A fine-grained malicious logic detection method and system based on power consumption feature classification

Abstract

The present invention provides a fine-grained malicious logic detection method and system based on power consumption feature classification. The method collects the power consumption curve of the chip under test and the normal power consumption curves of multiple groups of normal chips; performs denoising on the power consumption curves under test and normal power consumption curves; reorganizes and segments the power consumption curves under test and normal power consumption curves to form a feature matrix, and inputs the matrix into a trained neural network for classification. When the similarity of the classification results of the chip under test is less than a set threshold, it is a normal chip; when the similarity is greater than the set threshold, it is a malicious logic chip. The method can avoid the influence of adverse factors such as noise, time alignment, and inactivation, and has the characteristics of comprehensive feature evaluation, high recognition result credibility, and fine-grained detection. The detection process and calculation difficulty are more complex and efficient, and the results are more reliable and accurate.

Description

Technical Field

[0001] The present invention relates to the technical field of chip security and trustworthiness detection, and in particular to a fine-grained malicious logic detection method and system based on power consumption feature classification. Background Art

[0002] Information security incidents have occurred frequently in recent years, and integrated circuit (IC) security is receiving widespread attention. Ensuring chip autonomy, controllability, and trustworthiness has become a pressing need for all types of information systems. Uncontrollable links in the IC lifecycle make it easy for malicious third parties to insert malicious logic (also known as hardware Trojans), posing a significant security threat. Hardware-based malicious logic is a new attack vector that has emerged in recent years against integrated circuits. This attack involves attackers exploiting redundant circuit states or redundant areas within the circuit layout throughout the IC design and manufacturing process to purposefully tamper with the target circuit. Like a hidden bomb within the chip, it cannot be eliminated like a software virus, posing a significant challenge to IC security. Detecting malicious logic in hardware has consistently garnered widespread attention, particularly as methods based on side-channel analysis mature and possess significant application value. In the field of side channels, these channels can be categorized into energy, electromagnetic, and time channels, based on their physical characteristics. Hardware-based malicious logic detection methods based on power consumption information are highly efficient and non-invasive, requiring no disruption to the chip itself. They can be widely tested, offer high security, and contribute to the development of mature industry testing standards. However, power consumption-based side-channel analysis, a detection method that has garnered the most attention in academia, has a sensitivity that is strongly correlated with noise impact and feature recognition models. On the one hand, malicious hardware logic, as a tiny piece of malicious logic hidden within a chip, can easily be overwhelmed by noise (such as measurement noise, process noise, and noise caused by voltage and temperature variations). While large sample sizes can be used to remove measurement noise, many high-frequency noises still lack a mature solution. On the other hand, most existing mainstream detection models are based on spatial transformation or data dimensionality reduction, such as PCA, nonlinear analysis, and Mahalanobis distance, which inevitably lose feature information during the transformation process. While efforts to establish mature industry detection standards for malicious hardware logic have long been underway, both mean difference-based hardware Trojan detection methods and linear / nonlinear detection methods fail to perform high-frequency noise removal on the power consumption data being tested, limiting the effectiveness and accuracy of detection results. Existing neural network-based hardware Trojan detection methods focus on identifying specific types or individual samples, lacking noise processing for training set samples and failing to perform fine-grained analysis of the hardware Trojan type within the circuit being tested. At present, there is no detection model and system for hardware Trojan detection based on power consumption information that can perform fine-grained and accurate identification of hardware Trojans under optimized noise conditions, which poses a hidden danger to the current chip security and independent control.

[0003] Currently, trusted detection models for malicious logic in uncontrollable cryptographic chips are mostly targeted at specific, personalized samples and lack universal detection capabilities. Basic methods based on mean difference have low reliability due to the influence of PVT (process, voltage, and temperature) noise and measurement noise. Existing linear or nonlinear detection methods suffer from feature information loss during data conversion and cannot accurately identify the type of detection. Existing neural network hardware Trojan detection models overly focus on power consumption characteristics within a single interval in feature recognition, unable to avoid the impact of noise. They also lack accurate feature recognition and fine-grained classification of hardware Trojans, limiting the effectiveness and accuracy of detection results. Overall, a reliable evaluation model and auxiliary detection platform for intelligent and refined detection of the underlying malicious logic in cryptographic chips has yet to be established, posing a significant challenge to the trusted security of cryptographic chips. Summary of the Invention

[0004] The present invention proposes a fine-grained malicious logic detection method and system based on power consumption feature classification to solve the technical problem of low credibility and accuracy of existing detection methods.

