On-chip network hardware Trojan detection platform based on machine learning

Abstract

The present invention discloses a network-on-chip hardware Trojan detection platform based on machine learning, and belongs to the technical field of calculation, inference or counting. By constructing a security detection module including a traffic feature tracking and extraction module, a feature extraction storage module, a change point detection module and a random forest Trojan detection module, a network-on-chip hardware Trojan detection platform based on machine learning is built. The traffic feature tracking and extraction module converts the traffic data in the network-on-chip into a network-on-chip traffic time series model by analyzing the network-on-chip traffic features. The feature extraction result storage module saves the feature data. The change point detection module extracts the change points and abnormal points in the network-on-chip traffic time series model through the Bayesian change point method, which is used to separate normal data and change point data. The random forest detection module accurately identifies abnormal behaviors of the network-on-chip by learning complex and interrelated network-on-chip traffic features.

Description

Technical Field

[0001] The invention discloses a network-on-chip hardware Trojan detection platform based on machine learning, relates to hardware security technology, and belongs to the technical field of calculation, inference or counting. Background Art

[0002] In recent years, with the development of semiconductor technology and the increase in system complexity, more and more cores can be integrated into SoC to meet the growing demand. As traditional bus-based communication becomes more and more difficult, network on chip (NoC) has become a promising solution. In terms of integrated circuits, in order to reduce design costs and time to market, it is a common practice today to obtain IP from third-party suppliers, and the complex supply chain involved in NoC development poses a huge challenge to reliability. These implanted Trojans usually perform many malicious behaviors, such as denial of service (DoS), sensitive data leakage, functional changes or performance impairments. Therefore, there is an urgent need to carry out security research and design of network on chip.

[0003] The on-chip network is a system chip that uses a network structure to connect various IP cores. It is a new on-chip communication method that significantly outperforms the performance of traditional bus-based systems. Traditional FPGA design methods all achieve high bandwidth and high throughput by deeply pipelining the bus. However, for a large design, this method will quickly cause congestion of FPGA online resources and then lead to performance degradation. NoC can convert the content that needs to be transmitted at high speed into a data packet-based form, realize data exchange through the switch logic of the on-chip network, and separate data transmission and data calculation at the system level. However, the attacks that malicious IP may introduce have posed a challenge to the application and development of on-chip networks. Malicious IP can interfere with the normal operation of the on-chip network by modifying or stealing sensitive data in the on-chip network. At present, on-chip network hardware Trojan detection is mainly divided into software-based Trojan detection and hardware-based Trojan detection. Software-based on-chip network Trojan detection technology uses security-aware algorithms and frameworks to resist Trojan attacks without making any modifications to the original circuit. The software-based Trojan detection technology extracts the required traffic feature set by observing the analog circuit or the actual circuit under the condition of applying external stimulation, and detects the Trojan in an offline form, but this method is difficult to detect the hardware Trojan in the actual working situation and is difficult to be applied to the large-scale integrated circuit design. The hardware-based on-chip network Trojan detection technology adds a corresponding security module, and the software-based Trojan detection cannot perform real-time Trojan detection according to the on-chip network status in time, and the protection granularity is coarse. The attacked NoC will destroy the on-chip communication through message passing, resource sharing and changing operations or data flows. Therefore, when the Trojan is activated, the communication traffic of the on-chip network will change, so the Trojan can be detected by monitoring the traffic. The present application aims to dynamically detect hardware Trojans by constructing a security detection module, effectively improve the accuracy of the hardware Trojan detection results, and provide a new idea for the hardware Trojan detection method. Summary of the invention

[0004] The purpose of the present invention is to propose a network-on-chip hardware Trojan detection platform based on machine learning in view of the characteristics of the network-on-chip in the above-mentioned background technology that the network-on-chip may be attacked by malicious hardware Trojans. By implanting the constructed security detection module into the network-on-chip circuit, the ability of the network-on-chip to detect Trojan attacks is effectively improved, thereby achieving the purpose of establishing a network-on-chip hardware Trojan detection platform, and solving the technical problem that the security mechanism provided by the existing network-on-chip security protection technology cannot accurately perform dynamic security detection according to the network-on-chip traffic status.

