methods for more expensive metal-based selective laser melting systems. Additionally, the Sintratec Kit requires an assembly process, which provides valuable insights into its internal mechanisms that advance side-channel anomaly detection research.

A Sintratec Kit printer comes with the Sintratec Central slicing software, which runs on a Windows machine that communicates with the printer via a USB cable. The software slices a typical part design file (e.g., STL file) to create a toolpath file for printing parts layer by layer. Sintratec Central enables a user to specify the layer height, number of perimeters, perimeter offset, hatching offset and hatching spacing. For live print settings, Sintratec Central allows a user to specify the print chamber temperature, surface temperature and laser scanning speed.

# 4. Powder Bed Fusion Printer Anomalies

This section discusses the common anomalies seen in parts printed by powder bed fusion printers and the steps in the additive manufactur-
ing process chain where the anomalies may be introduced to sabotage
printed parts. Since the additive manufacturing steps are chained, a
flaw in the early part design file propagates to and manifests itself as an
anomaly in subsequent steps. Understanding where and how anomalies
may be induced assists anomaly detection efforts.

This research focuses on detecting anomalies induced by cyber attacks
during the designing, slicing and printing steps, and are detectible during
or after the printing process. Anomalies introduced during the final post-
processing step are outside the scope of this work because they are highly
specific to the printing materials and desired parts.

**Designing Step Anomalies.** Designing step anomalies are intro-
duced by accidental or intentional changes to part design files. The
changes require access to the part design computer, part design software
and/or saved part design. The principal designing step anomalies are:

- Part Scaling: Modification of part dimensions.

- Voids: Insertion of open spaces inside a part.

**Slicing Step Anomalies.** Slicing step anomalies are introduced by accidental or intentional changes to toolpath files. The changes require access to the slicing computer, slicing software and/or toolpath file. The principal slicing step anomalies are:

- Part Scaling: Modification of part dimensions.

- Voids: Insertion of open spaces inside a part.

- Part Orientation: Modification of part orientation on the build platform.

- Layer Thickness: Modification of print material quantity deposited in part layers.

**Printing Step Anomalies.** Printing step anomalies are introduced
by printer or material degradation or intentional changes to the print-
ing process. The changes require access to the printer, print materials
and/or printing software. The principal printing step anomalies are:

- Print Material Properties: Modification of print material quality due to improper storage, inadequate quality control during curement or poor powder recovery practices.

- Print Bed Temperature: Modification of print chamber temperature.
* **Material Surface Temperature:** Modification of powder surface temperature immediately before sintering.

* **Powder Spreading:** Modification of powder distribution in a part layer.

* **Laser Scanning Speed:** Modification of laser sintering speed.

* **Heating/Sintering Times:** Modification of powder heating and/or sintering times.

# 5. Anomaly Detection Method

The proposed anomaly detection method leverages three side channels, print bed movement, laser firing time and print chamber temperature, to detect print anomalies. The three side channels are robust to noise, which increases the probability of detecting printed part anomalies while reducing the number of sensors required to obtain feature data.

The anomaly detection method has two phases, baseline creation and anomaly detection. Unlike other additive manufacturing anomaly detection approaches that engage machine learning, the proposed method relies on three important print environment features that underlie the physics of selective laser sintering; this enhances anomaly detection coverage as well as detectibility. Additionally, the detection method does not require access to toolpath control code. As a result, the anomaly detection method is applicable to proprietary additive manufacturing systems.

Figure 3 shows the anomaly detection workflow. The baseline creation phase creates the ground truth based on control part readings and a configuration file containing threshold values for anomaly detection. This is followed by the anomaly detection phase that compares test part readings against the control readings using the threshold values in the configuration file.

The first step in the baseline creation phase is data collection, which gathers raw control data associated with the three features of interest while the control parts are being printed. Meanwhile, a configuration file containing initial detection thresholds is created to customize anomaly detection to print environments and user requirements. For example, some configuration file options enable users to specify the allowable fluctuations in laser firing time and print chamber temperature.

The second step is to conduct destructive testing of each control part to determine whether or not it meets the physical (e.g., size) and mechanical (e.g., tensile strength) specifications. Depending on the statistical requirements, the anomaly detection control data is created by
<figure><img src="image_5.png" /><figcaption>Figure 3. Anomaly detection workflow.</figcaption></figure>

destructively testing control parts from multiple print jobs. The third step in baseline creation is control reading verification during which the readings of control parts that satisfy the specifications upon destructive testing are averaged to create the baseline for anomaly detection. The fourth data processing step transforms the raw part data to a format suitable for data analysis.

The final data analysis and configuration file tuning steps use verified baseline control data in an iterative manner to adjust the configuration thresholds. Verified control data from multiple print jobs are compared against each other in order to adjust the initial configuration thresholds based on applicable constraints. The final tuned configuration thresholds are input to the data analysis step in the anomaly detection phase.