[0005] To solve the above technical problems, the present invention provides a fine-grained malicious logic detection method based on power consumption feature classification, comprising the following steps:

[0006] Step S1: collecting a power consumption curve of the chip under test and a plurality of normal power consumption curves of normal chips;

[0007] Step S2: De-noising the power consumption curve to be measured and the normal power consumption curve;

[0008] Step S3: The power consumption curve to be tested and the normal power consumption curve are reorganized and segmented to form a feature matrix, and input into the trained neural network for classification. When the similarity of the classification results of the chip to be tested is less than the set threshold, it is a normal chip. When the similarity is greater than the set threshold, it is a malicious logic chip.

[0009] Preferably, the denoising method in step S2 includes: large sample random noise optimization and wavelet transform high frequency noise optimization.

[0010] Preferably, the large sample random noise optimization method comprises the following steps: applying the same test vector to repeatedly collect N times, and eliminating it using a large sample mean method.

[0011] Preferably, the wavelet transform high-frequency noise optimization method comprises the following steps: converting the signal from the time domain to the time-frequency domain, extracting the details of the signal by translating and scaling the wavelet basis to remove the noise, and the expression of the wavelet transform is:

[0012]

[0013] Where r(t) represents the input, a and τ represent the scaling and translation factors respectively. represents the wavelet basis function.

[0014] Preferably, the method for collecting power consumption data in step S1 includes the following steps:

[0015] Step S11: Constructing the power consumption model P of the integrated circuit tot :

[0016] P tot =P dyn +P short +P leak ;

[0017] Where, P dyn Indicates dynamic power consumption, P short Represents static power consumption, P leak Indicates short-circuit current power consumption;

[0018] Step S12: measuring the power consumption data of N chips, inputting the same stimulus K and executing s times at different temperatures and voltages;

[0019] Step S13: Process the power consumption data using the following formula to obtain the actual current

[0020]

[0021]

[0022] Where, Indicates the real current of the circuit when there is no noise, which is related to the chip C and the excitation K. It represents the power consumption change caused by PVT noise and measurement noise during the actual operation of the circuit, s represents the number of measurements, C i represents the i-th chip, Indicates the power consumption change caused by malicious logic.

[0023] Preferably, the method of performing classification by the neural network in step S3 comprises the following steps:

[0024] Step S31: network initialization, input feature matrix;

[0025] Step S32: Based on the input feature matrix, the connection weights w between the input layer and the hidden layer ij And the hidden layer threshold a, calculate the hidden layer output H;

[0026] Step S33: According to the hidden layer output H, the connection weight w jkand threshold b, calculate the BP neural network prediction output O;

[0027] Step S34: Calculate the network prediction error e based on the network prediction output O and the expected output Y;

[0028] Step S35: Update the network connection weight w according to the network prediction error e ij and w jk ;

[0029] Step S36: Update the network node thresholds a and b according to the network prediction error e;

[0030] Step S37: Determine whether the algorithm iteration is completed. If not, return to step S32 and execute again. Otherwise, output the classification result.

[0031] Preferably, the method further comprises a denoising effect evaluation step: calculating the signal-to-noise ratio (SNR) after denoising:

[0032]

[0033] Where power signal Indicates the original signal energy, power noise represents the noise signal energy, n represents the signal sequence length, f(i) is the original signal, represents the denoised signal.

[0034] Preferably, when the signal-to-noise ratio SNR is less than a set threshold, step S2 is repeated until the set threshold is met.

