A hardware trojan detection method and system of a graph neural network with attention mechanism

Abstract

The application belongs to the field of computer and electronic technology, and discloses a hardware Trojan detection method and system of a graph neural network fused with an attention mechanism, comprising the following steps: S1. mapping netlist circuit code carrying a hardware Trojan into a directed graph; S2. performing graph embedding, graph segmentation and graph sampling on the directed graph; S3. extracting node inherent features through an encoder; S4. extracting node local features through a graph neural network; S5. extracting node global features through an attention mechanism model; and S6. performing feature fusion on the data inherent features extracted by the autoencoder, the local structure features extracted by the bidirectional GCN convergence model and the global structure features extracted by the self-attention mechanism, and obtaining an HT detection result through a classification model. The application greatly improves the accuracy and efficiency of Trojan detection, expands the detection range or type compared with existing methods, and can be applied to actual hardware Trojan detection of large-scale integrated circuits.

Description

TECHNICAL FIELD

[0001] The application belongs to the field of computer and electronic technology, and particularly relates to a hardware Trojan detection method and system of a graph neural network fusing an attention mechanism. BACKGROUND

[0002] The scale and complexity of modern system-on-chip (SoC) designs make it increasingly challenging and expensive for chip manufacturers to design, manufacture, and test each component internally. Market time pressure and resource constraints have prompted SoC designers to turn to third-party electronic design automation (EDA) tools and IP cores, as well as global outsourcing of design, manufacturing, and testing services. However, relying on untrusted IP and EDA tools significantly increases the risk of malicious entities inserting malicious circuits, i.e., hardware Trojans, in the integrated circuit supply chain. Hardware Trojans can perform various attack purposes, such as leaking information, changing functionality, reducing performance, or denial of service. The consequences of undetected hardware Trojans (HTs) in chips are very deadly, especially in chips for critical infrastructure, military systems, medical devices, etc. Since the attack of hardware Trojans is carefully designed and difficult to trigger under normal working conditions, it is difficult to detect Trojans. Hardware Trojan detection is a difficulty in current research. At a higher abstraction level, the flexibility of IP cores makes it easier for attackers to design and implant hardware Trojans. In addition, the process of implanting HTs in the manufacturing stage is much more complex than in the design stage. Therefore, pre-silicon HT detection is an effective countermeasure to solve the security problem of system-on-chip. Early identification and removal of HTs in the design stage can effectively reduce the cost and risk of removing HTs later.

[0003] A gate-level netlist describes a circuit from the perspective of circuit elements and their connections, can capture subtle changes and abnormalities that may not be detected at the RTL level, and helps to more effectively detect hardware Trojans. RTL circuits can also be synthesized into gate-level netlists, facilitating the use of various detection and verification tools. In addition, detection at the gate-level netlist stage helps to identify security risks introduced in the supply chain and ensure the integrity of the entire system. Therefore, detecting hardware Trojans at the gate level is a hotspot and difficulty in current research.

[0004] At present, there are many researches on gate-level detection of hardware Trojan, among which the application of graph neural network (GNN) to hardware Trojan detection has achieved good classification performance, but the graph neural network model has the problems of over-compression and over-smoothing, which leads to the fact that the Payload diffusion type Trojan cannot be well detected. In addition, these models require more time and resource overhead for large-scale circuits. Most of the HT detection methods can only detect some types of Trojan benchmarks in the existing Trusthub benchmark, and the detection range is limited. In addition, some HT detection methods limit the detection range to the specific part of the HT according to the characteristics of the Trojan composition. At the same time, GNN cannot extract global features, which leads to the fact that the existing detection methods have low accuracy and efficiency.

[0005] In summary, there is still room for improvement in the existing hardware Trojan detection technology, and the existing methods are still insufficient to meet the needs of large-scale circuit hardware Trojan detection. SUMMARY

[0006] In order to solve the problems of over-compression, over-smoothing and inability to expand to large-scale design in the existing GNN-based hardware Trojan detection method and system, the present application provides a graph neural network hardware Trojan detection method and system fusing attention mechanism, which greatly improves the accuracy and efficiency of Trojan detection; and can be applied to actual hardware Trojan detection of large-scale integrated circuits.