During the anomaly detection phase shown in Figure 3, each subsequent printed (test) part is non-destructively processed by comparing its readings against the baseline readings. The same data collection and data processing steps performed in the baseline creation phase are employed to collect the raw test part data and convert it to a format suitable for anomaly detection. The data analysis step uses the tuned configuration thresholds, test data and anomaly detection control data for every test part layer to determine anomalies. A test part that passes the data analysis step is deemed to be free from anomalies with respect to the measured side-channel data.
<figure><img src="image_6.png" /><figcaption>Figure 4. Magnet and rotary sensor placement.</figcaption></figure>

Note that the anomaly detection workflow involves destructive testing to create the baseline. Therefore, it is designed to be used in industrial environments that manufacture multiple copies of parts as opposed to hobbyist environments that print single parts.

## 5.1 Data Collection

Three sensors are employed to obtain side-channel data related to the control and test parts. The first sensor is a magnetic rotary board that works in concert with a small round (diametrically-magnetized) magnet to collect data pertaining to print bed movements. As shown in Figure 4, the magnet sits on the stepper motor that controls the print bed and the sensor board is positioned on top of the magnet. The sensor board communicates with an Arduino Uno device using the I2C protocol. The magnet is rotated and the magnet angle changes whenever the print bed moves. The Arduino Uno device records the magnet angle every 50 ms.

The Sintratec Kit printer used in this research has a proprietary laser that operates in the blue light range. Therefore, an ultraviolet light sensor is employed to determine when the laser is fired. The sensor has a relatively high sampling rate and accurately detects light in the ultraviolet wavelengths. As shown in Figure 5, the ultraviolet light sensor is placed inside the casing where the laser originates. The sensor is connected to a Raspberry Pi 3 computer, which uses the I2C protocol to passively collect ultraviolet index (intensity) measurements every 3 ms.

The third sensor, a thermistor, that can withstand high printing temperatures over extended periods of time, collects print chamber tem-
<figure><img src="image_7.png" /><figcaption>Figure 5. Light sensor placement.</figcaption></figure>

<figure><img src="image_8.png" /><figcaption>Figure 6. Thermistor placement.</figcaption></figure>

perature data. The thermistor shown in the oval region in Figure 6 is positioned to the left of the Sintratec Kit integrated thermistors at the back of the core. The thermistor is connected to the Arduino Uno device that collects five temperature samples every 10 ms and records the average value.
<table><caption>Table 1. Side-channel sensors and data collection devices.</caption><thead><tr><td>Device</td><td>Purpose</td><td>Resolution</td><td>Sampling Rate</td></tr></thead><tbody><tr><td>Seed Studio AS5600 Rotary Sensor</td><td>Print bed movement</td><td>0.09°</td><td>50 ms</td></tr><tr><td>Adafruit SI1145 Light Sensor</td><td>Laser firing detection</td><td>100 mlx</td><td>3 ms</td></tr><tr><td>EPCOS/TDK NTC thermistor</td><td>Print chamber temperature</td><td>0.1 °C</td><td>50 ms</td></tr><tr><td>Miuzei Arduino Uno</td><td>Data collection</td><td>-</td><td>-</td></tr><tr><td>Raspberry Pi 3</td><td>Drive data collection</td><td>-</td><td>-</td></tr></tbody></table>

The Arduino Uno communicates with the Raspberry Pi over a serial connection using a USB cable. The Raspberry Pi runs driver code that initiates scripts that continuously collect raw data provided by the three sensors during the printing process. Data values from the sensors are timestamped and stored in CSV files on a USB storage drive connected to the Raspberry Pi.

Table 1 provides information about the side-channel sensors and data collection devices. Note that emphasis is on employing multiple side channels to enhance anomaly detection coverage. While a single sensor is capable of detecting certain anomalies, using three sensors enables the majority of anomalies to be detected. The combination of sensors enhances detectibility while reducing the hardware requirements.

## 5.2 Data Processing

The data processing step invokes three main functions to convert the raw side-channel data to a format that supports data analysis:

* **Layer Detection Function:** The layer detection function examines consecutive rotary magnet sensor readings to determine when a new layer of powder is set. A Sintratec Kit printer performs four print bed movements in order to deposit a new layer. Consistent fluctuations in the rotary sensor readings indicate print bed movements. The layer detection function records the timestamped readings associated with powder deposition.

* **Laser-Layer Correlation Function:** The laser-layer correlation function uses the timestamped print layer readings to split the ultraviolet light sensor readings into layers. Since the intent is to de-
tect attacks during sintering, the function records the timestamps of the first and last sintered layers. The timestamps of the first and last sintered layers are correlated with the timestamps of the first and last laser firings, respectively. Laser and layer data collected before and after these two times are discarded.

The laser data values are drawn from a continuous scale based on the ultraviolet index (intensity). Since the focus is only on laser firing, the laser firing data for each layer is simplified by converting it to a string of binary values corresponding to whether (1) or not (0) the laser was fired.