[0035] The present invention also provides a fine-grained malicious logic detection system based on power consumption feature classification, the system comprising a power consumption curve extraction module, a denoising module and a feature classification judgment module;

[0036] The power consumption curve extraction module is used to collect the power consumption curve of the chip under test and the normal power consumption curves of multiple groups of normal chips;

[0037] The denoising module is used to denoise the power consumption curve to be measured and the normal power consumption curve;

[0038] The feature classification judgment module is used to reorganize and segment the power consumption curve to be tested and the normal power consumption curve to form a feature matrix, and input the trained neural network for classification to determine whether it is a malicious logic chip.

[0039] Preferably, the system further comprises a denoising evaluation module for calculating the signal-to-noise ratio of denoising, and when the signal-to-noise ratio is lower than a set threshold, the denoising module is adjusted to perform denoising again.

[0040] The beneficial effects of the present invention include at least: a fine-grained malicious logic detection method based on power consumption feature classification is established on the basis of side channel noise preprocessing. Through sample training of multiple types of hardware Trojan data sets, different interval segments of the power consumption curve after noise optimization are selected for neural network feature classification and identification. It can avoid the influence of adverse factors such as noise, time alignment and inactivation. It has the characteristics of comprehensive evaluation features, high credibility of recognition results, and the ability to achieve fine-grained detection. The detection process and calculation difficulty are more complex and efficient, and the results are more credible and accurate. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] Figure 1 Schematic diagram of a method flow in an embodiment of the present invention;

[0042] Figure 2 A schematic diagram of neural network feature extraction according to an embodiment of the present invention;

[0043] Figure 3 This is a schematic diagram of the classification results of normal power consumption data according to an embodiment of the present invention;

[0044] Figure 4 Schematic diagram of classification results of power consumption data of a circuit under test according to an embodiment of the present invention. DETAILED DESCRIPTION

[0045] The following is a clear and complete description of the technical solutions in the embodiments of the present invention, in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts are within the scope of protection of the present invention.

[0046] like Figure 1 As shown, the embodiment of the present invention provides the following steps:

[0047] Step S1: collecting a power consumption curve of the chip under test and a plurality of normal power consumption curves of normal chips.

[0048] Specifically, during data collection in the embodiments of the present invention, after the chip is implanted with malicious logic circuits, the original structure and scale of the circuit will inevitably be changed to a certain extent. This causes the chip implanted with the Trojan malicious logic circuit to exhibit different power consumption, delay and other bypass characteristics than the original chip. Generally, the power consumption of an integrated circuit is divided into three parts as shown in the following formula: dynamic power, static power and short-circuit current power. Its power consumption model is expressed as:

[0049] P tot =P dyn +Pshort +P leak ;

[0050] Where, P dyn Indicates dynamic power consumption, P short Represents static power consumption, P leak Indicates short-circuit current power consumption.

[0051] In the process of malicious logic detection based on power consumption information, the global current IDD of the circuit is used as the analysis target. By changing the process parameters or using different chips, N pieces of genuine chips C are obtained. i , i∈N, input the same stimulus K at different temperatures T and voltages V, perform s calculations and measure (M) power consumption data, Genuine chip C i During normal operation, the current mainly consists of two parts:

[0052]

[0053] in It is the real current of the circuit when there is no noise. Its magnitude is mainly related to the chip C and the excitation K. It is the power consumption change caused by PVT noise and measurement noise during the actual operation of the circuit.

[0054] For chips implanted with malicious logic circuits, the impact of the Trojan circuit on the total power consumption of the circuit can be treated as noise, and the contribution to the global current IDD can be expressed as To express:

[0055]

[0056] In the embodiment of the present invention, the measurement noise and PVT noise contained in the power consumption data are measured, and the power consumption analysis model under the influence of the PVTM noise can provide a basis for subsequent detection.

[0057] Step S2: De-noising the power consumption curve to be measured and the normal power consumption curve.

[0058] In the embodiment of the present invention, the denoising method includes large sample random noise optimization and wavelet transform high frequency noise optimization.

[0059] Specifically, large sample random noise optimization: measurement noise and VT noise obey the N(u,σ2) normal distribution. These random noises can be repeatedly collected N times by applying the same test vector and using the large sample mean method to eliminate their influence. At this time, the power consumption of the circuit eliminates random noise and subtracts the actual IC power consumption. After that, the power consumption trajectory of the Genuine chip Only includes power consumption changes caused by the process; power consumption trace of the Trojan chip circuit It is composed of process variations and the power consumption of the malicious logic circuit itself, thus completing the noise removal.