[0007] In order to achieve the above-mentioned purpose, the present application provides the following scheme:

[0008] A graph neural network hardware Trojan detection method fusing attention mechanism, the method comprising:

[0009] S1: mapping the netlist circuit code carrying hardware Trojan into a directed graph;

[0010] S2: performing graph embedding, graph segmentation and graph sampling on the directed graph to obtain a training set;

[0011] S3: extracting inherent features of nodes in the training set through an encoder;

[0012] S4: extracting local features of nodes in the training set through a graph neural network;

[0013] S5: extracting global features of nodes in the training set through an attention mechanism model;

[0014] S6: fusing the inherent features, the local features and the global features, and obtaining an HT detection result through a classification model.

[0015] Preferably, in S1, the mapping of the netlist circuit code carrying hardware Trojan into a directed graph comprises:

[0016] The lexical and syntactic information of the gate-level netlist is parsed and analyzed by an open-source hardware design tool kit Pyverilog to generate an abstract syntax tree AST corresponding to the gate-level netlist.

[0017] The circuit gate unit objects in the AST are taken as vertices of a graph, and the connections between the gate units are taken as edges between the vertices of the graph, so that the netlist design is modeled as a corresponding directed graph.

[0018] Preferably, in S2, the graph embedding, graph segmentation and graph sampling of the directed graph include:

[0019] An adjacency matrix is generated according to the directed graph.

[0020] According to the adjacency matrix, the gate unit basic types are encoded using a one-hot vector to obtain an embedding matrix of the gate nodes.

[0021] The directed graph is segmented into subgraphs by using a breadth-first search-based graph blocking algorithm.

[0022] The subgraph set is sampled by using a graph sampling algorithm to form a final training set.

[0023] Preferably, in S3, the inherent features of the nodes in the training set are extracted by an encoder.

[0024] The graph embedding matrix is input into the autoencoder, and the inherent features of the nodes are extracted by mapping the autoencoder to a preset low-dimensional representation.

[0025] The low-dimensional features are restored by the decoder.

[0026] The mean square error loss between the input of the autoencoder and the output of the decoder is used as part of the loss function of the entire model.

[0027] Preferably, in S4, the local features of the nodes in the training set are extracted by a graph neural network.

[0028] The graph data is processed by a forward graph convolutional network GCN layer.

[0029] The output of the forward graph convolutional network GCN layer is processed by a backward graph convolutional network GCN layer.

[0030] The outputs of the same bidirectional graph convolutional network GCN layer are fused and then transmitted to the next bidirectional graph convolutional network GCN layer as input, forming a bidirectional GCN convergence model.

[0031] The local structural features of the graph nodes are extracted by using the bidirectional GCN convergence model.

[0032] Preferably, in S5, the global features of the nodes in the training set are extracted by an attention mechanism model.

[0033] obtain the position encoding of the graph structure through an algorithm for position encoding of a directed graph;

[0034] extract global features of the graph nodes by processing the graph embedding and the position encoding through a self-attention mechanism model;

[0035] obtain the position encoding of the graph structure through an algorithm for position encoding of a directed graph includes:

[0036] obtain the position encoding PE of the directed graph;

[0037] obtain the position encoding PE' of the transpose of the directed graph;

[0038] connect PE and PE' as the final position encoding BPE;

[0039] extract global features of the graph nodes by processing the graph embedding and the position encoding through a self-attention mechanism model includes:

[0040] capture the dependency relationship between distant nodes in the graph through the self-attention mechanism, and introduce the constraint of the graph structure in the self-attention mechanism, and limit the attention weight to be allocated only to the connected neighbor nodes.

[0041] Preferably, in S6, the intrinsic features, local features and global features are fused, and the HT detection result is obtained through a classification model, which includes:

[0042] extract data intrinsic features A through an encoder h , local structure features L extracted by a graph neural network h , and global structure features G extracted by a self-attention mechanism model h fuse the features to obtain the final feature representation of the gate unit;

[0043] input the fused features into a final classification model for classification;

[0044] wherein the fusion is completed through a splicing operation between tensors, and the formula for feature fusion is:

[0045] h G =Concat(G h ,L h ,A h )

[0046] wherein h G is the final feature representation of the graph node after feature fusion;

[0047] the processing process of the classification module is:

[0048]

[0049] in, is the final prediction output.