* **Layer-Temperature Correlation Function:** The layer-temperature correlation function analyzes the laser-layer correlated data to split the temperature readings by layer. Since the temperature values do not fluctuate as rapidly as print bed movements and laser firings, the temperature readings are downsampled to about two readings per second.

The time required for data processing depends on the printed part. In the experiments, print jobs required around two hours and processing the data for a job took about ten minutes; this is not an issue because data processing only occurs once per print job. The files containing the processed data from the three sensors are input to the data analysis step to detect anomalies.

## 5.3 Data Analysis

The data analysis step compares the processed sensor data against the verified control data to determine the existence of anomalies in the printed parts. The thresholds stored in the configuration file are used for the comparisons.

Several variables should be considered when tuning the threshold values used for anomaly detection. The thresholds should be adjusted based on the printer tolerances and desired precision. Sensor sampling rates and error rates impose limits on detection capabilities and the appropriate threshold values. Additionally, allowable tolerances on the final printed parts provide guidance on the flexibility and variance in the part printing process. Ideally, thresholds should be customized to the parts as well as the printer.

Algorithm 1 specifies the anomaly detection procedure using the side-channel data. Most anomalies are detected via straightforward comparisons of layer counts, sintering times and print chamber temperatures. Analyzing the layer counts potentially reveals changes in the layer thick-
<caption>**Algorithm 1:** Identify anomalies using side-channel data.</caption>

Input: control: Processed control data
Input: test: Processed test data
Input: thresholds: Threshold settings from configuration file
Output: report: Summary of anomalies
anomalies ← []
if len(control) - len(test) ≠ 0 then
anomalies ← (layerCount, 0)
end
for cLayer, tLayer in control, test do
if |cLayer.time - tLayer.time| ≥ threshold.time then
anomalies ← (timing, tLayer.ID)
end
if levenshtein(cLayer pattern, tLayer pattern) ≥ threshold.firing then
anomalies ← (firing, tLayer.ID)
end
for controlTemp, testTemp in cLayertemperatures, tLayertemperatures do
if |controlTemp - testTemp| ≥ threshold.temperature then
anomalies ← (temperature, tLayer.ID)
end
end
end
report ← generateReport(anomalies)
return report

ness due to attacks. Variations in the sintering times may point to
the existence of voids in printed parts and changes in the laser scan-
ning speed. Temperature deviations greater than the threshold indicate
heating-related anomalies in the print chamber.

Voids and other changes to the internal structures of printed parts
may be detected by analyzing the laser firing data. The laser firing data
for each layer is expressed as a binary string. Levenshtein distances
are computed between the test and control binary strings for the corre-
sponding part layers. Distances exceeding a threshold are deemed to be
anomalous. Since additive manufacturing is a timing-based process, the
Levenshtein distance is a better metric than direct binary string com-
parison because slight differences in laser firing times can occur due to
the heating process or because the ultraviolet light sensor sampling data
may not align in exactly the same way for every print.

The data analysis step performs anomaly detection on a per-layer ba-
sis. Deviations beyond the set thresholds are flagged as anomalies in
a summary file. The summary file lists the anomalies and their types,
along with the anomalous part layers. The final report incorporates vi-
sualizations that can assist operators in determining if anomalies should be investigated further or if they are likely false positives.

The proposed anomaly detection method does not engage computing-intensive machine learning to detect anomalies. Additionally, it does not require access to toolpath control code, rendering it attractive for proprietary systems such as Sintratec Kit printers for which human-readable control code is not available. Just as significant, the total cost of the sensors and peripheral devices is under $120 and anomaly detection for each test part requires less than three seconds.

# 6. Anomaly Creation Attacks

Anomaly creation attacks were executed to evaluate the effectiveness of the proposed anomaly detection method. The attacks were selected based on their effects on the mechanical properties of the printed parts. The attacks were launched with varying degrees of severity to assess the finest granularities of anomaly detection.

Four types of anomaly creation attacks were executed in the experiments:

* **Void Insertion:** This type of attack inserts voids in a design file during the designing step. Inserting voids in a part changes how the part is built and affects part strength [4, 25]. Large voids may be detectible via non-destructive testing (e.g., visual inspection or weighing) whereas small voids may not be detectible without destructive testing.

Two types of voids were inserted in the printed parts. The first type of void had fixed cross sections arising from the exclusion of 2.45% of the sintering area per layer for 12 consecutive layers. The second type of void had cross sections that varied in size due to the exclusion of 0.57% to 2.73% of the sintering area per layer over 40 consecutive layers.

* **Layer Thickness Alteration:** This type of attack modifies the part layer thickness during the slicing step. The layer thickness affects inter-layer adhesion and, thus, part quality [10]. Normal layer thicknesses for a Sintratec Kit printer are in the order of microns (μm). This resolution makes it virtually impossible to distinguish individual layers by visual inspection.