[0060] Wavelet transform optimizes high-frequency noise: Circuits continuously charge and discharge capacitors during operation, and the sampled power consumption waveform contains many spikes and sudden changes. Traditional frequency-based denoising methods cannot effectively filter out Gaussian white noise. In engineering practice, the signals processed are often non-stationary, so wavelet analysis, a "mathematical microscope," is used to remove noise from power consumption data. Wavelet decomposition converts signals from the time domain to the time-frequency domain. By shifting and scaling the wavelet basis, any detail of the signal can be approximated.

[0061] Take the noisy signal r(k) as an example to illustrate the working principle of wavelet denoising:

[0062] r(k)=f(k)+e(k)k=0,1,…,n-1;

[0063] In the above formula, r(k) is the noisy signal, f(k) is the useful information, and e(k) is the noise signal. e(k) is usually distributed in the high-frequency part, while f(k) is usually distributed in the low-frequency part.

[0064] Let the signal be r(t), and the continuous wavelet transform of the signal r(t) be WT r (a,τ):

[0065]

[0066] Where r(t) represents the input, a and τ represent the scaling and translation factors respectively. It represents the wavelet basis function, which transforms the one-dimensional time domain signal into a two-dimensional phase plane through a and τ, and can simultaneously show the time-frequency properties of the signal, thereby removing the high-frequency part and completing denoising.

[0067] Step S3: The power consumption curve to be tested and the normal power consumption curve are reorganized and segmented to form a feature matrix, and input into the trained neural network for classification. When the similarity of the classification results of the chip to be tested is less than the set threshold, it is a normal chip. When the similarity is greater than the set threshold, it is a malicious logic chip.

[0068] Existing power consumption curve collection and feature extraction mainly rely on the time period with the most obvious power consumption in theoretical calculations to construct the feature matrix. In actual operation, it is often affected by factors such as waveform alignment. Single-segment data can easily lead to large errors, and the errors caused by waveform misalignment cannot be handled through large sample optimization methods.

[0069] The embodiment of the present invention performs initialization operation on the power consumption data based on the power consumption waveform characteristics, selects different interval segments of the power consumption curve after noise optimization for data segmentation and feature matrix construction, and extracts N segments Tra from the same power consumption curve segmentation based on the completion of PVTM noise optimization of the power consumption curve. i , i∈N, forming the analysis sample curve Tra=[Tra1,Tra2,Tra3…,Tra i ] is used to analyze the feature matrix of the network. This method can effectively avoid the influence of adverse factors such as noise, time alignment and inactivation.

[0070] After the normal power consumption curve and the power consumption curve to be tested are segmented as described above, they are input into the BP neural network for fine-grained classification and recognition, which includes the following steps:

[0071] Step 1: Network initialization. According to the system input and output sequence (X, Y), determine the number of network input layer nodes n, the number of hidden layer nodes l, and the number of output layer nodes m, and initialize the connection weights w between the input layer, hidden layer, and output layer neurons. ij 、w jk , initialize the hidden layer threshold a, the output layer threshold b, and give the learning rate and neuron activation function;

[0072] Step 2: Hidden layer output calculation. According to the input vector X, the connection weight w between the input layer and the hidden layer ij And the hidden layer threshold a, calculate the hidden layer output H;

[0073]

[0074] Step 3: Output layer output calculation. According to the hidden layer output H, the connection weight w jk and threshold b, calculate the BP neural network prediction output O;

[0075]

[0076] Step 4: Error calculation. Calculate the network prediction error e based on the network prediction output O and the expected output Y.

[0077] e k =Y k -O k k=1,2,…,m;

[0078] Step 5: Weight update. Update the network connection weight w according to the network prediction error e ij , w jk ;

[0079]

[0080] wjk =w jk +ηH j e k j=1,2,…,l;k=1,2,…,m

[0081] Where η is the learning rate;

[0082] Step 6: Threshold update. Update the network node thresholds a and b according to the network prediction error e.