[0005] The present invention adopts the following technical solutions to achieve the above-mentioned invention objectives:

[0006] The on-chip network hardware Trojan detection platform based on machine learning performs hardware Trojan detection on each routing node of the NoC to be tested through the security detection module, which specifically includes: traffic feature tracking and extraction module, feature extraction result storage module, change point detection module and random forest Trojan detection module. Design S1 is to build the traffic feature tracking and extraction module and feature extraction result storage module, design S2 is to build the change point detection module, and design S3 is to build the random forest Trojan detection module.

[0007] Design S1: The traffic feature tracking and extraction module is used to extract the network traffic feature data of the on-chip network hardware Trojan, and store the network traffic feature data extracted by the traffic feature tracking in the feature extraction result storage module in chronological order. The network traffic feature data obtained after a sampling interval is stored in the feature extraction result storage module as an on-chip network traffic time series. First, the link signal in the on-chip network and the port signal of the routing node are sampled at a rate of 1 sample per 1000 clock cycles to obtain the traffic data of the on-chip network to be tested at a lower computing cost; then, the extracted network traffic feature data is sent to the feature extraction result storage module in chronological order to form an on-chip network traffic time series.

[0008] Design S2: The change point detection module separates normal data and change point data through the Bayesian change point detection method. The change points and anomalies in the on-chip network traffic time series are located. If a change point is detected in the network traffic time series, the Bayesian related parameters of the change point and the anomaly are sent to the random forest detection module as dynamic Trojan feature data. The network traffic features and dynamic Trojan features extracted by the traffic feature tracking and extraction module constitute the dynamic Trojan feature set.

[0009] Design S3: The random forest Trojan detection module is first trained in an offline manner. First, the traffic feature data values ​​of the network on the chip to be tested and the dynamic Trojan feature data values ​​are extracted according to the dynamic Trojan feature set to obtain a data set; then, the constructed data set is used as the input of the random forest model, and the random forest model is trained using a cross-validation method. The data sets of each network on the chip to be tested are screened to obtain the best feature set, and the best feature set is used as the input of the random forest model for training to determine the parameters of the random forest model, and the detection result indicators of different random forest parameters are compared. The parameter model with the highest detection accuracy is selected to construct the random forest Trojan detection module.

[0010] Furthermore, in design S1, the network traffic data of the on-chip network hardware Trojan extracted includes: buffer utilization of each input port of the routing node, link utilization of each input port of the routing node, and local operating temperature. The buffer utilization of each input port of the routing node is defined as the number of virtual channels occupied per cycle when the on-chip network is running; the link utilization of each input port of the routing node is defined as the input migration value per cycle when the on-chip network is running; and the local operating temperature is defined as the operating temperature of the routing when the on-chip network is running.

[0011] Furthermore, in design S3, the on-chip network traffic time series and change points and Bayesian related parameters of the anomaly points obtained during the online detection of the random forest Trojan detection module are normalized, and the processed data set is sent to the classifier as training data for training, and the Trojan detection results are obtained through the random forest algorithm.

[0012] Furthermore, in design S3, the method for selecting the best feature set is as follows: all the constructed data sets of each on-chip network to be tested are used as training data, and the training data are divided into ten parts for testing through ten-fold cross validation. That is, one-tenth of all the data sets of the circuits to be tested are selected as the test set each time, and the remaining data sets are used as the training set for ten dynamic tests. Through the embedded functions provided in the machine learning algorithm, the number of Trojan features when the model has the highest accuracy and the importance ranking of each feature are obtained, and the data sets of each on-chip network to be tested are effectively screened according to the number of Trojan traffic when the accuracy is the highest and the importance ranking of each traffic data, so as to obtain the best feature set.

[0013] Furthermore, in design S3, the specific method for training the parameters of the random forest model is: the best feature set is divided into a training set and a test set by a ten-fold cross-validation method, so as to avoid the unscientific and subjective experimental results caused by the test set not being learned during the classifier training process. The cross-validation method is to divide the data set into ten parts, and take turns to train 9 of them and validate 1 part. The average of the 10 results is used as an estimate of the accuracy of the algorithm, and multiple 10-fold cross-validations are required to calculate the average. Use a machine learning classifier to train the training set and obtain the parameters of the random forest model. Determine the best training model based on the parameters of the random forest model, and the best training model obtained is used for dynamic detection of the test set.

[0014] Furthermore, in design S3, the Trojan traffic data detection results obtained by the random forest model are statistically analyzed. According to the obtained detection results, indicators such as True Positive Rate (TPR) and True Negative Rate (TNR) are calculated to evaluate the proposed detection method.

[0015] Furthermore, in design S3, the trained random forest model is constructed as a random forest Trojan detection module. By constructing a security detection module including a traffic feature tracking and extraction module, a feature extraction and storage module, a change point detection module, and a random forest Trojan detection module, a machine learning-based on-chip network hardware Trojan detection platform is built.

[0016] Furthermore, in design S3, in Trojan detection, the average value of TPR increases to 97.1%. The calculation method of TPR and TNR indicators is as follows:

[0017] TNR=TN / (TN+FP), TPR=TP / (TP+FN)

[0018] The present invention adopts the above technical solution to realize on-chip network security protection, which has the following beneficial effects:

[0019] (1) This application firstly proposes and uses the security detection modules of the traffic feature tracking and extraction module, the feature extraction and storage module, the change point detection module and the random forest detection Trojan module, providing a new direction for hardware Trojan detection. In dynamic detection, the change point detection module locates the change point appearing at any time point in the data flow of the on-chip network through the Bayesian change point detection method and uses its parameters as new Trojan features. The random forest detection Trojan module performs machine learning detection on the circuit to be tested through dynamic detection to further improve the accuracy of dynamic detection, and finally determines the identification result of the Trojan circuit. Experiments have verified the effectiveness of the newly proposed dynamic Trojan features for Trojan detection, and the change point detection module has effectively improved the average true positive rate (TPR) of dynamic detection. The on-chip network hardware Trojan detection platform based on machine learning proposed in this application overcomes the defect that static detection is difficult to detect hardware Trojans of the on-chip network in real time, and can comprehensively and efficiently detect hardware Trojans.

[0020] (2) By testing the test set, the experimental results show that the Trojan detection platform can improve the accuracy of hardware Trojans in the on-chip network in most cases compared with other existing detection platforms that only use machine learning. The detection method can achieve an average true positive rate (TPR) of 97.1% and an average true negative rate (TNR) of 93.9%. It can be seen that the on-chip network hardware Trojan detection platform based on machine learning proposed in this application effectively improves the detection accuracy. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Figure 1 The overall block diagram of the on-chip network hardware Trojan detection platform based on machine learning.

[0022] Figure 2 Flowchart of on-chip network hardware Trojan detection based on machine learning. DETAILED DESCRIPTION

[0023] The technical solution of the invention is described in detail below with reference to the accompanying drawings.

[0024] Please refer to Figure 1 The present invention provides a network-on-chip hardware Trojan detection platform based on machine learning. Router nodes are arranged in a two-dimensional grid manner, and the network-on-chip system structure is composed of a processing unit, a network interface, and a router. First, the Trojan detection platform based on the security network-on-chip divides the establishment of security routing into the following two parts: a routing module that works normally and a security detection module. The network-on-chip can use a variety of topological structures. The two-dimensional grid topological structure used in the reference figure is used. Each router includes three modules that work normally, namely, an input / output port, a routing controller, and a cross switch. On the one hand, the input / output port is responsible for data storage, and the cross switch is responsible for data transmission. The input / output port stores the data packet entering the port into the corresponding virtual channel implemented by the buffer, and the cross switch module transmits the data packet from the input port to the output port. On the other hand, the router controller manages the workflow of the input / output port and the cross switch. When the header slice of the data packet arrives at the buffer, the routing control module generates the request information of the next hop according to the destination of the data packet and the routing algorithm. Then, all requests bid for exchange, and the virtual channel distributor decides how to allocate the virtual channels of the downstream router to these requests. At the same time, the switch distributor working in parallel with the virtual channel distributor selects the correct data packets from the virtual channel and sends them to the cross switch. The security detection module includes: traffic feature tracking and extraction module, feature extraction result storage module, change point detection module, and random forest detection module. First, the routing traffic features in the on-chip network are extracted. Then, the traffic features are constructed as an on-chip network time series model in the form of time series. The on-chip network time series model is dynamically detected through the change point detection module to separate the normal changing traffic and the abnormal changing traffic caused by the Trojan attack. Finally, the extracted traffic to be tested is detected by constructing the random forest hardware module to obtain the final Trojan traffic data.

[0025] Reference Figure 2 , the training process of generating a random forest model includes steps S1 to S5.

[0026] Step S1: Analyze the dynamic traffic characteristics of the hardware Trojan in the on-chip network, form new dynamic Trojan characteristics with the relevant parameters generated by the Bayesian change point detection method, and form a dynamic Trojan feature set in combination with the dynamic traffic characteristics.

[0027] Hardware Trojans of the on-chip network, such as denial of service (DoS) and performance damage, show similar performance in traffic, mainly to interfere with the normal operation of the on-chip network. In response to these Trojans, the present invention proposes to detect traffic data through Bayesian online change points, and observe the state of the on-chip network time series using certain statistical indicators or statistical methods, so as to accurately and effectively estimate the location of the change point. By observing the communication behavior, the activated abnormal data points can be analyzed.

[0028] The dynamic traffic features of hardware Trojans in the on-chip network include: buffer utilization of each input port of the routing node, link utilization of each input port of the routing node, and local operating temperature. The buffer utilization of each input port of the routing node is defined as the number of virtual channels occupied per cycle when the on-chip network is running; the link utilization of each input port of the routing node is defined as the input migration value per cycle when the on-chip network is running; the local operating temperature is defined as the operating temperature of the routing when the on-chip network is running. The dynamic Trojan feature set is composed of new dynamic Trojan features extracted by combining dynamic traffic features and Bayesian online change point detection.

[0029] Step S2: Using the traffic tracking and extraction module, the feature extraction result is stored to extract the dynamic traffic features from the routing to the network traffic on the chip to be tested at a predetermined granularity.

[0030] First, data is extracted from the NoC at a predetermined granularity. The NoC data flow count does not change significantly within 1000 clock cycles. Therefore, the data flow is sampled at a rate of 1 sample per 1000 clock cycles to reduce the computational cost. Then, the buffer utilization of each input port, the link utilization of each input port, and the local operating temperature are put into corresponding lists respectively. This helps step S3.

[0031] Step S3: extracting the traffic feature data values ​​and the dynamic Trojan feature data values ​​in the on-chip network according to the dynamic Trojan feature set to obtain a data set.

[0032] The change point detection module uses certain statistical indicators or statistical methods to observe the state of the on-chip network traffic time series extracted from the Bayesian online change point detection S2, so as to accurately and effectively estimate the probability density function of the traffic data point, and determine the change point according to the probability density function value. The change points and abnormal point Bayesian related parameters of the on-chip network traffic time series model stored in the feature extraction storage module and the on-chip network traffic time series model detected in the change point detection module are extracted, and then constructed into a data set.

[0033] We assume a NoC data flow D, where data x1, x2, ... nAll samples are taken at the same time interval and can be divided into non-overlapping partitions p. The division between partitions is called a change point. The data points in the partitions are related to the probability distribution P(x t |n p ) are independent and identically distributed. Parameter n p (p=1,2,...,n) should also be independent and identically distributed. If the incoming data point x at time t t Represents two time periods d i and d j If there are change points between them, they have different probability distributions.

