A Trojan Detection Method for FPGA Netlist Based on Graph Neural Network

Abstract

The present invention belongs to the field of Trojan detection, and specifically relates to a Trojan detection method for FPGA netlist based on graph neural network, which aims to solve the problem of lack of effective Trojan detection mechanism in current technology. The present invention includes: using HDL to describe digital logic and system architecture to obtain HDL code; using EDA tools to convert HDL code into gate-level representation, allocating logic blocks represented at the gate level to FPGA chips and planning connections and generating bitstream files; downloading the bitstream files to the FPGA chips and obtaining FPGA netlist files; converting the netlist files into original directed graphs; setting Trojan features of nodes in the original directed graph, further extracting features from the original directed graph to obtain feature directed graphs; balancing malicious logic nodes and normal nodes in the feature directed graphs; using graph convolutional networks to classify nodes of the balanced directed graphs to obtain Trojan detection results. The present invention can accurately detect Trojans.

Description

Background Art

[0002] In today's digital environment, Field-Programmable Gate Arrays (FPGAs) have become critical components in a wide range of fields, including telecommunications, automotive systems, medical devices, and data processing infrastructure. The tunability and superior performance of FPGAs make them indispensable in meeting the dynamic needs of modern electronic systems. Therefore, protecting the integrity and security of FPGAs is critical, not only to protect intellectual property and confidential information, but also to ensure the reliability and stability of the information ecosystem. However, the widespread deployment of FPGAs in mission-critical applications makes them vulnerable to sophisticated security threats, among which hardware Trojans (HDs) are a particularly vicious form of attack. Hardware Trojans are malicious code or modifications implanted in electronic hardware with the purpose of stealing information, disrupting system functionality, or conducting other undetected malicious activities. Unlike software Trojans, hardware Trojans are more difficult to detect and mitigate because they are hidden within the physical structure of the hardware. Hardware Trojans are a significant threat because they can bypass traditional security measures and cause significant damage to systems and data, while posing long-term risks to security and trustworthiness. The development lifecycle of FPGA-based applications requires the use of specialized Integrated Development Environments (IDEs) that help write, compile, and generate binary bitstreams. These bitstreams configure the FPGA to execute custom designs, providing developers with extraordinary flexibility. However, this flexibility also provides the possibility for the implantation of hardware Trojans, including the integration of third-party IP cores, the use of external libraries, and various links in the bitstream generation and distribution stages.

[0003] Although FPGA security is of vital importance, the current application development process usually lacks an effective Trojan detection mechanism. This deficiency not only increases the risk of the system being attacked by hardware Trojans, but also poses a major challenge to security protection. Summary of the invention

[0004] In order to solve the above-mentioned problem in the prior art, that is, the current application development process usually lacks an effective Trojan detection mechanism, the present invention provides a Trojan detection method for FPGA netlist based on graph neural network, the method comprising:

[0005] Using HDL to describe digital logic and system architecture to obtain HDL code; using an EDA tool to convert the HDL code into a gate-level representation, allocating the logic blocks of the gate-level representation to an FPGA chip and planning the connection, and generating a bitstream file based on the planned and connected FPGA chip;

[0006] Download the bitstream file to the FPGA chip, and obtain the netlist file of the FPGA based on the downloaded bitstream file;

[0007] Determine the edges and nodes of the original directed graph, and convert the netlist file into the original directed graph; set the Trojan features of the nodes in the original directed graph, and convert the original directed graph into a feature directed graph based on the Trojan features of the nodes in the original directed graph;

[0008] Balance the malicious logic nodes and normal nodes in the feature directed graph to obtain a balanced directed graph;

[0009] Use the trained graph convolutional network to classify the nodes of the balanced directed graph to obtain the classification result of the nodes of the balanced directed graph, that is, the Trojan detection result of the netlist file.

[0010] In a preferred embodiment, the Trojan features of each node in the original directed graph include: the number of fan-in signals at a distance of x levels from the current node; the number of flip-flops at a distance of x levels in the input and output directions from the current node; the number of multiplexers at a distance of x levels from the current node; the number of inverters within a distance of x levels from the current node; x = 1, 2, 3, 4, 5; the distance to the nearest basic input from the current node; the distance to the nearest basic output from the current node; the number of y-level ring structures contained in the current node, where y = 3, 4, 5.