[0083]

[0084] b k =b k +e k k=1,2,…,m;

[0085] Step 7: Determine whether the algorithm iteration has ended. If not, return to step 2; otherwise, output the classification result.

[0086] If the data to be tested is normal data, its overall characteristics are also very similar to the overall characteristics of the input normal data. The neural network has an equal probability of classifying each group of data as different normal data. Therefore, when the similarity is less than the set threshold, it is a normal chip; if the data to be tested contains data with a Trojan program, its overall characteristics are extremely different from the overall characteristics of the normal data, but its similarity with the overall characteristics of one group of normal data is always higher than that of the other three groups. Therefore, when the similarity is greater than the set threshold, it is a malicious logic chip.

[0087] The present invention is described below through a specific process:

[0088] Hardware malicious logic typically targets major core devices with large circuits, resulting in significant noise impact in real-world scenarios. To ensure universal design and verification, hardware Trojans should be implemented within attack vectors that cover general architectures. This experiment used the internationally recognized AES encryption algorithm, which covers general microprocessor architectures, as a vector. A key-leakage hardware Trojan based on sequence detection was designed and implemented within the AES algorithm. The hardware Trojan circuit's equivalent gate size accounted for 0.54% (the original circuit's equivalent gates were 277,000, while the Trojan circuit's equivalent gates were 1,500). During normal operation, the AES circuit encrypts 128 bits of input data with a 128-bit key. The hardware Trojan trigger module detects the input number and is triggered when the input matches a predefined sequence.

[0089] Data is collected with the help of tools such as a high-precision signal acquisition board, an oscilloscope, and host computer power consumption acquisition software, and the power consumption of the parent circuit and the circuit under test is obtained through denoising.

[0090] In the feature recognition process based on BP neural network, the characteristic data matrices A, B, C, and D of the four groups of normal power consumption curves collected by the power consumption acquisition platform, each containing 12,000 points, are respectively added with feature labels 1, 2, 3, and 4. In order to analyze its power consumption characteristics as comprehensively as possible, the 12,000 points of the four groups of parent circuit power consumption characteristic data matrices A, B, C, and D are taken and cut into 24 segments of equal length, each containing 500 data points, to obtain the reorganized 24 rows and 500 columns feature matrix E 24×500 , each column of 24 points is used as a feature input of the neural network, with a total of 500 inputs, such as Figure 2 shown.

[0091] For example, group A is divided into 500 segments, with every 24 data points cut into segments. The first data point of each segment is grouped as group 1, the second data point is grouped as group 2, and so on, forming 500 groups of data, each containing 24 data points. The same method is used to process data points B, C, and D.

[0092] A: Add the identifier 1 to the beginning of all 500 data sets from data set A to obtain a large array E;

[0093] B: Add the identifier 2 to the beginning of all 500 data sets from data set B to obtain a large array F;

[0094] C: Add the identifier 3 to the beginning of all 500 data sets from data set C to obtain a large array G;

[0095] D: Add the identifier 4 to the beginning of all 500 sets of data from data set D to obtain a large array H.

[0096] Using the BP neural network hardware Trojan detection algorithm, the four reprocessed data matrices (E, F, G, and H) were trained on a neural network to generate a sample reference model. The power consumption of the chip implanted with the hardware Trojan was collected to generate the test data O, which also contained 12,000 data items. The same processing method was applied to the data in Group A to generate data N. This large array N was then processed in a neural network, which identified subtle differences in the arrays and performed classification. The 500 data groups in each large dataset can be considered as 500 subtle features that together comprise the overall characteristics of the large dataset. Since the four training datasets were all normal data, their overall characteristics were extremely similar, and their 500 subtle features were also extremely similar. If the data to be tested is normal data, its overall characteristics are also very similar to the overall characteristics of the four sets of input big data. The neural network has an equal probability of classifying each set of data (each subtle feature) into categories 1, 2, 3, and 4, all of which are approximately 25% ± the threshold. Therefore, the classification of the 500 sets of data is extremely discrete. If the data to be tested contains a Trojan program, its overall characteristics are very different from the overall characteristics of the four sets of input big data. However, its overall characteristics are always more similar to the overall characteristics of one set of data among the four sets of big data than the other three sets, that is, the similarity is greater than the set threshold. Therefore, most of the subtle features in its 500 sets are also more similar to the corresponding subtle features of this set of input data. Therefore, when the neural network performs classification, it will classify most of the data into this category, forming a normalized state. In the embodiments of the present invention, through noise optimization through large sample denoising and wavelet denoising, it can prevent noise from overwhelming the noise of hardware Trojans. The power consumption fluctuations caused by hardware Trojans are separated from the power consumption data. Through the classification processing of the neural network, the hardware Trojan identification results are more obvious.