The layer thickness alteration attacks were executed by adjusting the Sintratec Central slicing parameters. The Sintratec Central software requires all the layers to have the same thickness, typi-
cally 100 µm. The three experimental attacks increased the layer thicknesses to 105 µm, 110 µm and 150 µm, respectively.

* **Temperature Modification:** This type of attack modifies the print chamber temperature during printing. Printing a part at a lower temperature negatively impacts inter-layer adhesion whereas printing at a higher temperature causes consecutive layers to be melted together or curled, both of which can result in warped parts. The temperature modification attacks leveraged the parameter control feature provided by the Sintratec Central slicing software. Specifically, the temperature may be changed while printing any layer and may be returned to the original value at any time during printing. The experimental attacks decreased the temperature by 5 °C and increased the temperature by 5 °C from the recommended temperature of 140 °C for seven to ten layers at two locations during printing (bottom or middle portions of the parts).

* **Scanning Speed Variation:** This type of attack modifies the laser scanning speed during printing. Modifying the scanning speed introduces timing-related defects that negatively impact part properties [10].

The scanning speed variation attacks leveraged the parameter control feature of the Sintratec Central software. The experimental attacks were executed by modifying the scanning speeds to 575 mm/s, 600 mm/s and 625 mm/s from the recommended speed of 550 mm/s for the entire prints.

# 7. Experimental Setup and Results

This section presents the experimental setup and discusses the anomaly detection results.

## 7.1 Experimental Setup

Three sensors were used to collect side-channel data in the experiments. An AS5600 magnetic rotary sensor with a magnet was placed on the stepper motor to collect print bed movement data. An SI1145 ultraviolet light sensor was placed inside the laser casing to determine whether or not the laser fired at a given time. A thermistor was placed at the back of the print chamber to collect print chamber temperature data. All the sensors were fixed at their locations throughout the baseline creation and anomaly detection phases.

An Arduino Uno device was used to collect data from the rotary sensor and thermistor. The Arduino Uno communicated with a Raspberry Pi
<figure><img src="image_9.png" /><figcaption>*Figure 7. Printed part sample.*</figcaption></figure>

3 computer over a USB serial connection to write timestamped readings to a CSV file. The Raspberry Pi also collected timestamped readings from the ultraviolet light sensor and recorded them in a separate CSV file. Rotary and temperature sensor readings were sampled every 50 ms. The ultraviolet light index in the laser casing was sampled every 3 ms.

Data collection was initiated using a secure shell (SSH) connection to the Raspberry Pi during powder bed preparation, shortly before sintering. Data collection continued until the print was completed and the cooldown phase began. At this point, the data collection was terminated manually via the SSH connection. The data files were transferred to a separate computer via secure copy for processing and analysis. The data collection code was written in Python and Arduino C. The data processing and analysis code was written in Python.

Figure 7 shows a printed part sample used in the experiments. The Lego-brick-shaped sample incorporates basic linear, rectangular and circular features. A print job involved printing ten parts at one time. The ten printed part samples were positioned in exactly the same way on the print bed during each print job.

Additionally, a more complex printed part sample was designed to serve as a challenging test case in the anomaly detection experiments. Figure 8 shows a complex printed part sample. The complex printed part was about the same size as its simpler counterpart, but with twice as many layers and several intricate details.

All the part samples were printed using a mixture of 70% new and 30% used PA 12 powder. No more than two print jobs were executed on a given day to accommodate the time required to heat the powder, sinter the part layers and cool each printed part. As a result, data collection extended over several months – this is not a limitation because the print schedule mirrors typical additive manufacturing operations. Typical printer cleaning and calibration schedules were also followed.
<figure><img src="image_10.png" /><figcaption>Figure 8. Complex printed part sample.</figcaption></figure>

Four attack thresholds for anomaly determination against the baseline were recorded in the configuration file. The anomaly threshold for layers in a printed part was set to zero (i.e., test and control samples had to have the same numbers of layers). Two anomaly thresholds for laser firing during layer sintering were set – the maximum laser firing time difference was 100 ms and the maximum laser firing pattern difference was 15%. The anomaly threshold for print chamber temperature was set to a maximum difference of 5 °C. The justifications for the threshold settings are described later in this section.

## 7.2 Anomaly Detection Results

This section presents the results of detecting anomalies in simple and complex printed parts targeted by anomaly creation attacks. The simple parts were targeted by void insertion, layer thickness alteration, temperature modification and scanning speed variation attacks. Void insertion attacks were not executed on the complex printed parts due to their size and shape.

**Simple Printed Part Results.** Eight control print jobs were executed in the simple printed part experiments. One control print job was used as the baseline for anomaly detection. One control print job was deemed a false positive because it was discovered during the analysis to be anomalous despite creating it in the exact same way as the other control prints. This could be due to timing changes induced by random laser heating variations.