[0011] In a preferred embodiment, the method for extracting the Trojan features of the nodes in the original directed graph to obtain the feature directed graph is as follows:

[0012] For the i-th node v of the original directed graph i , put the i-th node v i into the initialized queue Q; when calculating a certain dimension of the Trojan features of the node v i , the traversal layer number m = x or y, where x and y are the levels of the required certain dimension of the feature from the node v i ;

[0013] Take out the first node v of the initialized queue Q as the first element, and obtain all adjacent nodes of the first element v according to the structure of the original directed graph;

[0014] Put all adjacent nodes of the first element v into the initialized queue Q in turn for traversal loop; after the traversal loop ends, calculate the feature values of all nodes put into the initialized queue; when the current layer j of the initialized queue satisfies the traversal condition, traverse the current layer j of the initialized queue Q until all layers that satisfy the traversal condition are traversed; the traversal condition is: j < m and the initialized queue Q is not empty;

[0015] For node v i , the method to calculate its eigenvalue is: node v i The current Trojan feature distance node v i When the distance is m, the current traversal level is m; m = x or y; all nodes that meet the current Trojan feature are put into the current initial queue, and the traversal cycle is performed in turn. After the traversal cycle, the number of nodes that meet the current Trojan feature type in the current initial queue is v i The characteristic value of the current Trojan feature;

[0016] The eigenvalues ​​of all Trojan features of all nodes together form the feature matrix F; F[v i ,:] represents node v i Features;

[0017] Based on the feature matrix F, we get the feature directed graph:

[0018] V={v1,v2,…,v n}; A∈R n×n ; F∈R n*d ;

[0019] Where V = {v1,v2,…,v n} is a set of n nodes, yes The adjacency matrix of represents the feature matrix of the node, is the feature of node j, and d is the dimension of the node feature.

[0020] In a preferred embodiment, the method for obtaining a balanced directed graph is:

[0021] The encoder is used to extract the original features of the feature directed graph into a low-dimensional embedding space to obtain an embedded representation of the original features:

[0022]

[0023] in, is the embedding representation of the original node v; F[v,:] represents the features of v; A[:,v] is The vth column of the adjacency matrix, σ is the activation function, W 1 represents the weight matrix;

[0024] Generate neighboring nodes of the new node based on the original feature embedding representation using a synthetic point generator;

[0025]

[0026] Among them, nn(v) represents the nearest neighbor node of node v, Embedding representation of node u, argmin u Represents that the function The node u where the value reaches the minimum; Y u Indicates the type of node u, Y v Indicates the type of node v;

[0027] Generate a new node based on the embedded representation of the original feature and the neighboring nodes of the new node by using the synthetic point generator:

[0028]

[0029] Among them, v * Represents a new node, Yes * The embedding representation of is the embedding representation of the neighboring nodes of the new node;

[0030] By controlling the number of synthesized new nodes, the number of samples in each class can be balanced;

[0031] The decoder establishes a connection relationship between the new node and the original node:

[0032]

[0033] is the predicted v * ,u, w represents any node in the graph, v * Represents the new node generated, represents the embedding representation of the new node, represents the embedding representation of any node, and S represents the feature matrix, i.e., the training target;

[0034] Based on the new node and the original node, update the adjacency matrix:

[0035]

[0036] in, represents the updated adjacency matrix, v′ represents, u represents, E v′,u represents, η represents a constant value;

[0037] Based on the updated nodes and the updated proximity matrix, we get a balanced directed graph.

[0038] in, is the updated node set, After the update The adjacency matrix of Represents the feature matrix of the updated node.

[0039] In a preferred embodiment, the method for the graph convolutional network to update the node features of the balanced directed graph is as follows:

[0040] Input the balanced directed graph into the graph convolutional network, and the graph convolutional network updates the node features of the balanced directed graph by aggregating its own features and neighboring nodes:

[0041]

[0042] where H (l) is the activation matrix of the l-th layer, is the original adjacency matrix plus self-connection, I is the identity matrix, is the diagonal node degree matrix of, W (l) is the weight matrix of the l-th layer, σ is a non-linear activation function; H (l +1) is the activation matrix of the (l + 1)-th layer;

[0043] For each node in the balanced directed graph, the trained GCN model uses the softmax function to calculate the probability of non-trojan nodes and the probability of trojan nodes P(P) according to the features and connection relationships.

