Trojan Detection Research Articles

Hardware Trojan Detection based on Testability Measures in Gate Level Netlists using Machine Learning

Modern integrated circuit design manufacturing involves outsourcing intellectual property to third-party vendors to cut down on overall cost. Since there is a partial surrender of control, these third-party vendors may introduce malicious circuit commonly known as Hardware Trojan into the system in such a way that it goes undetected by the end-users’ default security measures. Therefore, to mitigate the threat of functionality change caused by the Trojan, a technique is proposed based on the testability measures in gate level netlists using Machine Learning. The proposed technique detects the presence of Trojan from the gate-level description of nodes using controllability and observability values. Various Machine Learning models are implemented to classify the nodes as Trojan infected and non-infected. The efficiency of linear discriminant analysis obtains an accuracy of 92.85 %, precision of 99.9 %, recall of 80%, and F1 score of 88.8% with a latency of around 0.9 ms.

Graph Centrality Algorithms for Hardware Trojan Detection at Gate-Level Netlists

Graph Centrality Algorithms for Hardware Trojan Detection at Gate-Level Netlists

A method to prevent hardware Trojans limiting access to layout resources

The advancement of Integrated Circuit (IC) technology has encouraged the IC industries to go fabless and outsource the fabrication to other companies, due to the cost associated with installing a new facility and design to production time limitations. It has also introduced an adverse effect on hardware security, known as Hardware Trojan (HT), which is very difficult to detect due to low signal-to-noise (SNR) ratio. As a result, Hardware Trojan has become a serious concern for the semiconductor industry. Even though researchers have proposed various solutions and design methods to address these security concerns, due to the wide range of Trojans, a comprehensive solution to counteract these security threats is yet far from reach. For now, only specific solutions for certain Trojan detection have been presented. Different Trojan prevention methods have also been explored with optimal hardware security in mind. In this article, a novel Design-For-Security (DFS) idea for HT prevention has been presented where the unused polysilicon layer is occupied using minimum feature wires and thus deprive the attackers of the resources needed for Trojan routing. The main advantage of this technique is that it prevents an attacker from inserting any active layer in the silicon substrate, which is a fundamental component of any CMOS device. Since the active layer connects directly to any polysilicon layer, if the unused polysilicon layer is covered with minimum feature wire, it is impossible for attackers to rout any extra circuitry without removing a portion of the polysilicon wire. A readout circuit is used to determine the delay produced by the added polysilicon wires, which in turn makes sure that the polysilicon layer is intact, and it has not been tampered with. A unique signature is also obtained using those polysilicon wires as probes to induce signal from the main circuit. Any modification to either the circuit or the polysilicon probe will reflect a change in the signature. Simulation results indicate that with a proper design, even the insertion of a single inverter can be detected. This technique can ensure 100% utilization of the empty spaces in the polysilicon layer.

Analog hardware trojan design and detection in OFDM based wireless cryptographic ICs.

Due to Hardware Trojan (HT), trustworthiness of Integrated Circuit (IC) supply chain is a burning issue in Semiconductor Industry nowadays. Over the last decade, extensive research has been carried on HT detection methods for digital circuits. However, the HT issue remains largely unexplored in the domain of Analog Mixed Signal (AMS)/ RF circuit where it is now an appealing target for the attackers. The increasing popularity of Orthogonal Frequency Division Multiplexing (OFDM) based wireless cryptographic ICs in modern communication systems makes it a lucrative target for HT-based attacks which could have a devastating impact on data security. This paper presents a trigger-based Hardware Trojan Threat model that exploits the extended cyclic prefix (ECP) property of the OFDM communication scheme to leak the secret encryption key over low noise Additive White Gaussian Channel (AWGN) and developed a Cyclic Prefix (CP) checker based detection mechanism named “SENTRY” to detect such trojans once it is triggered.

A Deep Learning Approach in Optical Inspection to Detect Hidden Hardware Trojans and Secure Cybersecurity in Electronics Manufacturing Supply Chains

Deep learning methods have been extensively studied and have been proven to be very useful in multiple fields of technology. This paper presents a deep learning approach to optically detect hidden hardware trojans in the manufacturing and assembly phase of printed circuit boards to secure electronic supply chains. Trojans can serve as backdoors of accessing on chip data, can potentially alter functioning and in some cases may even deny intended service of the chip. Apart from consumer electronics, printed circuit boards are used in mission critical applications like military and space equipment. Security compromise or data theft can have severe impact and thus demand research attention. The advantage of the proposed method is that it can be implemented in a manufacturing environment with limited training data. It can also provide better coverage in detection of hardware trojans over traditional methods. Image recognition algorithms need to have deeper penetration inside the training layers for recognizing physical variations of image patches. However, traditional network architectures often face vanishing gradient problem when the network layers are added. This hampers the overall accuracy of the network. To solve this a Residual network with multiple layers is used in this article. The ResNet34 algorithm can identify manufacturing tolerances and can differentiate between a manufacturing defect and a hardware trojan. The ResNet operates on the fundamental principle of learning from the residual of the output of preceding layer. In the degradation issue, it is observed that, a shallower network performs better than deeper network. However, this is with the downside of lower accuracy. Thus, a skip connection is made to provide an alternative path for the gradient to skip forward the training of few layers and add in multiple repeating blocks to achieve higher accuracy and lower training times. Implementation of this method can bolster automated optical inspection setup used to detect manufacturing variances on a printed circuit board. The results show a 98.5% accuracy in optically detecting trojans by this method and can help cut down redundancy of physically testing each board. The research results also provide a new consideration of hardware trojan benchmarking and its effect on optical detection.

An efficient methodology for hardware Trojan detection based on canonical correlation analysis

Side-channel (SC) analyses are extensively used for achieving hardware Trojan detection (TD) by analyzing the anomalies of SC leakages of the suspicious integrated circuits (ICs). However, when a suspicious IC is employed with an SC attack countermeasure (SCAC) to resist against SC attacks, the SC leakages of the IC may become random. Under such a circumstance, the conventional SC analyses are not efficient in detecting the potential embedded Trojans within the suspicious IC since the random SC leakages may mask the critical features of the Trojans. To address this issue, a novel SC analysis based on canonical correlation analysis (CCA) is proposed in this paper. The possible correlations among the random SC leakages are efficiently extracted and processed to distinguish the different features between the SCAC and the embedded Trojans under the assistance of CCA. Result shows that the proposed SC analysis is able to enhance the TD accuracy by 11.3% as compared to the previous SC analyses.

Hardware Trojan detection for lightweight ciphers implemented on field‐programmable gate arrays using the replay algorithm

SummaryHardware Trojans (HTs) are malicious and intentional modification of the hardware design, embedded by an adversary to leak sensitive data, modify functionality, or cause malfunction. Lightweight ciphers are designed for resource‐constrained devices (RCDs) to balance resources and security, but often targeted by HTs. This work aims to create a trusted lightweight cipher design and detect complex sequential HTs using a runtime monitoring method with minimal resource overhead. The novelty of the approach is that it combines full or partial temporal redundancy, resource minimization, and runtime monitoring. The algorithm employs temporal redundancy, by executing a first run of the cipher, and then replays the cipher fully (ReplayN method) or partially (ReplayN/2 method). A mismatch indicates HT activity, and a third replay is executed to determine the correct results. The ReplayN/2 algorithm further optimizes time and energy by limiting replay to the second half of the cipher rounds. The proposed method is compared with other existing methods including triple modular redundancy (TMR), adapted triple modular redundancy (ATMR), and reverse‐function redundancy (RFR). All methods were implemented in field‐programmable gate array (FPGA) technology. Implementation performance metrics were measured and compared, including resource utilization (i.e., logical elements [LEs]), power, energy (E), and speed (i.e., Fmax). The results show that the proposed algorithm outperforms existing methods in most of the metrics. In terms of speed and area, the replay algorithm is faster by 24% and reduces total LEs by 42% when compared with existing methods. Regarding power, replay algorithm reduces power by 45% when compared with TMR and ATMR. With respect to energy, replay methods reduce energy by an average of 6% when compared with TMR and ATMR. The ReplayN/2 reduces energy by an average 15% when compared with TMR and ATMR. Based on the (i.e., energy × area) metric, ReplayN/2 is the top performing method as it balances area and energy metrics. Using metric, the replay methods are the best performing methods as they best balance area, energy, and speed. Also, based on metric, the replay methods are the top performing methods.

A Two-Stage Hardware Trojan Detection Method Considering the Trojan Probability of Neighbor Nets

A Two-Stage Hardware Trojan Detection Method Considering the Trojan Probability of Neighbor Nets

A machine learning method for hardware Trojan detection on real chips

Due to the global supply chain of integrated circuits (IC) from design to application, Hardware Trojan (HT) may be stealthily inserted into ICs. The effect of HT detection methods are related to the signal-to-noise ratio (SNR) and the Trojan-to-circuit ratio (TCR). Various HT detection methods are designed to target at simulated circuits; however, the effect on real chips is not involved. In the light of detection of HT on real chips with low SNR and low TCR, a machine learning method is proposed and experimented in this paper. It is difficult to directly distinguish the insignificant effect of HT on a modern complex chip. The proposed method extracts statistic features to explore the much rich expression of HT signals and adjusts the distance of different features to separate Trojan circuits from the security ones far apart. The proposed methods are tested on real chips with 10−5 TCR and demonstrated the effect compared to other state-of-the-art methods.

An R-SIFT Image Matching Intelligent Algorithm Applied to Hardware Trojan Detection

Malicious modification, deletion or addition of some modules in the integrated circuits (ICs) will cause the chip to be attacked, which is called Hardware Trojans (HTs). Reverse engineering (RE) is a classic destructive method and widely used in HTs detection. However, RE is very time-consuming and error prone. In this paper, based on RE, we propose the R-SIFT algorithm to match image and reformulate the Trojan detection problem as change detection problem. For the R-SIFT algorithm, the ratio of exponentially weighted averages (Roewa) operator is introduced into the scale-invariant feature transform (SIFT) algorithm. Experiments show that the proposed method has 7 to 56 times more matching points than the original SIFT can be effectively applied to HTs detection.

SAT-Based Integrated Hardware Trojan Detection and Localization Approach Through Path-Delay Analysis

With the rapid growth in IC outsourcing in the semiconductors industry, concerns have increased about the weakening ICs security against hardware Trojan attacks. In this brief, an integrated hardware Trojan detection and localization methodology is presented by employing the proposed SAT-based test pattern generation scheme and the MUX-based debugging technique. The experimental results show that our methodology can effectively detect timing anomalies in the path-delays caused by hardware Trojans with node coverage around 97% as well as localizing all Trojan's gates with a localization resolution around 99.6%. Moreover, all timing error sites are successfully identified with zero False Negative and 0.56% False Positive rates.

Design and detection of hardware Trojan based on satisfiability don't cares

Design and detection of hardware Trojan based on satisfiability don't cares

Survey on model checking based hardware Trojan detection technology

Survey on model checking based hardware Trojan detection technology

A new hardware Trojan detection technique using deep convolutional neural network

The involvement of external vendors in semiconductor industries increases the chance of hardware Trojan (HT) insertion in different phases of the integrated circuit (IC) design. Recently, several partial reverse engineering (RE) based HT detection techniques are reported, which attempt to reduce the time and complexity involved in the full RE process by applying machine learning or image processing techniques in IC images. However, these techniques fail to extract the relevant image features, not robust to image variations, complicated, less generalizable, and possess a low detection rate. Therefore, to overcome the above limitations, this paper proposes a new partial RE based HT detection technique that detects Trojans from IC layout images using Deep Convolutional Neural Network (DCNN). The proposed DCNN model consists of stacking several convolutional and pooling layers. It layer-wise extracts and selects the most relevant and robust features automatically from the IC images and eliminates the need to apply the feature extraction algorithm separately. To prevent the over-training of the DCNN model, a new stopping condition method and two new metrics, namely Accuracy difference measure (ADM) and Loss difference measure (LDM), are proposed that halts the training only when the performance of our model genuinely drops. Further, to combat the issue of process variations and fabrication noise generated during the RE process, we include noisy images with varying parameters in the training process of the model. We also apply the data augmentation and regularization techniques in the model to address the issues of underfitting and overfitting. Experimental evaluation shows that the proposed technique provides 99% and 97.4% accuracy on Trust-Hub and synthetic ISCAS dataset, respectively, which is on-an-average 15.83% and 21.69% higher than the existing partial RE based techniques.

Hardware Trojan Detection Based on Ordered Mixed Feature GEP

In the hardware Trojan detection field, destructive reverse engineering and bypass detection are both important methods. This paper proposed an evolutionary algorithm called Ordered Mixed Feature GEP (OMF-GEP), trying to restore the circuit structure only by using the bypass information. This algorithm was developed from the basic GEP through three sets of experiments at different stages. To solve the problem, this paper transformed the GEP by introducing mixed features, ordered genes, and superchromosomes. And the experiment results show that the algorithm is effective.

A trojan framework in AES core to evade state-of-the-art HT detection schemes

This paper explores cipher-destroying and secret key emitting Hardware Trojan (HT) in Advanced Encryption Standard (AES) cores. It reports a malicious trojan circuit which is implanted in the 10th round of encryption modules to make the AES core vulnerable for system design. Stealthiness of the combinational trojan against the dimension of signal lines, involved to trigger the trojan, is examined. It is shown that such trojans are malicious and hard to detect following the existing trojan detection methodologies. The explored malevolent HT can be the cause of severe damage to a system as it leaks out the secret key to an intruder. An existing trojan detection technique is, therefore, modified to propose seamless detection of such trojans.

AdaTrust: Combinational Hardware Trojan Detection Through Adaptive Test Pattern Construction

As society becomes increasingly reliant on products and systems that make use of integrated circuits, the defense against potential hardware Trojan attacks by an untrusted foundry becomes an important part of any certification flow for critical components. The slew of recent proposals notwithstanding, a satisfactory solution is still wanting as the solutions offered heretofore either require impractical design/test pattern cost or deliver insufficient detection capabilities, primarily challenged by the noise induced by process variation. The methodology put forth by this proposal aims to remedy this, leveraging an adaptive approach that applies superposition to perform a fine-grained circuit analysis and expose any extant Trojan circuitry. Iterative test pattern modifications, circuit response analysis, and adaptive decision-making are deployed, all embedded within the design-for-test and test pattern cost paradigms of a common industrial circuit. We demonstrate the efficacy of this technique on standard Trust-Hub benchmark circuits with combinational Trojans inserted in sequential designs, showing significant improvement over prior techniques. We also explore the potential cost–benefit tradeoffs that exist within such a methodology, with the intent to provide an efficient solution for an array of potential product markets. This methodology provides a reliable and effective means for Trojan detection, addressing an important piece of the overall circuit certification puzzle.

Detection of Unusual Thermal Activities in a Semiconductor Chip Using Backside Infrared Thermal Imaging

Abstract Rapid detection of hardware Trojans on a semiconductor chip that may run malicious processes on the chip is a critical and ongoing security need. Several approaches have been investigated in the past for hardware Trojan detection, mostly based on changes in circuit parameters due to Trojan activity. Chip temperature is one such parameter that is closely related to the degree of Trojan activity. This paper carries out backside infrared (IR) imaging of a two-die three-dimensional integrated circuit (3D IC) thermal test chip in order to detect unusual thermal activities on the chip. Four distinct image processing algorithms are evaluated and compared in terms of speed, accuracy, and occurrence of false positives and negatives. The impact of background thermal activity and finite duration of Trojan activity on the accuracy of detection is investigated. Within the parameter space tested in this work, the histogram method is found to be the most effective at Trojan detection in the 3D IC. Modifications in data analysis techniques are proposed that improve Trojan detection performance. This work may help develop thermal imaging as a means for real-time Trojan detection and enhancement of security of modern semiconductor chips, including 3D ICs.