[0097] According to the BP neural network hardware Trojan detection algorithm, the reprocessed four feature data matrices of E, F, G, and H are input into the neural network for training to obtain a sample reference model. In order to compare and analyze the neural network classification results of the subsequent circuit to be tested, a group of power consumption data of the original circuit is randomly selected and reorganized to obtain its feature matrix, and the reorganized results are input into the BP neural network for classification. The experimental results are as follows Figure 3 As shown in the figure, the horizontal axis represents the characteristic power consumption point, and the vertical axis represents the characteristic value.

[0098] from Figure 4 The experimental results show that if the test data is normal, the classification results after BP neural network processing are relatively discrete, with a roughly consistent distribution across the four labels. This is because the overall characteristics of the test data are very similar to those of the four sample data sets. The neural network has an equal probability of classifying each data set (each subtle feature) as category 1, 2, 3, or 4, each with a probability of approximately 25%. Therefore, the classification of the 500 data sets is extremely discrete.

[0099] Similarly, we collect power consumption data of the chip implanted with malicious logic to obtain the test data O, which also contains 12,000 data. We perform the same data reorganization method as matrix A to obtain the feature matrix N, which is then input into the neural network for processing. The classification results are as follows Figure 4 shown.

[0100] Figure 4 As can be seen from the classification results of the power consumption matrix of the circuit under test after processing with the BP neural network, subtle differences in its characteristic power consumption matrix become apparent after the circuit is implanted with malicious logic, resulting in significant differences in the distribution after classification. From a theoretical perspective, if the circuit under test contains a hardware Trojan, its power consumption characteristics will be significantly different from the overall characteristics of the sample data, but its similarity to the overall characteristics of one of the four sets of big data will always be higher than that of the other three sets. Therefore, most of its 500 sets of subtle features are also more similar to the corresponding subtle features of this set of input data. Therefore, when the neural network performs classification, it will classify the majority of the data into this category, resulting in a normalized trend, thereby distinguishing normal chips from Trojan chips.

[0101] The embodiment of the present invention further provides a fine-grained malicious logic detection system based on power consumption feature classification, including a power consumption curve extraction module, a denoising module and a feature classification judgment module;

[0102] The power consumption curve extraction module is used to collect the power consumption curve of the chip under test and the normal power consumption curves of multiple groups of normal chips;

[0103] A denoising module is used to denoise the power consumption curve to be measured and the normal power consumption curve;

[0104] The feature classification and judgment module is used to reorganize and segment the power consumption curve to be tested and the normal power consumption curve to form a feature matrix, and input the trained neural network for classification to determine whether it is a malicious logic chip.

[0105] It also includes a denoising evaluation module for calculating the signal-to-noise ratio of denoising. When the signal-to-noise ratio is lower than a set threshold, the denoising module is adjusted to perform denoising again.

[0106] The technical features of the above embodiments may be combined in any manner. To simplify the description, not all possible combinations of the technical features in the above embodiments are described. Only preferred embodiments of the present invention are presented. While the description is relatively specific and detailed, it should not be construed as limiting the scope of the present invention. As long as there are no contradictions in the combination of these technical features, they should be considered to be within the scope of this specification.

[0107] It should be noted that those skilled in the art may make various modifications and improvements without departing from the scope of the present invention, and these modifications and improvements fall within the scope of protection of the present invention. Therefore, the scope of protection of the patent for this invention shall be based on the appended claims.