[0044] If P(N) > P(P), then judge that the node is a negative node; if P(N) < P(P), then judge that the node is a positive node.

[0045] In a preferred embodiment, the training process of the encoder, the synthetic node generator, and the decoder is as follows:

[0046] Obtain the first training dataset; the first training dataset includes the feature directed graph converted based on the netlist file;

[0047] Input the samples in the first training dataset into the encoder, and through the processing of the encoder, the synthetic node generator, and the decoder in sequence, obtain the prediction result of the connection relationship between nodes;

[0048] Based on the prediction result of the connection relationship between nodes and its corresponding label, calculate the loss value, and then update the parameters of the encoder, the synthetic node generator, and the decoder;

[0049] The loss function of the decoder during training is:

[0050]

[0051] represents the loss function of the edge generator, where E is the predicted node connection relationship, A is the known node connection relationship in the directed graph, represents the square of the Frobenius norm;

[0052] The training is repeated until the trained encoder, synthetic node generator, and decoder are obtained.

[0053] In a preferred embodiment, the graph convolutional network is trained by assigning weights in the loss function of training the graph convolutional network, and the loss function after assigning weights is:

[0054]

[0055] Where N is a balanced directed graph The number of nodes in , K is the number of node categories, y i,k is a one-hot code of whether node i belongs to category k, is the predicted probability that node i belongs to category k, is the loss function, w k is the weight of class k.

[0056] In a second aspect of the present invention, a Trojan detection method system for FPGA netlist based on graph neural network is proposed, and the system comprises:

[0057] A file generation module is used to describe digital logic and system architecture using HDL to obtain HDL code; the HDL code is converted into gate-level representation by an EDA tool, the logic blocks of the gate-level representation are allocated to the FPGA chip and the connection is planned, and a bitstream file is generated based on the planned and connected FPGA chip;

[0058] A file download module, used to download the bit stream file to the FPGA chip, and obtain a netlist file of the FPGA based on the downloaded bit stream file;

[0059] A directed graph generation module is used to convert the netlist file into an original directed graph; set the Trojan horse features of the nodes in the original directed graph, and extract the Trojan horse features of the nodes in the original directed graph to obtain a feature directed graph;

[0060] A directed graph balancing module, used to balance malicious logical nodes and normal nodes in the feature directed graph to obtain a balanced directed graph;

[0061] The node classification module uses the trained graph convolutional network to classify the nodes of the balanced directed graph to obtain the classification results of the nodes of the balanced directed graph, that is, the Trojan detection results of the netlist file.

[0062] According to a third aspect of the present invention, an electronic device is provided, comprising:

[0063] at least one processor; and

[0064] a memory communicatively connected to at least one of the processors; wherein,

[0065] The memory stores instructions that can be executed by the processor, and the instructions are used to be executed by the processor to implement the above-mentioned Trojan detection method for FPGA netlist based on graph neural network.

[0066] In a fourth aspect of the present invention, a computer-readable storage medium is proposed, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to be executed by the computer to implement the above-mentioned Trojan detection method for FPGA netlist based on graph neural network.

[0067] Beneficial effects of the present invention:

[0068] (1) The present invention aims to develop a hardware Trojan detection algorithm based on graph neural network applied to EDA software, combine the algorithm with the design workflow, and finally incorporate it into the proprietary EDA tool HT-FDS. The obtained Trojan detection results have excellent performance.

[0069] (2) This application proposes a security-oriented design workflow that uses specialized algorithms that produce excellent Trojan detection results and integrates Trojan detection algorithms into the development environment to ensure continuous security. Introducing a design process that prioritizes security from the beginning is a major shift in the way FPGAs are designed. This preemptive security focus aims to address potential vulnerabilities in the earliest stages of design, thereby reducing the risk of security vulnerabilities and ensuring the integrity of the final product.