[0034] The Bayesian online change point detection algorithm has a run length (r t ) is modeled, where r t Indicates the length of the current running time t. Representation and running time r t The set of related data points. Since r can be 0, all x (r) The set can be empty. t = 0 is above a predefined threshold, then the data point at time t represents a change point. However, accurate estimation of r t = 0 may not be feasible, so we can estimate the probability for a predetermined number of data points n after time t. If the probability exceeds a predefined threshold, we can conclude that the point at time t represents a change point.

[0035] The Bayesian online change point detection operation is as follows. The continuous data points between time a and time b (inclusive) are represented as x a:b When the data point x t Arrival, the data point x that has been reached up to time t 1:t , evaluate the marginal predictive distribution P(x t+1 |x 1:t ), determine whether the data point is a change point based on the marginal prediction distribution value, and in the marginal prediction distribution P(x t+1 |x 1:t ) exceeds the predefined threshold, the network traffic characteristic data collected at time a is the change point, and the marginal prediction distribution probability density function value P(x t+1 |x 1:t ) are the change points and outlier Bayesian correlation parameters of the on-chip network traffic time series model.

[0036] For the current run length r t The posterior distribution of is integrated to find the marginal predictive distribution, expressed as:

[0037]

[0038] Using Bayes' theorem for x t The posterior probability P(r t |x 1:t ) for evaluation:

[0039]

[0040] Calculate P(x 1:t )as follows:

[0041]

[0042] The joint probability P(r t |x 1:t ) is expressed using the following equation:

[0043]

[0044] Therefore, the joint distribution based on the current run length and the data is P(r t |r t-1 )and Two calculations, respectively: 1) Given r t-1 The current run length r of the run length t 2) The data point x arriving at time t t The predicted distribution on .

[0045] Step S4: In order to select appropriate on-chip network routing port data, the data set obtained in step S3 is normalized, and the processed data is sent to the classifier as training data for model training, and the best feature set is obtained through the machine learning algorithm. According to the best feature, appropriate data in the data set is selected and the data set is processed.

[0046] The best feature set selection method is to use all the data sets of the circuits to be tested as training data, and divide the training data into ten parts through ten-fold cross validation and put them into the classifier for testing. Through the built-in functions provided in the machine learning algorithm, the importance ranking of each Trojan feature to the model and the number of features n at the best accuracy are obtained. Based on these two indicators, the feature elements ranked top n in importance are selected to form the best feature set.

[0047] Step S5: In order to improve the detection accuracy of the random forest model for Trojans, a cross-validation method is used to divide multiple circuits to be tested into a training set and a test set. The trained classifier is used to train the data in the training set, and the best training model is obtained to dynamically detect the test set.

[0048] Use a machine learning classifier to train the training set divided by cross validation, starting from the root node, recursively perform the following operations on each node, and recursively construct a binary decision tree. The features are: buffer utilization of each input port, link utilization of each input port, local operating temperature, and the parameters of the on-chip network traffic time series model constructed using the Bayesian online change point detection method. Let the node training data set be D, and calculate the Gini coefficient of the data set under the existing features. At this time, for each feature A, for each possible partition value a, the training data set is divided into two parts, D1 and D2, according to whether it is greater than a or less than a. The Gini coefficient formula is as follows:

[0049]

[0050]

[0051] Through random sampling, the correlation between decision trees is reduced, making them more accurate and generalized. By evaluating the training model, the training parameters are adjusted to obtain the optimal training model. Finally, the test data set is sent to the optimal training model, and the circuit is dynamically tested.

[0052] Step S6: Combine the detection results of the above detection methods to obtain the final Trojan circuit set. According to the obtained detection results, calculate True Positive Rate (TPR), True Negative Rate (TNR) and other indicators to evaluate the proposed detection method.

