Additive manufacturing (AM) is rapidly integrating into critical sectors such as aerospace, automotive, and healthcare. However, this cyber-physical convergence introduces new attack surfaces, especially at the interface between computer-aided design (CAD) and machine execution layers. In this work, we investigate targeted cyberattacks on two widely used fused deposition modeling (FDM) systems, Creality's flagship model K1 Max, and Ender 3. Our threat model is a multi-layered Man-in-the-Middle (MitM) intrusion, where the adversary intercepts and manipulates G-code files during upload from the user interface to the printer firmware. The MitM intrusion chain enables several stealthy sabotage scenarios. These attacks remain undetectable by conventional slicer software or runtime interfaces, resulting in structurally defective yet externally plausible printed parts. To counter these stealthy threats, we propose an unsupervised Intrusion Detection System (IDS) that analyzes structured machine logs generated during live printing. Our defense mechanism uses a frozen Transformer-based encoder (a BERT variant) to extract semantic representations of system behavior, followed by a contrastively trained projection head that learns anomaly-sensitive embeddings. Later, a clustering-based approach and a self-attention autoencoder are used for classification. Experimental results demonstrate that our approach effectively distinguishes between benign and compromised executions.

翻译：增材制造（AM）正快速融入航空航天、汽车和医疗等关键领域。然而，这种信息物理融合引入了新的攻击面，特别是在计算机辅助设计（CAD）与机器执行层之间的接口处。本研究针对两种广泛使用的熔融沉积成型（FDM）系统——Creality旗舰型号K1 Max和Ender 3——探究了定向网络攻击。我们的威胁模型采用多层中间人（MitM）入侵方式，攻击者在用户界面上传G代码文件至打印机固件的过程中拦截并篡改文件。该MitM入侵链可实现多种隐蔽的破坏场景，这些攻击无法被传统切片软件或运行时接口检测，导致打印部件存在结构性缺陷却保持外部形态的合理性。为应对此类隐蔽威胁，我们提出一种无监督入侵检测系统（IDS），通过分析实时打印过程中生成的结构化机器日志进行防御。该防御机制采用冻结的基于Transformer的编码器（BERT变体）提取系统行为的语义表征，随后通过对比训练投影头学习异常敏感嵌入，最终结合基于聚类的方法与自注意力自编码器进行分类。实验结果表明，该方法能有效区分正常执行与受攻击的执行过程。