Hardware Trojan Detection Technique Research Articles

A fast modularity hardware Trojan detection technique for large scale gate-level netlists

Hardware Trojans (HTs) are a kind of malicious circuit implanted by adversaries and induce malfunction under rare situations. Attackers may insert HTs into untrusted third-party intellectual properties (3PIPs), thus severely threatening the hardware security of ICs. To overcome this issue, state-of-art HT detection techniques are proposed based on feature extraction of gate-level netlists (GLNs). However, these techniques may take a long time to extract HT signals for large scale GLNs. In this paper, we propose a fast modularity HT detection (FMTD) method for large scale GLNs. The GLN modularity algorithm can divide the whole GLN into several small modules with the boundaries of D flip-flops (DFFs) of each module. By analyzing the transition rate of critical signals, preserving suspicious DFFs, and repairing the ring circuit, we can ensure the integrity of HT circuits during the GLN modularity process. Then, the calculation of the testability of each module is conducted in parallel with our self-designed tool. In the self-designed tool, we repair the ring circuit, calculate the testability values, and calibrate the testability values of module boundary signals. Compared with the EDA tools, our self-designed tool has no upper limit of testability values. Then, the testability values are sent to the unsupervised K-means clustering simultaneously to diagnose the HT signals. Facilitated by the modularity of the GLN, the detection time of 105 order signals sample is reduced by up to 90 % when compared to the traditional COTD method, while our MFTD method shows a similar HT detection performance to that of the traditional COTD method. For all 20 kinds of GLN samples in Trust-hub, our FMTD method can obtain a detection accuracy of 100 %, and signal diagnosis precision of more than 93 % with a diagnosis false positive rate lower than 1 %.

A Pre-Silicon Detection Based on Deep Learning Model for Hardware Trojans

Several hardware Trojan (HT) detection techniques are available today to ensure the security of hardware systems. However, the existing pre-silicon HT detection techniques have problems such as difficulties in capturing HT path features and poor applicability. To address these challenges, this paper proposes a gate-level HT detection scheme based on a deep learning model. We parse the circuit gate-level netlist and develop an algorithm to extract circuit path sentences based on the signal propagation rule. Path sentences consisting of gate names are extracted as experimental datasets. We apply the theory of natural language processing (NLP) to the task of HT detection and use three neural networks to filter the length of path sentences. Then, based on the deep learning model text convolutional neural network (TextCNN), we propose PS-TextCNN for HT detection. Our approach is verified on seven benchmark circuits of the RS232-series and eight benchmark circuits of the s-series. We achieve an average true positive rate (TPR) of 88.9%. The TPR of the RS232-series reaches a high score of 99.5%. The TPR of the s-series is 79.5%, which is significantly higher than that of the existing gate-level HT detection techniques.

A New ATPG and Online Monitoring based Technique for Hardware Trojan Detection

Hardware Trojan (HT) is the most severe security threat during an integrated circuit (IC) development. The logic testing based pre-silicon techniques fail to detect the HT inserted during fabrication, whereas the existing ATPG based approaches provide low coverage and are inefficient to trigger hard-to-activate sites. Further, the existing online monitoring techniques fail to detect the Trojans effectively and do not provide any opportunity to fix/reject the design. Therefore, a new HT detection technique is proposed that combines ATPG and online monitoring to detect all the stealthy Trojans effectively. This paper first proposes a new ATPG algorithm that generates the patterns to activate the Trojan. Further, a new modified HT detection (checker) logic is proposed that is selectively inserted in the original design to effectively observe the effect of activated Trojan during post-silicon testing and online monitoring. The proposed checker logic eliminates the masking problem and can also observe the effects of those HTs, which could not propagate to the output. The experimental evaluation on ISCAS benchmarks shows that our algorithm provides 4.5× higher trigger coverage and does not leave any feasible rare-node inactivated. Further, the proposed checker effectively observes malicious behavior without additional overhead over the existing checker. The insertion of our checker at 25% low observability nodes in ISCAS benchmarks requires only 0.189% area overhead.

A Novel Attack Mode on Advanced Technology Nodes Exploiting Transistor Self-Heating

Self-heating (SH) is a phenomenon that can induce excessive heat inside the transistor channel. SH represents an emerging and serious concern, especially in advanced technology nodes, where excessive heat acting on elevated channel geometries will notably shift the critical transistor parameters (e.g., threshold-voltage <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$V_{\text {th}}$ </tex-math></inline-formula> and carrier mobility <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$\mu $ </tex-math></inline-formula> ). The underlying 3-D device structures (e.g., FinFET, nanowire, or nanosheet structures), along with newly employed materials such as silicon-germanium (SiGe), which show worse thermal conductivity than traditional materials, can considerably exacerbate SH. On top of that, quantum confinement, a phenomenon that becomes dominant at sub-10nm, further increases the intensity of SH. In this article, we are the first to explore SH effects from the perspective of hardware security, rather than the performance, reliability standpoints covered in state-of-the-art (SOTA) work. As proof of concept, we devise an SH-based hardware trojan (HT) that exploits the SH-induced <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$V_{\text {th}}$ </tex-math></inline-formula> change in 7-nm FinFET circuits. Leveraging <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$V_{\text {th}}$ </tex-math></inline-formula> -dependent reconfigurable logic, we design a reconfigurable HT payload that maliciously changes its functional behavior once the SH-induced <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$V_{\text {th}}$ </tex-math></inline-formula> change takes effect. Following SOTA work, we present a comprehensive modeling and analysis of SH effects at the device level and highlight its impact on transistor <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$V_{\text {th}}$ </tex-math></inline-formula> . Next, we study how fabrication-time changes in the transistor doping and geometry can promote the SH-assisted degradation. We then describe various payload configurations for the proposed HT, quantify its overheads, and discuss its resilience against standard HT detection techniques. Finally, we demonstrate two case studies using the proposed HT, one to leak the secret key from a pipelined design of an advanced encryption standard (AES) circuit, and another to showcase denial-of-service for a Gaussian-blur filter circuit. Our work utilizes industry-standard models with parameters extracted from measurements and calibrated with experiments. Our results are obtained from meticulous study and optimization across the device-, circuit-, and system-levels.

Golden-Free Hardware Trojan Detection Using Self-Referencing

The globalization of the semiconductor supply chain has developed a new set of challenges for security researchers. Among them, malicious alterations of hardware designs at an untrusted facility, or Trojan insertion, are considered one of the most difficult challenges. While side-channel analysis-based hardware Trojan detection techniques have shown great potential, most solutions, proposed over the past decade, require the availability of golden (i.e., Trojan-free) chips and are susceptible to process variations. Few techniques that do not require a golden chip depend on simulation-based modeling of the side-channel signature, which may not be reliable for differentiating between process and Trojan induced variations. Furthermore, most of these techniques are evaluated either using very few Trojan inserted chips or simulation-based test setup. Spatial and temporal self-referencing-based detection mechanisms proposed earlier effectively eliminate the need for a golden chip and the impact of process variations. However, these techniques have not been adequately studied to achieve high detection sensitivity. In this article, we propose a golden-free multidimensional self-referencing technique that analyzes the side-channel signatures in both the time and frequency domains to significantly broaden the Trojan coverage and strengthen the detection confidence. We introduce a fully automated detection framework containing systematic methodologies for test generation, signature extraction, signal processing, threshold calculation, and metric-based decision-making that effectively enables the synergistic self-referencing approach. Finally, we evaluate the proposed technique through a comprehensive hardware measurement setup consisting of 96 Trojan-inserted test chips. Along with achieving a high detection coverage, we demonstrate that the analysis of spatial and temporal discrepancies in both frequency and time domains helps to reliably detect small hard-to-detect Trojans under process and measurement induced variations.

A Pre-Activation, Golden IC Free, Hardware Trojan Detection Approach

The increasing concern about the security and reliability of abroad manufactured integrated circuits (ICs) has attracted academia and industries to develop hardware Trojan (HT) detection approaches. This article presents an efficient integrated HT detection technique based on evaluating changes in the integrated parasitic capacitors. The HT detection circuit consists of a capacitively coupled, low-power, low-noise, operational transconductance amplifier (OTA), which can detect capacitance fluctuations in the range of 10 aF. The HT detection circuit consumes <inline-formula> <tex-math notation="LaTeX">$5.88~\mu \text {W}$ </tex-math></inline-formula> from 1.8-V power supply in 180-nm CMOS technology. The detection method is based on clustering the IC and monitoring each cluster&#x2019;s flag. The flag set circuit is designed to sense parasitic capacitance and change its status based on it. The proposed technique can detect the HT circuit before the activation of the IC. Moreover, this technique shows very promising results in detecting HTs with zero-delay effect, which is a challenging issue in the conventional delay-based side-channel signal analysis method. More significantly, the proposed method does not require a golden IC for HT detection and can detect the HT using simulation-based data. The proposed method creates a recognizable difference detection signal between the capacitive behavior of an infected and a pure IC. This results in a high confidence level in the proposed detection method. The proposed idea is implemented on ISCAS&#x2019;85 benchmark circuits, and the detection outcomes and the statistical simulations are presented.

A new hardware Trojan detection technique using deep convolutional neural network

The involvement of external vendors in semiconductor industries increases the chance of hardware Trojan (HT) insertion in different phases of the integrated circuit (IC) design. Recently, several partial reverse engineering (RE) based HT detection techniques are reported, which attempt to reduce the time and complexity involved in the full RE process by applying machine learning or image processing techniques in IC images. However, these techniques fail to extract the relevant image features, not robust to image variations, complicated, less generalizable, and possess a low detection rate. Therefore, to overcome the above limitations, this paper proposes a new partial RE based HT detection technique that detects Trojans from IC layout images using Deep Convolutional Neural Network (DCNN). The proposed DCNN model consists of stacking several convolutional and pooling layers. It layer-wise extracts and selects the most relevant and robust features automatically from the IC images and eliminates the need to apply the feature extraction algorithm separately. To prevent the over-training of the DCNN model, a new stopping condition method and two new metrics, namely Accuracy difference measure (ADM) and Loss difference measure (LDM), are proposed that halts the training only when the performance of our model genuinely drops. Further, to combat the issue of process variations and fabrication noise generated during the RE process, we include noisy images with varying parameters in the training process of the model. We also apply the data augmentation and regularization techniques in the model to address the issues of underfitting and overfitting. Experimental evaluation shows that the proposed technique provides 99% and 97.4% accuracy on Trust-Hub and synthetic ISCAS dataset, respectively, which is on-an-average 15.83% and 21.69% higher than the existing partial RE based techniques.

MacLeR: Machine Learning-Based Runtime Hardware Trojan Detection in Resource-Constrained IoT Edge Devices

Traditional learning-based approaches for run-time Hardware Trojan detection require complex and expensive on-chip data acquisition frameworks and thus incur high area and power overhead. To address these challenges, we propose to leverage the power correlation between the executing instructions of a microprocessor to establish a machine learning-based run-time Hardware Trojan (HT) detection framework, called MacLeR. To reduce the overhead of data acquisition, we propose a single power-port current acquisition block using current sensors in time-division multiplexing, which increases accuracy while incurring reduced area overhead. We have implemented a practical solution by analyzing multiple HT benchmarks inserted in the RTL of a system-on-chip (SoC) consisting of four LEON3 processors integrated with other IPs like vga_lcd, RSA, AES, Ethernet, and memory controllers. Our experimental results show that compared to state-of-the-art HT detection techniques, MacLeR achieves 10\% better HT detection accuracy (i.e., 96.256%) while incurring a 7x reduction in area and power overhead (i.e., 0.025% of the area of the SoC and <0.07% of the power of the SoC). In addition, we also analyze the impact of process variation and aging on the extracted power profiles and the HT detection accuracy of MacLeR. Our analysis shows that variations in fine-grained power profiles due to the HTs are significantly higher compared to the variations in fine-grained power profiles caused by the process variations (PV) and aging effects. Moreover, our analysis demonstrates that, on average, the HT detection accuracy drop in MacLeR is less than 1% and 9% when considering only PV and PV with worst-case aging, respectively, which is ~10x less than in the case of the state-of-the-art ML-based HT detection technique.

Ten years of hardware Trojans: a survey from the attacker's perspective

Hardware Trojan detection techniques have been studied extensively. However, to develop reliable and effective defenses, it is important to figure out how hardware Trojans are implemented in practical scenarios. The authors attempt to make a review of the hardware Trojan design and implementations in the last decade and also provide an outlook. Unlike all previous surveys that discuss Trojans from the defender's perspective, for the first time, the authors study the Trojans from the attacker's perspective, focusing on the attacker's methods, capabilities, and challenges when the attacker designs and implements a hardware Trojan. First, the authors present adversarial models in terms of the adversary's methods, adversary's capabilities, and adversary's challenges in seven practical hardware Trojan implementation scenarios: in-house design team attacks, third-party intellectual property vendor attacks, computer-aided design tools attacks, fabrication stage attacks, testing stage attacks, distribution stage attacks, and field-programmable gate array Trojan attacks. Second, the authors analyse the hardware Trojan implementation methods under each adversarial model in terms of seven aspects/metrics: hardware Trojan attack scenarios, the attacker's motivation, feasibility, detectability (anti-detection capability), protection and prevention suggestions for the designer, overhead analysis, and case studies of Trojan implementations. Finally, future directions on hardware Trojan attacks and defenses are also discussed.

Securing IoT Space via Hardware Trojan Detection

Hardware Trojan (HT) is a malicious modification in the chip circuitry, which may lead to undesired chip function changing or sensitive information leaking once activated. As recently studied, HT has become one of the main threats for Internet-of-Things (IoT) security, and therefore, protecting IoT against the HT attack attracts growing attention from IoT researchers. In this article, we propose an HT detection technique which makes use of chip temporal thermal information and self-organizing map (SOM) neural network to automatically isolate the Trojan-infected chips with the Trojan-free ones, and meanwhile, confirm the Trojan location at the infected chips. The experimental results reveal that our method is effective. Specifically, for the Trust-hub benchmarks, it can detect HTs which increase only 0.02% power consumption of the original design and localize the Trojan positions precisely without any error. In addition, we demonstrate the advantages of our method over two existing HT detection methods, namely, the thermal and power map (TPM) and ring oscillator net (RON), and make a thorough discussion on how the thermal image resolution, chip technology, and clustering algorithm affect the Trojan detection results.

Building an accurate hardware Trojan detection technique from inaccurate simulation models and unlabelled ICs

Most of prior hardware Trojan detection approaches require golden chips for references. A classification-based golden chips-free hardware Trojan detection technique has been proposed in the authors' previous work. However, the algorithm in that work is trained by simulated ICs without considering a shift between the simulation and silicon fabrication. In this study, a co-training based hardware Trojan detection method by exploiting inaccurate simulation models and unlabeled fabricated ICs is proposed to provide reliable detection capability when facing fabricated ICs, which eliminates the need of golden chips. Two classification algorithms are trained using simulated ICs. These two algorithms can identify different patterns in the unlabelled ICs during test-time, and thus can label some of these ICs for the further training of the other algorithm. Moreover, a statistical examination is used to choose ICs labelling for the other algorithm. A statistical confidence interval based technique is also used to combine the hypotheses of the two classification algorithms. Furthermore, the partial least squares method is used to preprocess the raw data of ICs for feature selection. Both EDA experiment results and field programmable gate array (FPGA) experiment results show that the proposed technique can detect unknown Trojans with high accuracy and recall.

COTD: Reference-Free Hardware Trojan Detection and Recovery Based on Controllability and Observability in Gate-Level Netlist

This paper presents a novel hardware Trojan detection technique in gate-level netlist based on the controllability and observability analyses. Using an unsupervised clustering analysis, the paper shows that the controllability and observability characteristics of Trojan gates present significant inter-cluster distance from those of genuine gates in a Trojan-inserted circuit, such that Trojan gates are easily distinguishable. The proposed technique does not require any golden model and can be easily integrated into the current integrated circuit design flow. Furthermore, it performs a static analysis and does not require any test pattern application for Trojan activation either partially or fully. In addition, the timing complexity of the proposed technique is an order of the number of signals in a circuit. Moreover, the proposed technique makes it possible to fully restore an inserted Trojan and to isolate its trigger and payload circuits. The technique has been applied on various types of Trojans, and all Trojans are successfully detected with 0 false positive and negative rates in less than 14 s in the worst case.

Temperature‐variation‐based hardware Trojan detection through ring oscillator

Hardware Trojan (HT) insertions have emerged as a major security concern for integrated circuits. HT can cause undesired change in functional behaviour, while it also changes the temperature characteristic of the chip. A temperature variation-based HT detection technique through ring oscillator is proposed. Ring-oscillator is a thermally sensitive digital oscillator, and the number of oscillations that the counter counts varies with temperature. It is shown that the ring oscillator's count in a chip with HT insertion in a fixed duration drops faster. With this count, statistical analysis finds that the deviation between the maximum and minimum value in a chip without HT insertion is approximate to another, while HT insertion will cause the deviation value extend. Then, we present a Trojan detection approach using ring oscillator's count analysis. Experimental results show that the proposed approach achieves more effective and easier for Trojan detection. Moreover, the proposed detection approach can be used to detect different HT insertion in different place on the chips.

Guest Editorial

Guest Editorial

Detecting Hardware Trojan through Time Domain Constrained Estimator Based Unified Subspace Technique

SUMMARY Hardware Trojan (HT) has emerged as an impending security threat to hardware systems. However, conventional functional tests fail to detect HT since Trojans are triggered by rare events. Most of the existing side-channel based HT detection techniques just simply compare and analyze circuit’s parameters and offer no signal calibration or error correction properties, so they suffer from the challenge and interference of large process variations (PV) and noises in modern nanotechnology which can completely mask Trojan’s contribution to the circuit. This paper presents a novel HT detection method based on subspace technique which can detect tiny HT characteristics under large PV and noises. First, we formulate the HT detection problem as a weak signal detection problem, and then we model it as a feature extraction model. After that, we propose a novel subspace HT detection technique based on time domain constrained estimator. It is proved that we can distinguish the weak HT from variations and noises through particular subspace projections and reconstructed clean signal analysis. The reconstructed clean signal of the proposed algorithm can also be used for accurate parameter estimation of circuits, e.g. power estimation. The proposed technique is a general method for related HT detection schemes to eliminate noises and PV. Both simulations on benchmarks and hardware implementation validations on FPGA boards show the effectiveness and high sensitivity of the new HT detection technique.