The following results were obtained for the four types of anomaly creation attacks:

* **Void Insertion:** The void insertion attacks introduced two types of voids in the printed parts during the designing step. The first
<figure><img src="image_11.png" /><figcaption>Figure 9. Screenshot previews of normal layers versus layers with voids.</figcaption></figure>

type of void had fixed cross sections arising from the exclusion of 2.45% of the sintering area per layer for 12 consecutive layers. The second type of void had cross sections that varied in size due to the exclusion of 0.57% to 2.73% of the sintering area per layer over 40 consecutive layers. Seven void attack print jobs were executed with ten printed part copies each. In four of the print jobs, every one of the 40 (= 4 × 10) total part copies incorporated one consistent void. The remaining three print jobs produced 30 total part copies, each containing one varying void.

The open spaces in the part layers caused by voids induced variations in the laser firing patterns. Figure 9 shows the differences in the laser firing patterns with previews of the layers with open spaces. Parts with consistent and variable voids that excluded more than 44 mm² total area or 1.29% of the layer sintering area were always detected. The 44 mm² total area resulted from a small void of 4.4 mm² in each of the ten parts on the build plate, so the removed area did not have to correspond to one large void in order to be detected. Anomalies were always indicated by the laser timing readings. However, anomalies were not always indicated by the laser firing patterns.

* **Layer Thickness Alteration:** The layer thickness alteration attacks executed during the slicing step modified the individual layer thickness from the recommended setting of 100 µm to 105 µm, 110 µm and 150 µm. Five layer thickness alteration print jobs were executed, yielding 50 (= 5 × 10) total part copies. One print job was executed for each of the 150 µm and 110 µm layers, and three print jobs with 105 µm layers.

None of the layer thickness modifications were discernible via visual inspection nor did they affect part dimensions and weight. Parts with 150 µm and 110 µm layers were observed to have significantly
<figure><img src="image_12.png" /><figcaption>Figure 10. Temperature profiles.</figcaption></figure>

reduced strength; in fact, many of them crumbled during routine post-processing cleaning. Parts with 105 µm layers did not crumble during post-processing.

Anomalies were indicated based on differences in the total numbers of layers, laser timings and laser firing patterns. Parts whose layer thicknesses were increased by 5 µm or more were always detected as anomalous.

* **Temperature Modification:** The temperature modification attacks executed during the printing step either decreased or increased the print chamber temperature by 5°C from the recommended 140°C for seven to ten printed layers at the bottom and middle of the printed parts. The error rating for the thermistor at the printing temperature was 5°C, which is why smaller thresholds were not used. Three print jobs (10 copies each) were executed – one with a 5°C decrease while printing the bottom portions, one with a 5°C increase while printing the bottom portions and one with a 5°C increase while printing the middle portions.

Figure 10 shows the temperature profiles under normal conditions (control) and during an attack (test). Anomalies were indicated based on the laser timing and print chamber temperature. All the temperature attacks were detected for all the print jobs. No changes to the printed parts were discernible by visual inspection.
<figure><img src="image_13.png" /><figcaption>Figure 11. Laser sintering time profiles.</figcaption></figure>

The locations of the temperature attacks (bottom or middle portions) did not impact anomaly detection.

* **Scanning Speed Variation:** The scanning speed attacks executed during the printing step modified the laser scanning speed from the recommended 550 mm/s to 575 mm/s, 600 mm/s and 625 mm/s. Three print jobs were executed for each of the three scanning speeds for a total of nine print jobs (90 copies).

Figure 11 shows laser sintering times under normal conditions (control) and during an attack (test). Scanning speed modifications did not induce any discernible changes to the printed parts. Anomalies, which were indicated by laser timing, were detected even when the scanning speed was increased as little as 25 mm/s. As expected, the scanning speed changes on laser timing were more obvious when larger areas were sintered.

Table 2 shows the detection granularities for the four types of anomaly creation attacks. The smallest changes discernible by the anomaly detection method range from just 1.29% to 5%.

Table 3 summarizes the anomaly detection results for the simple printed parts in the experiments. For each print job, the test data was compared against the control data and the entire test print job was assessed as anomalous or normal. The numbers of true positives (anomalies claimed to exist and do exist), true negatives (anomalies claimed not to exist and are non-existent), false positives (anomalies claimed to exist
<table><caption>Table 2. Detection granularities for the anomaly creation attacks.</caption><thead><tr><td>Attack</td><td>Smallest Detected Change</td><td>Percentage Change</td></tr></thead><tbody><tr><td>Void Insertion</td><td>44 mm²</td><td>1.29%</td></tr><tr><td>Layer Thickness Alteration</td><td>5 µm</td><td>5.00%</td></tr><tr><td>Temperature Modification</td><td>5°C</td><td>3.57%</td></tr><tr><td>Scanning Speed Variation</td><td>25 mm/s</td><td>4.55%</td></tr></tbody></table>

<table><caption>Table 3. Anomaly detection results for simple printed parts.</caption><thead><tr><td>Accuracy</td><td>Sensitivity</td><td>Specificity</td><td>Precision</td></tr></thead><tbody><tr><td>96.9%</td><td>100%</td><td>87.5%</td><td>96.0%</td></tr></tbody></table>

but are non-existent) and false negatives (anomalies claimed not to exist but do exist) were computed. These values were used to compute the standard accuracy, sensitivity, specificity and precision metrics reported in Table 3. Clearly, the anomaly detection results for the simple printed parts are very good.

**Complex Printed Part Results.** Two control print jobs and two attack print jobs were executed to evaluate the efficacy of the anomaly detection method on a part with a complex shape with several intricate details. The first attack modified the laser scanning speed from 550 mm/s to 600 mm/s. The second attack modified the layer thickness from the recommended 100 µm to 105 µm and raised the print chamber temperature from the recommended 140°C to 145°C at the bottom of the print. The anomaly detection thresholds used were the same as those used in the simple part experiments.

During the experiment it was determined that the sintering area when building the complex part had to be at least 10 mm² in order for the ultraviolet light sensor to detect laser firing; otherwise, the laser sintered the layers much too quickly. The method was still able to detect two anomalies in layers with sintering areas larger than the 10 mm² limit, specifically, anomalies in the total number of layers and print chamber temperature. However, no anomalies were indicated by the laser timing readings during the scanning speed variation attack. This is likely due to the small to very small sintering areas of several complex part layers. The resulting shorter sintering times prevented the scanning speed variation attack from producing detectible differences in laser timing.
## 8. Discussion

The proposed anomaly detection method was able to detect anomalies in printed parts targeted by several attacks during various steps of the additive manufacturing process chain. The total cost of the sensors and devices (not including the printer) was under $120.

Positioning parts at different x-axis and y-axis locations on the print bed did not impact anomaly detection. However, varying the z-axis placement induced anomalies due to the differences in the numbers of layers in the print jobs. Additionally, the number of parts in each print job had to be the same or the laser timings would change between print jobs due to variations in the laser sintering area. Recalibration of the laser did not require the creation of a new baseline.

Changing the orientation of the rotary sensor board between print jobs did not affect anomaly detection because all the magnet angle readings were relative to each other. Ultraviolet light sensor placement between print jobs also did not affect anomaly detection as long as the sensor was positioned in the laser casing. However, the thermistor was sensitive to placement – moving it closer or farther away from the heating element vastly affected the readings.

Selective laser sintering is a highly time-dependent process. Laser timing proved to be the most reliable side channel for anomaly detection because all four types of attacks induced timing-related anomalies. However, installing the rotary sensor was essential to performing anomaly detection on a per-layer basis. Using the ultraviolet light sensor without the rotary sensor would have significantly increased the computations required to perform laser-layer correlation while increasing the error rate. Additionally, combining laser timing data with the other two side-channel readings further distinguished the types of anomalies.

An unexpected observation was that the laser firing pattern data was less useful than the print bed movement, laser firing time and print chamber temperature data. In fact, the laser firing data consistently indicated anomalies only when the layer thickness was changed.

Detecting anomalies on a per-layer basis – where each layer is evaluated independently – provides the opportunity for real-time quality control of printed parts. The real-time computations would also be reduced because the retroactive parsing of the collected data into layers is eliminated. Additionally, the detection of significant anomalies in a few layers could result in a print job being terminated immediately, saving time and reducing print material wastage.

A limitation of the anomaly detection method is that the additional sensors and devices increase the attack surface. Physical countermea-
sures such as access control and anti-tampering mechanisms, and cyber security countermeasures such as access control and authentication would have to be instituted. The Raspberry Pi network should also be isolated and secured.

However, the principal limitation is that, when an anomaly is detected, it is often not possible to identify the specific anomaly creation attack that was responsible. Other side channels such as print bed movement and print chamber temperature could be used to narrow the type of attack and direct mitigation efforts.

The anomaly detection method requires destructive testing to create a baseline for every new part design, but this may not be a large limitation for mission-critical parts where quality control is essential. Indeed, the verification of printed parts is a part of the normal workflow. The proposed method just adds an additional baseline creation step, which is easily integrated in the manufacturing workflow.

With regard to temperature detection, the main limitation is that the thermistor had a high error rating of 5°C at the printing temperature. Since changing the temperature as little as one degree can affect printed part quality, it is important to use a thermistor with a higher rating in anomaly detection.

It was not possible to reliably detect changes in the layer thickness using rotary sensor data. The attacks executed in this research changed the thickness of every part layer by the same amount during the slicing step, which changed the total number of layers. Therefore, it is possible that an attack that dynamically changes the thickness of individual layers while maintaining the layer count would go undetected. However, this attack would require extreme care to ensure that the other printed part measurements are not affected, requiring considerable skill and access on the part of the attacker.

Finally, the proposed anomaly detection method is unable to determine if a new bed of powder was actually laid when required. A solution is to position additional rotary sensors on the powder bed delivery motors and correlate their timing with print bed movements.

## 9. Conclusions

Due to the complexity of additive manufacturing systems, cyber attacks that seek to sabotage printed parts and/or print environments are difficult to detect and mitigate, and impossible to eliminate entirely. Therefore, it is imperative to focus on methods that can verify the integrity of printed parts. While quality control using destructive testing is an option, rapid and reliable non-destructive testing methods are needed
to detect anomalies in printed parts induced by cyber attacks during the
various steps in the additive manufacturing process chain.

The anomaly detection method developed for a selective laser sin-
tering system does not engage computing-intensive machine learning to
detect anomalies, relying instead on three side channels, print bed move-
ment, laser firing time and print chamber temperature, that underlie the
physics of selective laser sintering. The side channels provide detection
coverage while reducing the sensor requirements. Additionally, they are
robust to noise, which enhances the detection of printed part anomalies.

Experimental results demonstrate the efficacy of the anomaly de-
tection method under attacks that target the mechanical properties of
printed parts. The method yielded 96.9% anomaly detection accuracy.
The smallest discernible changes to printed parts were 1.29% for void
insertion attacks, 5% for layer thickness alteration attacks, 3.57% for
temperature modification attacks and 4.55% for scanning speed varia-
tion attacks. The cost of the sensors and peripheral devices is under $120
and anomaly detection for each test part requires less than three sec-
onds, rendering the method inexpensive and efficient for use in industrial
environments.

This research can be leveraged to develop reliable anomaly detection
methods for more expensive systems, including those employing metal-
based selective laser melting. Future research will focus on enhancing
anomaly detection by incorporating data from additional side channels
and considering other types of attacks that target the mechanical prop-
erties of printed parts. Despite promising experimental results, the pro-
posed method merely identifies anomalies in parts after they are printed.
Future research will attempt to address this limitation by leveraging side
channels to detect anomalies in parts and print environments while parts
are being printed, contributing to better attack detection and mitigation
capabilities as well as reduced material wastage.

Acknowledgement

This research was supported by the National Science Foundation un-
der Grant no. DGE 1501177 and by UT-Battelle under Contract no.
DE-AC05-00OR22725 with the U.S. Department of Energy.

References

[1] M. Al Faruque, S. Chhetri, S. Faezi and A. Canedo, Forensics of Thermal Side Channels in Additive Manufacturing Systems, CECS Technical Report #16-01, Center for Embedded and Cyber-Physical Systems, University of California, Irvine, Irvine, California, 2016.
[2] C. Bayens, T. Le, L. Garcia, R. Beyah, M. Javanmard and S. Zonouz, See no evil, hear no evil, print no evil? Malicious fill pattern detection in additive manufacturing, *Proceedings of the Twenty-Sixth USENIX Security Symposium*, pp. 1181–1198, 2017.

[3] S. Belikovetsky, Y. Solewicz, M. Yampolskiy, J. Toh and Y. Elovici, Digital audio signature for 3D printing integrity, *IEEE Transactions on Information Forensics and Security*, vol. 14(5), pp. 1127–1141, 2018.

[4] S. Belikovetsky, M. Yampolskiy, J. Toh, J. Gatlin and Y. Elovici, dr0wned – Cyber-physical attack with additive manufacturing, presented at the *Eleventh USENIX Workshop on Offensive Technologies*, 2017.

[5] J. Brandman, L. Sturm, J. White and C. Williams, A physical hash for preventing and detecting cyber-physical attacks on additive manufacturing systems, *Journal of Manufacturing Systems*, vol. 56, pp. 202–212, 2020.

[6] S. Chhetri, A. Canedo and M. Al Faruque, KCAD: Kinetic cyber-attack detection method for cyber-physical additive manufacturing systems, *Proceedings of the IEEE/ACM International Conference on Computer-Aided Design*, 2016.

[7] J. Ellis, 3D-printed nuclear reactor promises faster, more economical path to nuclear energy, *Oak Ridge National Laboratory News*, Oak Ridge National Laboratory, Oak Ridge, Tennessee (www.ornl.gov/news/3d-printed-nuclear-reactor-promises-faster-more-economical-path-nuclear-energy), May 11, 2020.

[8] S. Faaezi, S. Chhetri, A. Malawade, J. Chaput, W. Grover, P. Brisk and M. Al Faruque, Oligo-Snoop: A non-invasive side-channel attack against DNA synthesis machines, *Proceedings of the Twenty-Sixth Annual Network and Distributed Systems Security Symposium*, 2019.

[9] J. Gatlin, S. Belikovetsky, S. Moore, Y. Solewicz, Y. Elovici and M. Yampolskiy, Detecting sabotage attacks in additive manufacturing using actuator power signatures, *IEEE Access*, vol. 7, pp. 133421–133432, 2019.