[0050] The present invention also provides a graph neural network hardware Trojan detection system integrating an attention mechanism, the system being used to implement any one of the methods described above, the system comprising: a mapping module, a preprocessing module, an inherent feature extraction module, a local feature extraction module, a global feature extraction module, and a classification module;

[0051] The mapping module is used to map the netlist circuit code carrying the hardware Trojan into a directed graph;

[0052] The preprocessing module is used to perform graph embedding, graph segmentation and graph sampling on the directed graph to obtain a training set;

[0053] The inherent feature extraction module is used to extract the inherent features of the nodes in the training set through the encoder;

[0054] The local feature extraction module is used to extract local features of nodes in the training set through a graph neural network;

[0055] The global feature extraction module is used to extract the global features of the nodes in the training set through the attention mechanism model;

[0056] The classification module is used to fuse inherent features, local features and global features, and obtain HT detection results through a classification model.

[0057] Compared with the prior art, the present invention has the following beneficial effects:

[0058] The present invention discloses a method and system for hardware Trojan detection using a graph neural network integrated with an attention mechanism, comprising: S1. mapping a netlist circuit code carrying a hardware Trojan into a directed graph; S2. performing graph embedding, graph segmentation, and graph sampling on the directed graph; S3. extracting node intrinsic features using an encoder; S4. extracting node local features using a graph neural network; S5. extracting node global features using an attention mechanism model; and S6. fusing the data intrinsic features extracted by the encoder, the local structural features extracted by a bidirectional GCN aggregation model, and the global structural features extracted by the self-attention mechanism, and obtaining HT detection results through a classification model. The disclosed method and system for hardware Trojan detection using a graph neural network integrated with an attention mechanism can extract node data intrinsic features using an encoder, extract local spatial structural features of graph nodes using a graph neural network, and extract global spatial structural features of graph nodes using an attention mechanism, significantly improving the accuracy and efficiency of Trojan detection. Hardware Trojan detection can be performed without a golden reference model, expanding the detection scope or types compared to existing methods. The method can be applied to hardware Trojan detection in large-scale integrated circuits. BRIEF DESCRIPTION OF DRAWINGS

[0059] In order to more clearly illustrate the technical solutions of the present application, the following briefly introduces the drawings needed in the embodiments. Obviously, the drawings described below only some embodiments of the present application, and for those skilled in the art, other drawings can also be obtained from these drawings without creative labor.

[0060] Figure 1 For the embodiment of the present application, the implementation flowchart of the hardware Trojan detection method of the graph neural network fused with attention mechanism is shown in the figure.

[0061] Figure 2 For the embodiment of the present application, the implementation flowchart of the graph embedding and graph segmentation of the directed graph is shown in the figure.

[0062] Figure 3 For the embodiment of the present application, the specific implementation flowchart of extracting node inherent features through the encoder is shown in the figure.

[0063] Figure 4 For the embodiment of the present application, the specific implementation flowchart of extracting node local features through the graph neural network is shown in the figure.

[0064] Figure 5 For the embodiment of the present application, the specific implementation flowchart of extracting node global features through the self-attention mechanism model is shown in the figure. DETAILED DESCRIPTION

[0065] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only some embodiments of the present application, not all. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present application.

[0066] In order to make the above-mentioned purposes, features and advantages of the present application more obvious and easy to understand, the present application will be further described in detail below with reference to the drawings and specific embodiments.

[0067] Embodiment one

[0068] As shown in the figure, the present application provides a hardware Trojan detection method of graph neural network fused with attention mechanism, mainly including: Figure 1 Mapping the netlist circuit code carrying hardware Trojan into a directed graph;

[0069] Carrying out graph embedding, graph segmentation and graph sampling on the directed graph;

[0070] Extracting node inherent features through the encoder;

[0071] ​

[0072] extracting the local features of the nodes through a graph neural network;

[0073] extracting the global features of the nodes through a self-attention mechanism model;

[0074] performing feature fusion on the data inherent features, the local structural features and the global structural features, and performing classification to obtain a detection result.

[0075] Further specifically, the method comprises the following steps:

[0076] S1: mapping the netlist circuit code carrying the hardware Trojan into a directed graph, and the specific implementation method is to parse and analyze the lexical and syntax information of the gate-level netlist through the open source hardware design toolkit Pyverilog, to generate an abstract syntax tree AST corresponding to the gate-level netlist. Then, the circuit gate unit objects in the AST are taken as the vertices of the graph, and the connections between the gate units are taken as the edges between the vertices of the graph, so that the netlist design can be modeled into a corresponding directed graph.

[0077] S2: performing graph embedding, graph partitioning and graph sampling on the directed graph, as shown in FIG. 2, and the specific implementation steps are as follows: Figure 2

[0078] S201: generating an adjacency matrix according to the directed graph. According to the generated directed graph, an adjacency matrix A with a size of N*N can be obtained, where N is the number of vertices in the directed graph. The adjacency matrix A represents the structural information of the graph.

[0079] S202: mapping the gates with the same logical function to their basic types, which can reduce the coding feature dimension of the nodes and reduce the calculation overhead of the hardware Trojan detection model in the later stage.

[0080] S203: initializing the node feature vector using one-hot encoding, to obtain an embedding matrix of the gate nodes, i.e., a graph embedding matrix, with a size of N*K, where K is the number of basic types of the nodes. Each row in the embedding matrix represents the initial embedding representation of each node in the graph.

[0081] ​S204 adopts a graph partitioning algorithm to divide the directed graph into subgraphs. Specifically, a graph partitioning algorithm based on breadth-first search is adopted to divide the directed graph into subgraphs, that is, all nodes of the entire graph are traversed through layer-by-layer search, and the division mode of the subgraph is determined according to the connection relationship. Graph partitioning can convert a large graph into a small graph, which is easy to be processed by the model. The specific implementation steps are to loop through each unvisited node: each time, an unvisited node is selected from the unvisited nodes as a starting point, and a breadth-first search is performed once; a queue is created and the current starting node is put into the queue, and it is marked as visited at the same time; the nodes in the current subgraph are recorded, initialized as an empty set; a node is taken out from the queue and added to the queue; all neighbor nodes of the node are visited, if the neighbor node is unvisited, it is added to the queue, marked as visited and removed from the unvisited set; when the queue is empty, it indicates that all nodes of the current subgraph have been traversed, and the current subgraph is added to the subgraph set as a complete subgraph; repeat the above process until the unvisited set is empty, indicating that all nodes have been divided into different subgraphs.

[0082] S205 adopts a graph sampling algorithm to sample the subgraph set to form a final training set. The specific implementation method is to extract part of the subgraphs from the subgraph set as the final training set through a non-replacement sampling algorithm, so as to further reduce the cost of training. The specific implementation steps are: if the number of subgraphs corresponding to the benchmark n<=10, all subgraphs corresponding to the benchmark are added to the training set; if n>10, select subgraphs to add to the training set; all subgraphs containing the Trojan are added to the training set.

[0083] S3 extracts node inherent features through an encoder, embeds the graph into an autoencoder, maps to a low-dimensional representation through the encoder, extracts data inherent features of the node, and then restores the low-dimensional features through the decoder. The mean square error loss between the input of the autoencoder and the output of the decoder is part of the loss function of the entire model.

[0084] As shown in Figure 3 , the specific process is as follows:

[0085] S301 maps the graph embedding matrix to a low-dimensional representation to realize the function of encoding. This step is used for node inherent feature extraction and dimension reduction, and at the same time, the output of each layer of the encoder is transmitted to the same layer of the graph neural network as input for multi-dimensional feature fusion, which can to some extent alleviate the problem of over-smoothing of the graph neural network. The number of layers of the encoder is set to be the same as the number of layers of the graph neural network, which is convenient for feature transmission and fusion. At the same time, the encoder can be pre-trained in priority. The process of feature transmission and fusion between the same layer of the encoder and the graph neural network is as follows:

[0086] H′ (l) = H (l)+ aZ (l+1)

[0087] where H (l) is the input of the l-th layer of the graph neural network, Z (l+1) is the output of the l-th layer of the encoder, and a is a settable adjustment factor. H′ (l) is the new input of the l-th layer of the graph neural network after feature transmission and fusion.

[0088] S302 maps the low-dimensional representation back to the input space to realize the function of the decoder, where the decoder and the encoder in the previous step are both composed of three layers of fully connected networks. The number of neurons of the three layers of the encoder is 128, 128, and 20 respectively. The encoding process is shown in the following formula:

[0089] A h = σ(W3σ(W2σ(W1X + b1) + b2) + b3)

[0090] where the input X is a graph embedding matrix, W1, W2, and W3 are weight matrices of the encoder, b1, b2, and b3 are bias vectors, and σ is the activation function Relu. A h is the extracted low-dimensional intermediate representation, i.e., the intrinsic feature of the node.

[0091] The structure of the decoder is a mirror structure of the encoder. The decoding process is as follows:

[0092]

[0093] where the input A h is the intrinsic feature of the node extracted by the encoder, W1 ′ , W2 ′ , and W3 ′ are weight matrices of the decoder, b1 ′ , b2 ′ , and b3 ′ are bias vectors, and σ is the activation function Relu. is the output of the encoder, i.e., the reconstruction output.

[0094] S303 calculates the loss by the mean square error loss function and performs back propagation to update the model parameters, where the mean square error loss function MSE is calculated according to the following formula:

[0095]

[0096] where N is the total number of gate nodes, is the predicted output of the hardware trojan gate classification model through the gate unit feature, and x i is the original input of the gate.

[0097] S4 extracts the local features of the nodes by the graph neural network, such asFigure 4 The specific process is as follows:

[0098] S401 processes the graph data through a forward graph convolutional network (GCN) layer, and the working principle of the GCN is as shown in the following formula:

[0099]

[0100] where W (l) is a trainable weight used in the GCN layer. A is an adjacency matrix of G, used to aggregate the feature vectors of adjacent nodes, I is a unit matrix, is a diagonal matrix used to normalize σ(.) is an activation function, and the present application uses a ReLU activation function.

[0101] S402 processes the output of the forward GCN layer through a reverse GCN layer, with the purpose of forming a bidirectional GCN layer with the forward graph convolutional network (GCN) layer in the previous step.

[0102] S403 fuses the outputs of the same bidirectional GCN layer, and then transmits them into the next bidirectional GCN layer as input, forming a bidirectional GCN convergence model. Specifically, the existing bidirectional GCN model can extract the features of the fan-in and fan-out directions of the nodes in the directed graph, but the GCN layers in each direction are independent, and can only extract the features of the single-direction fan-in or fan-out, and cannot converge the information of the sibling nodes. By constructing the bidirectional GCN convergence model in the present application, that is, the outputs of each layer of the forward GCN and the reverse GCN are spliced, and then transmitted to the next layer of the forward GCN and the reverse GCN as input, the node information convergence area of the target node can be expanded and more comprehensive local structure features of the graph nodes can be extracted.

[0103] The calculation process of the forward GCN is as follows:

[0104]

[0105] where H (l) is the input feature of the lth layer, is the weight matrix of the forward GCN layer, A is the adjacency matrix, and σ is the activation function ReLU. is the output of the lth layer of the forward GCN.

[0106] The calculation process of the reverse GCN is as follows:

[0107]

[0108] where H (l) is the input feature of the lth layer, is the weight matrix of the reverse GCN layer, A Tis the transpose of the adjacency matrix, and is the activation function Relu. is the output of the reverse GCN layer l.

[0109] The process of the bidirectional GCN aggregation is as follows:

[0110]

[0111] where Concat denotes the concatenation operation. (l+1) is the output of the aggregated bidirectional GCN layer l.

[0112] The output H (l+1) is taken as the input of the next layer, and the above process is repeated to form a multi-layer bidirectional GCN aggregation model. The output L h of the third layer of the bidirectional GCN is the local structure feature of the node.

[0113] S5 extracts the global feature of the node through a self-attention mechanism model, as shown in Figure 5 The specific process is as follows:

[0114] S501 obtains the position encoding of the graph structure through an algorithm for obtaining position encoding of a directed graph. The specific implementation method is to use the eigenvector of the Laplacian matrix corresponding to the graph as the position encoding, so as to better capture the global structure information of the graph. However, the Laplacian eigenvector is not applicable to the directed graph. Therefore, the present application proposes an algorithm for obtaining position encoding of a directed graph. First, the position encoding PE of the directed graph is obtained, then the position encoding PE' of the transpose of the directed graph is obtained, and finally PE and PE' are connected as the final position encoding BPE. The specific solving process of the position encoding of the directed graph is as follows:

[0115] 1) First, the degree matrix D is obtained through the adjacency matrix A of the graph. The out-degree matrix D is a diagonal matrix, where the element D[i][i] on the diagonal represents the out-degree of node i (i.e. the sum of the weights of all edges starting from node i). The calculation formula is:

[0116]

[0117] 2) Construct the Laplacian matrix L. The Laplacian matrix of the directed graph is defined as follows:

[0118] L=D-A

[0119] 3) Calculate the eigenvalues and eigenvectors of L. Use the relevant library function in the Numpy library in Python to calculate the eigenvalues and eigenvectors of L. The specific code is represented as: eigenvalues, eigenvectors=np.linalg.eig(L).

[0120] 4) Obtain the position encoding. If the feature vector obtained in the previous step contains complex numbers, only the real part is selected, and the imaginary part is discarded. Then sort the feature values, and select the K smallest non-zero feature vectors as the position encoding information PE of the node.

[0121] After transposing A, A T , and by the above steps consistent with the position vector of the adjacency matrix A, the position encoding information PE' of the reverse graph can be obtained. Concatenate PE and PE' to obtain the final position encoding information, i.e. BPE, which is passed to the next model.

[0122] BPE = Concat(PE, PE')

[0123] S502 extracts the global structure features of the graph nodes by a self-attention mechanism model that can process graph data. Specifically, a self-attention mechanism model is trained to process the graph embedding X and the position encoding BPE obtained in S501. The model is stacked with multiple encoding layers, each of which includes two sub-layers: a self-attention layer and a feedforward neural network layer. The self-attention mechanism model is as follows:

[0124] G h = FC(Attention(X + BPE; W Q , W K , W V )

[0125] where X is the graph embedding matrix, BPE is the position encoding of the directed graph, W Q , W K and W V are the learnable parameters of the attention layer. Attention is the self-attention layer, and FC is the feedforward neural network. G h is the global structure feature of the graph nodes extracted by the self-attention mechanism.

[0126] The self-attention mechanism model makes the positions of any two nodes in the sequence adjacent, and the features can be better transmitted, thereby better extracting global features to solve the problem of over-compression of GNN.

[0127] S6 fuses the data intrinsic features and local structure features and global structure features, and classifies to obtain the detection result. Specifically, the data intrinsic features A h , the local structure features L h extracted by the graph neural network, and the global structure features G h extracted by the self-attention mechanism model are fused to obtain the final feature representation of the gate unit. Here, the fusion is completed by the concatenation operation between tensors. The formula for feature fusion is as follows:

[0128] h G =Concat(G h ,L h ,A h )

[0129] where h G is the final feature representation of the graph node after feature fusion. Finally, the fused features are input into the final classification model for classification. The classification model is implemented by a multi-layer perceptron (MLP). Through the Softmax function, the output of the MLP can be converted into a probability distribution, thereby realizing the classification of the circuit nodes. In the present application, the MLP has 2 layers, the first layer has 60 nodes, and the second layer has 2 nodes. The output of the MLP is an N*2-dimensional matrix, where N is the number of directed graph nodes, and 2 represents the predicted probability of two categories of normal circuit nodes and hardware Trojan circuit nodes. The processing process of the classification model is shown in the following formula:

[0130]

[0131] where h G is the final feature representation of all gate nodes. is the final prediction output, and the class with a higher prediction value is selected as the final predicted class of the node.

[0132] The hardware Trojan detection method and system of the graph neural network fused with attention mechanism disclosed in the present application first map the netlist circuit code carrying the hardware Trojan into a directed graph, then embed the graph, and obtain the graph embedding using onehot encoding; the large graph is divided into small subgraphs using a graph blocking algorithm. The inherent features of the nodes are extracted through the encoder, the local features of the nodes are extracted through the graph neural network, and the global features of the nodes are extracted through the self-attention mechanism model. The inherent features of the data and the local structural features and the global structural features are fused, and classification is performed to obtain the detection result. The present application solves the problem of excessive compression and excessive smoothing when the graph neural network is applied to hardware Trojan detection, so that the Payload diffusion type and other Trojans can also be well detected. The graph neural network cannot extract global features, resulting in low accuracy and efficiency of the existing detection methods. The present application extracts the global features of the nodes through the attention mechanism model, and fuses the inherent features of the data and the local structural features and the global structural features, thereby improving the precision of the hardware Trojan detection. The large graph is divided into small subgraphs through the graph blocking algorithm, thereby reducing the time and resource consumption of the hardware Trojan detection, so that the present system can be expanded to a large-scale design.

[0133] Example Two

[0134] The application also provides a hardware Trojan detection system of a graph neural network with an attention mechanism, which is used to implement the method, and comprises a mapping module, a preprocessing module, an intrinsic feature extraction module, a local feature extraction module, a global feature extraction module and a classification module.

[0135] The mapping module is used to map the netlist circuit code carrying the hardware Trojan into a directed graph.

[0136] The preprocessing module is used to perform graph embedding, graph segmentation and graph sampling on the directed graph to obtain a training set.

[0137] The intrinsic feature extraction module is used to extract intrinsic features of nodes in the training set through an encoder.

[0138] The local feature extraction module is used to extract local features of nodes in the training set through a graph neural network.

[0139] The global feature extraction module is used to extract global features of nodes in the training set through an attention mechanism model.

[0140] The classification module is used to fuse the intrinsic features, the local features and the global features, and obtain an HT detection result through a classification model.

[0141] The above-described embodiments are only used to describe the preferred modes of the application, and do not limit the scope of the application, and various modifications and improvements to the technical solutions of the application made by those skilled in the art without departing from the design spirit of the application shall fall within the protection scope of the claims of the application.

Claims

1. A hardware Trojan detection method based on a graph neural network integrating an attention mechanism, characterized in that: The method comprises: S1: Mapping the netlist circuit code carrying the hardware Trojan into a directed graph; S2: Perform graph embedding, graph segmentation, and graph sampling on the directed graph to obtain a training set; S3: Extract the inherent features of the nodes in the training set through the encoder; S4: Extract local features of nodes in the training set through graph neural network; S5: Extract global features of nodes in the training set through the attention mechanism model; S6: Intrinsic features, local features, and global features are fused and the HT detection results are obtained through the classification model; In S5, extracting the global features of the nodes in the training set through the attention mechanism model includes: S501 proposes an algorithm for finding positional encodings for directed graphs: first, find the positional encoding PE corresponding to the directed graph, then find the positional encoding PE' of the transposed directed graph, and finally concatenate PE and PE' to form the final positional encoding BPE. The specific process for finding the positional encoding of a directed graph is as follows: 1) First, calculate the degree matrix D from the graph adjacency matrix A. The out-degree matrix D is a diagonal matrix, where the diagonal elements D[i][i] represent the out-degree of node i, that is, the sum of the weights of all edges starting from node i. The calculation formula is: 2) Construct the Laplace matrix L. The Laplace matrix of the directed graph is defined as follows: L=DA 3) Calculate the eigenvalues ​​and eigenvectors of L using the relevant library functions in the Numpy library in Python. The specific code is expressed as: eigenvalues, eigenvectors = np.linalg.eig(L); 4) Get the position code. If the eigenvector obtained in the previous step contains complex numbers, then only the real part is selected and the imaginary part is discarded. Then, sort by eigenvalue and select the K smallest non-zero eigenvectors as the node's position code information PE; Transpose A to get A T And through the same steps as the position encoding information PE, the position encoding information PE' of the directed graph transposition is obtained, and PE and PE' are concatenated as the final position encoding information, namely BPE, which is passed to the next step of the model: BPE=Concat(PE,PE') Among them, Concat represents the concatenation operation; S502 extracts global features of graph nodes through a self-attention mechanism model for processing graph data. The specific method is to train a self-attention mechanism model to process the graph embedding matrix X and the position encoding BPE obtained in S501. The model is composed of multiple stacked encoding layers, each of which includes two sublayers: a self-attention layer and a feedforward neural network layer. The self-attention mechanism model is as follows: G h =FC(Attention(X+BPE;W Q ,W K ,W V )) Where X is the graph embedding matrix, BPE is the positional encoding of the directed graph, and W Q 、W K and W V is the learnable parameter of the attention layer, Attention is the self-attention layer, FC is the feedforward neural network, G h It is the global feature of the graph node extracted after the self-attention mechanism.

