Machine learning Trojan horse detection method based on structural feature screening and load expansion

Abstract

The invention belongs to the technical field of hardware security, and discloses a machine learning Trojan horse detection method based on structural feature screening and load expansion, which comprises the following steps: firstly, converting a netlist of a circuit into a quantifiable mathematical model, and performing feature extraction through a mathematical method based on the model; then, in combination with hardware Trojan trigger structure characteristics, screening nodes to obtain a more balanced data set, and carrying out Trojan detection in combination with a machine learning classification method; and finally, according to the structural characteristics of the hardware Trojan load, carrying out backward expansion on Trojan nodes so as to obtain a complete hardware Trojan circuit. According to the method, the structural features of the Trojan horse with low trigger probability and the circuit static features used by machine learning are creatively combined, the data set of machine learning is preliminarily screened, the data set for training is balanced, the efficiency and accuracy of machine learning are effectively improved, a new thought is provided for subsequent related research, and the detection effects of most hardware Trojan horse detection methods are improved.

Description

technical field [0001] The invention belongs to the technical field of hardware security, in particular to a machine learning Trojan horse detection method based on structural feature screening and load expansion. Background technique [0002] At present, a hardware Trojan horse is an extra circuit deliberately inserted into a normal circuit by some attackers during chip manufacturing to secretly leak information, increase circuit power consumption, interfere with or destroy the normal function of the circuit. In addition, the concealment of the Trojan horse circuit is extremely high, and it is only triggered under rare conditions, which makes hardware Trojan horse detection more difficult. Existing Trojan horse detection mostly uses machine learning methods for analysis, and has better performance. But its defects are also obvious: First, compared with normal circuits, the number of Trojan horse nodes is very small, so the problem of data imbalance is particularly serious ...

AI Technical Summary

Problems solved by technology

[0004] (1) Existing Trojan horse detection mostly uses machine learning methods for analysis, but compared with normal circuits, the number of Trojan horse nodes is very small, so the problem of data imbalance during training is particularly serious

[0005] (2) Most of the existing methods are to find the trigger circuit from the rarity analysis of the Trojan horse circuit, but they are helpless for the Trojan horse load circuit with specific functions and structure that is almost the same as the normal circuit

[0006] (3) The defects of existing Trojan horse detection methods all have a greater impact on the accuracy of hardware Trojan horse detection

[0008] (1) The number of Trojan nodes is usually far less than the number of normal nodes, directly using full-node training will lead to serious data imbalance; to solve this problem, the usual method is over-sampling or under-sampling

The former repeatedly samples the positive data, that is, simply repeatedly samples the Trojan horse nodes, but overemphasizes the existing positive cases, which will easily cause the noise or error in the positive cases to be multiplied; the latter discards most of the negative data, that is, deletes Go to a large number of non-trojan nodes, but improper selection of discarded data will make the generated model deviate greatly, and how to select discarded nodes is more difficult

[0009] (2) The Trojan horse circuit can be divided into a trigger circuit and a load circuit. The characteristics of the trigger circuit are relatively clear, and the general Trojan horse detection method can detect the trigger circuit; and the functions of the load circuit are different. Currently, there are information leakage types, increased Power consumption type, destructive function type, etc., the circuit structure is also very different, which is a big challenge for Trojan horse detection

Images