[0053] Step S7: The trained random forest model is constructed as a random forest Trojan detection module. By constructing a security detection module including a traffic feature tracking and extraction module, a feature extraction and storage module, a change point detection module, and a random forest Trojan detection module, an on-chip network hardware Trojan online detection platform based on machine learning is realized.

Claims

1. A method for detecting hardware Trojans in network-on-chip based on machine learning, characterized in that: Extract network traffic feature data of on-chip network hardware Trojans; Generate an on-chip network traffic time series according to the collection time sequence of the network traffic feature data; Locate the change points and anomaly points in the on-chip network traffic time series, and when the change points and anomaly points are detected, use the Bayesian correlation parameters of the change points and anomaly points as dynamic Trojan feature data; Based on the Trojan feature set composed of network traffic characteristics and dynamic Trojan features, the network traffic feature data values ​​of each on-chip network to be tested and the dynamic Trojan feature data values ​​are collected to construct a data set. The classifier is trained with the data set as the input of the classifier to obtain the best feature set. The classifier is trained with the best feature set to obtain the optimal classifier. The optimal classifier is used to perform online detection on the Trojan feature data of the on-chip network to be tested.

2. A network-on-chip hardware Trojan detection platform based on machine learning, used to implement the method of claim 1, characterized in that: The on-chip network hardware Trojan detection platform includes: A traffic feature tracking and extraction module is used to extract network traffic feature data of the on-chip network hardware Trojan and output the extracted network traffic feature data to a feature extraction result storage module; A feature extraction result storage module stores network traffic feature data as an on-chip network traffic time series in the order of receiving time; a change point detection module, which reads the on-chip network traffic time series stored in the feature extraction result storage module, locates the change points and abnormal points in the on-chip network traffic time series, and when the change points and abnormal points are detected, sends the Bayesian probability density function values ​​of the data points at the locations of the change points and abnormal points as dynamic Trojan feature data to the random forest Trojan detection module; and, The random forest Trojan detection module collects the network traffic characteristic data values ​​of each on-chip network to be tested and the dynamic Trojan characteristic data values ​​output by the change point detection module after detecting the time series of each on-chip network traffic. The collected network traffic characteristic data values ​​of each on-chip network to be tested and the dynamic Trojan characteristic data values ​​are used as data sets to train a random forest model to obtain the best feature set. The best feature set is used to train the random forest model to obtain the best random forest model. The best random forest model is used to perform online detection on the Trojan characteristic data of the on-chip network to be tested.

3. The on-chip network hardware Trojan detection platform based on machine learning according to claim 2 is characterized in that: The network traffic feature data of the on-chip network hardware Trojan extracted by the traffic feature tracking and extraction module include: a buffer utilization value of each input port of a routing node, a link utilization value of each input port of a routing node, and a local operating temperature value.

4. The on-chip network hardware Trojan detection platform based on machine learning according to claim 2, characterized in that: The traffic feature tracking and extraction module extracts network traffic feature data of the on-chip network hardware Trojan according to a predetermined protection granularity.

5. The on-chip network hardware Trojan detection platform based on machine learning according to claim 2 is characterized in that: The specific process of locating the change points and abnormal points in the on-chip network traffic time series is as follows: t Has a run length r t Model the probability of estimating the time t After a predetermined number of data points n The probability, time t After a predetermined number of data points n When the probability of t The collected network traffic data are change points or abnormal points.

6. The on-chip network hardware Trojan detection platform based on machine learning according to claim 2, characterized in that: The specific process of obtaining the best feature set is as follows: the data set is divided into a training set and a test set by cross-validation, and then dynamic detection is performed, and the accuracy of each detection is counted. The data set is screened to obtain the best feature set based on the number of Trojan feature data when the random forest model has the highest accuracy and the importance ranking of each Trojan feature data.

7. The on-chip network hardware Trojan detection platform based on machine learning according to claim 2, characterized in that: The specific process of training the random forest model using the best feature set is: using a cross-validation method to divide the best feature set into a training set and a test set, then training the parameters of the random forest model, and determining the best random forest model based on the parameters.

Images