Towards bidirectional LUT-level detection of hardware Trojans

FPGAs are field-programmable and reconfigurable integrated circuits; consequently, they entail numerous security concerns. For example, malicious functions such as hardware Trojans (HTs), can be inserted into the circuits in both development and deployment stages, as malicious fabrication and modification are possible even after deployment. Therefore, to detect HTs in FPGAs effectively, it is necessary to exploit both netlists available at the development stage and bitstreams available at deployment stage; this is in contrast with existing approaches, which require source code or gate-level netlists. In achieving this, we encounter two major challenges: effectively exploiting FPGA netlists closer to bitstreams for HTs detection and reverse-engineering bitstreams to netlists at an acceptable level. To address these problems, we develop a bidirectional mechanism for detecting HTs in FPGAs at any stage. To the best of our knowledge, this is the first study on bidirectional HT detection in FPGAs. To address the first challenge, we focus on LUT-level netlists; regarding the second challenge, we directly reverse-engineer bitstreams to LUT-level netlists. For HTs detection, we employ features extracted from LUT-level netlists, which can also be derived from reversed bitstreams and used to identify HTs. We design and implement our system for experimental studies. The experiments achieve a TPR of more than 99.3% and an FPR of less than 0.15% for 15 TrustHub benchmarks in forward and backward (reverse) directions for FPGA Virtex-5 devices.

Design and Evaluation of a Multi-Domain Trojan Detection Method on Deep Neural Networks

Trojan attacks on deep neural networks (DNNs) exploit a <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">backdoor</i> embedded in a DNN model that can hijack any input with an attacker’s chosen signature trigger. Emerging defence mechanisms are mainly designed and validated on vision domain tasks (e.g., image classification) on 2D Convolutional Neural Network (CNN) model architectures; a defence mechanism that is general across vision, text, and audio domain tasks is demanded. This work designs and evaluates a run-time Trojan detection method exploiting <underline xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">STR</u> ong <underline xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">I</u> ntentional <underline xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">P</u> erturbation of inputs that is a multi-domain input-agnostic Trojan detection defence across <underline xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Vi</u> sion, <underline xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">T</u> ext and <underline xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">A</u> udio domains—thus termed as STRIP-ViTA. Specifically, STRIP-ViTA is demonstratively independent of not only task domain but also model architectures. Most importantly, unlike other detection mechanisms, it requires neither machine learning expertise nor expensive computational resource, which are the reason behind DNN model outsourcing scenario—one main attack surface of Trojan attack. We have extensively evaluated the performance of STRIP-ViTA over: i) CIFAR10 and GTSRB datasets using 2D CNNs for vision tasks; ii) IMDB and consumer complaint datasets using both LSTM and 1D CNNs for text tasks; and iii) speech command dataset using both 1D CNNs and 2D CNNs for audio tasks. Experimental results based on more than 30 tested Trojaned models (including publicly Trojaned model) corroborate that STRIP-ViTA performs well across all nine architectures and five datasets. Overall, STRIP-ViTA can effectively detect trigger inputs with small false acceptance rate (FAR) with an acceptable preset false rejection rate (FRR). In particular, for vision tasks, we can always achieve a 0 percent FRR and FAR given strong attack success rate always preferred by the attacker. By setting FRR to be 3 percent, average FAR of 1.1 and 3.55 percent are achieved for text and audio tasks, respectively. Moreover, we have evaluated STRIP-ViTA against a number of advanced backdoor attacks and compare its effectiveness with other recent state-of-the-arts.