[10] L. Graves, W. King, P. Carrion, S. Shao, N. Shamsaei and M. Yampolskiy, Sabotaging metal additive manufacturing: Powder delivery system manipulation and material-dependent effects, *Additive Manufacturing*, vol. 46, article no. 10209, 2021.
[11] A. Hojjati, A. Adhikari, K. Struckmann, E. Chou, T. Nguyen, K. Madan, M. Winslett, C. Gunter and W. King, Leave your phone at the door: Side channels that reveal factory floor secrets, *Proceedings of the ACM SIGSAC Conference on Computer and Communications Security*, pp. 883–894, 2016.

[12] Inspector General, U.S. Department of Defense, Audit of the Cybersecurity of Department of Defense Additive Manufacturing Systems, Washington, DC (media.defense.gov/2021/Jul/07/2002757308/-1/-1/1/DODIG-2021-098.PDF), 2021.

[13] T. Kellner, Mind Meld: How GE and a 3D-Printing Visionary Joined Forces, GE Report, General Electric, Boston, Massachusetts (www.ge.com/news/reports/mind-meld-ge-3d-printing-visionary-joined-forces), July 10, 2017.

[14] E. Kurkowski, A. Van Stockum, J. Dawson, C. Taylor, T. Schulz and S. Shenoi, Manipulation of G-code toolpath files in 3D printers: Attacks and mitigations, in *Critical Infrastructure Protection XVI*, J. Staggs and S. Shenoi (Eds.), Springer, Cham, Switzerland, pp. 155–174, 2022.

[15] M. Leary, *Design for Additive Manufacturing*, Elsevier, Amsterdam, The Netherlands, 2020.

[16] Manufactur3D Magazine, The seven types of additive manufacturing technologies, Thane, India (manufactur3dmag.com/7-types-additive-manufacturing-technologies), April 6, 2018.

[17] S. Moore, W. Glisson and M. Yampolskiy, Implications of malicious 3D printer firmware, *Proceedings of the Fiftieth Hawaii International Conference on System Sciences*, 2017.

[18] H. Pearce, K. Yanamandra, N. Gupta and R. Karri, FLAW3D: A Trojan-Based Cyber Attack on the Physical Outcomes of Additive Manufacturing, arXiv: 2104.09562 (arxiv.org/abs/2104.09562), 2021.

[19] B. Post, B. Richardson, P. Lloyd, L. Love, S. Nolet and J. Han-nan, Additive Manufacturing of Wind Turbine Molds, Document ORNL/TM-2017/290, Oak Ridge National Laboratory, Oak Ridge, Tennessee, 2017.

[20] M. Rais, Y. Li and I. Ahmed, Spatiotemporal G-code modeling for secure FDM-based 3D printing, *Proceedings of the Twelfth ACM/IEEE International Conference on Cyber-Physical Systems*, pp. 177–186, 2021.
[21] Sintratec, Sintratec Kit: Most innovative product in the Polish market, Press Release, Brugg, Switzerland (staticcontent.sintratec.com/wp-content/uploads/2018/08/19073627/180412_Press_RemarketingSintratec_winsAward_for_Most_Innovative_product_2018.pdf), April 12, 2018.

[22] Sintratec, Sintratec Kit, Brugg, Switzerland (sintratec.com/product/sintratec-kit), 2022.

[23] C. Song, F. Ling, Z. Ba, K. Ren, C. Zhou and W. Xu, My smartphone knows what you print: Exploring smartphone-based side-channel attacks against 3D printers, *Proceedings of the ACM SIGSAC Conference on Computer and Communications Security*, pp. 895–907, 2016.

[24] L. Sturm, M. Albakri, P. Tarazaga and C. Williams, In situ monitoring of material jetting additive manufacturing process via impedance based measurements, *Additive Manufacturing*, vol. 28, pp. 456–463, 2019.

[25] L. Sturm, C. Williams, J. Camelio, J. White and R. Parker, Cyber-physical vulnerabilities in additive manufacturing systems: A case study attack on the .STL file with human subjects, *Journal of Manufacturing Systems*, vol. 44(1), pp. 154–164, 2017.

[26] H. Vincent, L. Wells, P. Tarazaga and J. Camelio, Trojan detection and side-channel analyses for cyber security in cyber-physical manufacturing systems, *Procedia Manufacturing*, vol. 1, pp. 77–85, 2015.

[27] M. Wu, V. Phoha, Y. Moon and A. Belman, Detecting malicious defects in 3D printing process using machine learning and image classification, *Proceedings of the ASME International Mechanical Engineering Conference and Exposition*, article no. 67641, 2016.

[28] C. Xiao, Security attack on 3D printing, presented at the *xFokus Security Conference* (www.claudxiao.net/Attack3DPrinting-Claud-en.pdf), 2013.

[29] S. Yu, A. Malawade, S. Chhetri and M. Al Faruque, Sabotage attack detection for additive manufacturing systems, *IEEE Access*, vol. 8, pp. 27218–27231, 2020.