Claims

1. A fine-grained malicious logic detection method based on power consumption feature classification, characterized by: The following steps are involved: Step S1: collecting a power consumption curve of the chip under test and a plurality of normal power consumption curves of normal chips; Step S2: De-noising the power consumption curve to be measured and the normal power consumption curve; Step S3: The power consumption curve to be tested and the normal power consumption curve are reorganized and segmented to form a feature matrix, and input into the trained neural network for classification. When the similarity of the classification results of the chip to be tested is less than a set threshold, it is a normal chip. When the similarity is greater than the set threshold, it is a malicious logic chip. The denoising method in step S2 includes: large sample random noise optimization and wavelet transform high frequency noise optimization; The method for optimizing large sample random noise includes the following steps: applying the same test vector and repeatedly collecting N times, and eliminating the noise using a large sample mean method; The wavelet transform high-frequency noise optimization method comprises the following steps: converting the signal from the time domain to the time-frequency domain, extracting the details of the signal by translating and scaling the wavelet basis to remove the noise. The expression of the wavelet transform is: ； Where r(t) represents the input, and denote the scaling and translation factors, respectively. represents the wavelet basis function; The method for collecting power consumption data in step S1 includes the following steps: Step S11: Constructing the power consumption model P of the integrated circuit tot : ； Where, P dyn Indicates dynamic power consumption, P short Represents static power consumption, P leak Indicates short-circuit current power consumption; Step S12: measuring the power consumption data of N chips, inputting the same stimulus K and executing s times at different temperatures and voltages; Step S13: Process the power consumption data using the following formula to obtain the actual current : ； ； Where, Indicates the real current of the circuit when there is no noise, which is related to the chip C and the excitation K. It represents the power consumption change caused by PVT noise and measurement noise during the actual operation of the circuit, s represents the number of measurements, C i represents the i-th chip, Indicates the power consumption change caused by malicious logic.

2. The fine-grained malicious logic detection method based on power consumption feature classification according to claim 1 is characterized by: The method for neural network classification in step S3 includes the following steps: Step S31: network initialization, input feature matrix; Step S32: Based on the input feature matrix, the connection weights between the input layer and the hidden layer And the hidden layer threshold a, calculate the hidden layer output H; Step S33: According to the hidden layer output H, the connection weight and threshold b, calculate the BP neural network prediction output O; Step S34: Calculate the network prediction error e based on the network prediction output O and the expected output Y; Step S35: Update the network connection weight according to the network prediction error e and ; Step S36: Update the network node thresholds a and b according to the network prediction error e; Step S37: Determine whether the algorithm iteration is completed. If not, return to step S32 and execute again. Otherwise, output the classification result.

3. The fine-grained malicious logic detection method based on power consumption feature classification according to claim 1 is characterized in that: The method further comprises a denoising effect evaluation step: calculating the signal-to-noise ratio (SNR) after denoising: ； Where power signal Indicates the original signal energy, power noise represents the noise signal energy, n represents the signal sequence length, f(i) is the original signal, represents the denoised signal.

4. The fine-grained malicious logic detection method based on power consumption feature classification according to claim 3 is characterized by: When the signal-to-noise ratio SNR is less than the set threshold, step S2 is repeated until the set threshold is met.

5. A fine-grained malicious logic detection system based on power consumption feature classification, applicable to the method according to any one of claims 1 to 4, characterized in that: The system includes a power consumption curve extraction module, a denoising module and a feature classification judgment module; The power consumption curve extraction module is used to collect the power consumption curve of the chip under test and the normal power consumption curves of multiple groups of normal chips; The denoising module is used to denoise the power consumption curve to be measured and the normal power consumption curve; The feature classification judgment module is used to reorganize and segment the power consumption curve to be tested and the normal power consumption curve to form a feature matrix, and input the trained neural network for classification to determine whether it is a malicious logic chip.

6. The fine-grained malicious logic detection system based on power consumption feature classification according to claim 5 is characterized by: The system further comprises a denoising evaluation module for calculating a signal-to-noise ratio of denoising, and when the signal-to-noise ratio is lower than a set threshold, adjusting the denoising module to perform denoising again.

Images