2. The method according to claim 1, characterized in that In S1, mapping the netlist circuit code carrying the hardware Trojan into a directed graph includes: The open source hardware design toolkit Pyverilog is used to parse and analyze the lexical and grammatical information of the gate-level netlist and generate the abstract syntax tree (AST) corresponding to the gate-level netlist. The circuit gate unit objects in AST are regarded as the vertices of the graph, the connections between gate units are regarded as the edges between the vertices of the graph, and the netlist design is modeled as the corresponding directed graph.

3. The method according to claim 2, characterized in that In S2, performing graph embedding, graph segmentation, and graph sampling on the directed graph includes: Generate an adjacency matrix based on a directed graph; According to the adjacency matrix, the basic type of the gate unit is encoded using a one-hot vector to obtain the embedding matrix of the gate node; A graph partitioning algorithm based on breadth-first search is used to split the directed graph into subgraphs; The graph sampling algorithm is used to sample the subgraph set to form the final training set.

4. The method according to claim 3, characterized in that In S3, the inherent features of the nodes in the training set are extracted by the encoder, including: The graph embedding matrix is ​​input into the autoencoder, which maps it to a preset low-dimensional representation and extracts the inherent features of the node data. Restore low-dimensional features through the decoder; The mean squared error loss between the autoencoder input and the decoder output is used as part of the loss function of the entire model.

5. The method according to claim 3, characterized in that In S4, extracting local features of nodes in the training set through the graph neural network includes: Process graph data through the forward graph convolutional network GCN layer; Process the output of the forward graph convolutional network GCN layer through the reverse graph convolutional network GCN layer; The outputs of the same bidirectional graph convolutional network (GCN) layer are first fused and then passed to the next bidirectional graph convolutional network (GCN) layer as input to form a bidirectional GCN convergence model. The bidirectional GCN aggregation model is used to extract local features of graph nodes.

6. The method according to claim 1, characterized in that In S6, the inherent features, local features and global features are fused and the HT detection results obtained through the classification model include: Extract the inherent features of the data A through the encoder h , local features L extracted by graph neural network h And the global feature G extracted by the self-attention mechanism model h Perform feature fusion to obtain the final feature representation of the gate unit; Input the fused features into the final classification model for classification; Among them, the fusion is completed by splicing operations between tensors, and the formula for feature fusion is: h G =Concat(G h ,L h ,A h ) Among them, h G is the final feature representation of the graph node after feature fusion; The processing process of the classification module is: in, For the final prediction output, MLP stands for multi-layer perceptron.

7. A graph neural network hardware Trojan detection system integrating an attention mechanism, the system being used to implement the method according to any one of claims 1 to 6, characterized in that: The system includes: a mapping module, a preprocessing module, an inherent feature extraction module, a local feature extraction module, a global feature extraction module and a classification module; The mapping module is used to map the netlist circuit code carrying the hardware Trojan into a directed graph; The preprocessing module is used to perform graph embedding, graph segmentation and graph sampling on the directed graph to obtain a training set; The inherent feature extraction module is used to extract the inherent features of the nodes in the training set through the encoder; The local feature extraction module is used to extract local features of nodes in the training set through a graph neural network; The global feature extraction module is used to extract the global features of the nodes in the training set through the attention mechanism model; The classification module is used to fuse inherent features, local features and global features, and obtain HT detection results through a classification model.

Images