[0070] (3) By leveraging techniques such as deep learning and graph networks, this paper demonstrates the effectiveness of these algorithms in identifying and mitigating hidden malicious circuits, thereby significantly improving the security of EDA and FPGA designs. By embedding Trojan detection algorithms into the design workflow of EDA, this research ensures that security checks become an integral part of the design process. This seamless integration facilitates continuous security verification throughout the development cycle, allowing developers to identify and correct potential vulnerabilities in real time. Therefore, this approach not only enhances the security of the design process, but also simplifies the workflow, making security checks less invasive and more efficient. BRIEF DESCRIPTION OF THE DRAWINGS

[0071] Other features, objects and advantages of the present application will become more apparent by reading the detailed description of non-limiting embodiments made with reference to the following drawings:

[0072] Figure 1 It is a flow chart of a Trojan detection method for FPGA netlist based on graph neural network according to an embodiment of the present invention;

[0073] Figure 2 It is a flow chart of a method for obtaining a balanced directed graph from malicious logical nodes and normal nodes in a balanced feature directed graph according to an embodiment of the present invention;

[0074] Figure 3 It is a flow chart of the design and development of the Hongtu series software according to an embodiment of the present invention;

[0075] Figure 4 It is a structural diagram of a computer system of a server for implementing the method, system, and device embodiments of the present application. DETAILED DESCRIPTION

[0076] The present application will be further described in detail below in conjunction with the accompanying drawings and embodiments. It is to be understood that the specific embodiments described herein are only used to explain the relevant invention, rather than to limit the invention. It is also necessary to explain that, for ease of description, only the parts related to the relevant invention are shown in the accompanying drawings.

[0077] It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0078] The present invention provides a Trojan detection method for FPGA netlist based on graph neural network, the method comprising:

[0079] Using HDL to describe digital logic and system architecture to obtain HDL code; using an EDA tool to convert the HDL code into a gate-level representation, allocating the logic blocks of the gate-level representation to an FPGA chip and planning the connection, and generating a bitstream file based on the planned and connected FPGA chip;

[0080] Downloading the bitstream file to the FPGA chip, and obtaining a netlist file of the FPGA based on the downloaded bitstream file;

[0081] Determine the edges and nodes of the original directed graph, and convert the netlist file into the original directed graph; set the Trojan horse features of the nodes in the original directed graph, and convert the directed graph into a feature directed graph based on the Trojan horse features of the nodes in the original directed graph;

[0082] Balancing malicious logic nodes and normal nodes in the feature directed graph to obtain a balanced feature;

[0083] The trained graph convolutional network is used to classify the nodes of the balanced directed graph to obtain the classification results of the nodes of the balanced directed graph, that is, the Trojan detection results of the netlist file.

[0084] In order to more clearly illustrate the Trojan detection method for FPGA netlist based on graph neural network of the present invention, Figure 1 Each step in the embodiment of the present invention is described in detail.

[0085] The Trojan detection method for FPGA netlist based on graph neural network in the first embodiment of the present invention is described in detail as follows:

[0086] Using HDL to describe digital logic and system architecture to obtain HDL code; using an EDA tool to convert the HDL code into a gate-level representation, allocating the logic blocks of the gate-level representation to an FPGA chip and planning the connection, and generating a bitstream file based on the planned and connected FPGA chip;

[0087] Specifically, in the workflow of FPGA design, EDA (electronic design automation) tools play a pivotal role, building a bridge between design concepts and actual hardware. In this process, designers first use hardware description languages ​​(HDLs), such as Verilog or VHDL, to carefully describe the digital logic and system architecture. After that, the EDA tool performs the synthesis phase, converting the HDL code into a gate-level representation and optimizing it to meet the constraints on timing, power consumption, and area. Subsequently, the design enters the verification phase, where designers use simulation to ensure that the synthesized logic meets the original design intent and verify whether there are logical errors. This step is critical because it prevents costly repeated modifications. After verification, the design enters the layout and routing phase, in which the EDA tool assigns logic blocks to physical locations on the FPGA chip and plans the connections between them, while solving any potential timing problems. Finally, after careful optimization during the layout and routing process, the EDA tool generates a bitstream file, which is a data sequence that accurately configures the internal logic units of the FPGA and their interconnections. The designer then downloads the bitstream to the FPGA chip to implement the design concept. From design input to final hardware implementation, every step of this process relies on the powerful functions of EDA tools, ensuring efficient implementation and rapid iteration of the design, greatly improving development efficiency and success rate. Hongtu series software is a set of powerful tools independently developed by Beijing Microelectronics Technology Institute (BMTI) for software and hardware development environment and embedded platform. Figure 2As shown, Hongtu can meet a variety of needs such as full-process FPGA development, configuration download, soft error sensitivity assessment, soft error mitigation optimization, embedded integrated development, and on-chip programmable system development. