Stealthy process attack detection for automated manufacturing
Additive manufacturing's reliance on embedded computing renders it vulnerable to tampering through cyber-attacks. Sensor instrumentation of additive manufacturing devices allows for rigorous process and security monitoring, but also results in a massive volume of noisy data for each run. As such, in-situ, near-real-time anomaly detection is challenging. A probabilistic-model-based approach addresses this challenge.
1. Memory encoding instructions that, when executed by data processing apparatus, cause the data processing apparatus to perform operations comprising:
accessing current and voltage signals indicative of instructions provided by controller circuitry of a 3D printer to actuators thereof based on a toolpath source, wherein subsets of the accessed current and voltage signals correspond to unaltered instructions and to instructions altered by malicious changes to the toolpath source;
retrieving respective phase signals from the current and voltage signals of the subsets;
determining phase synchrony metrics between the phase signals in a pair-wise manner, and associate, based on the phase synchrony metrics, a first class of signals with unaltered instructions and a second class of signals with altered instructions;
training, based on the determined phase synchrony metrics between the phase signals retrieved from the current and/or voltage signals indicative of instructions to at least some of the actuators, a Bayesian probabilistic model of logistic regression to define the boundary between the first class and the second class;
receiving a new current or voltage signal indicative of new instructions provided by the controller circuitry to one of the actuators; and
predicting, based on the trained model, whether the new instructions are unaltered or altered.
2. The memory of claim 1 , wherein the operation of training the model comprises performing a Monte Carlo Markov chain method to train parameters of the logistic regression.
3. The memory of claim 1 , wherein the operation of retrieving respective phase signals from the current and voltage signals comprises applying a Hilbert Transform to each of the current and voltage signals.
4. The memory of claim 1 , wherein the operation of determining phase synchrony metrics between the phase signals comprises, for each pair of phase signals,
producing a binary phase synchrony signal from the pair of phase signals, and
averaging the binary phase synchrony signal as the pair's phase synchrony metric.
5. The memory of claim 1 , wherein the operations further comprise synchronizing the accessed current and voltage signals with each other.
6. The memory of claim 1 , wherein the operations further comprise decimating the accessed current and voltage signals.
7. The memory of claim 1 , wherein the operation of training the model is performed based on the determined phase synchrony metrics between the phase signals retrieved from the current and voltage signals indicative of instructions to at least two of the actuators.
8. The memory of claim 1 , wherein the operation of training the model is performed based on the determined phase synchrony metrics between the phase signals retrieved from the current signals or voltage signals indicative of instructions to a single one of the actuators.
9. The memory of claim 8 , wherein the new current signal or the new voltage signal is indicative of new instructions provided by the controller circuitry to one of the actuators that is different from the single actuator used for the training operation.
10. The memory of claim 1 , including
collecting raw nominal data, raw baseline data, and raw attack data;
filtering the raw nominal data, raw baseline data, and raw attack data with a band-pass filter;
calculating instantaneous phase of the raw nominal data, raw baseline data, and raw attack data;
calculating baseline:baseline phase synchrony;
calculating baseline:attack phase synchrony; and
performing Monte Carlo Markov Chain logistic curve optimization.
11. The memory of claim 1 , wherein the operations further comprise
accessing a threshold probability value;
predicting the new instructions are altered in response to a probability value that meets or exceeds the threshold probability value, labeling the new instructions as altered, and causing a warning to be presented in a user interface.
12. The memory of claim 1 , wherein the operations further comprise
accessing a threshold probability value;
predicting the new instructions are unaltered in response to a probability value that is below the threshold probability value and labeling the new instructions as unaltered.
13. A system comprising:
a 3D printer comprising
actuators, and
a controller configured to provide instructions to the actuators based on a toolpath file;
respective current and voltage sensors arranged and configured to issue current and voltage signals indicative of the instructions provided by the controller to the actuators;
a data processing apparatus; and
the memory of claim 1 .
14. The system of claim 13 wherein the actuators include an x-axis motor, y-axis motor, z-axis motor, polymer extruder motor, and fiber extruder motor, and a polymer heatblock.
15. The system of claim 13 , wherein the 3D printer comprises
the data processing apparatus, and
the memory.
16. The system of claim 13 , comprising:
a display module communicatively coupled with the data processing apparatus and configured to present a warning.
17. A method of detecting stealth additive manufacturing attacks altering g-code instructions during additive manufacturing, the method comprising:
providing additive manufacturing equipment configured to generate additively manufactured parts, the additive manufacturing equipment including a controller for controlling operation of the additive manufacturing equipment and at least one driver for controlling operation of an additive manufacturing component;
providing a stealth attack detection system;
clamping a Hall effect sensor to, at one end, a lead between the driver and the additive manufacturing component and, at the other end, the stealth attack detection system;
receiving, at the stealth attack detection system, an operation current signal indicative of operational additive manufacturing instructions provided by the controller to the additive manufacturing component; and
predicting, based on a trained probabilistic attack detection model, whether the new instructions are unaltered or altered.
18. The method of detecting stealth additive manufacturing attacks of claim 17 further including training the probabilistic attack detection model, wherein the training includes:
collecting, in the stealth attack detection system, current data signals indicative of instructions provided by the controller to the additive manufacturing component based on a toolpath source, wherein subsets of the collected current signals correspond to unaltered instructions and subsets of the collected current signals correspond to instructions altered by malicious changes to the toolpath source;
determining, with the stealth attack detection system, respective phase signals from the current signals of the subsets;
determining phase synchrony metrics between the phase signals in a pair-wise manner, and associating, based on the phase synchrony metrics, a first class of signals with unaltered instructions and a second class of signals with altered instructions;
training, based on the determined phase synchrony metrics between the phase signals retrieved from the current signals indicative of instructions to the additive manufacturing component, a Bayesian probabilistic model of logistic regression to define the boundary between the first class and the second class.
19. The method of detecting stealth additive manufacturing attacks of claim 17 including retrofitting additive manufacturing equipment with the stealth attack detection apparatus.
20. The method of detecting stealth additive manufacturing attacks of claim 17 including integrating the stealth attack detection apparatus into the additive manufacturing equipment.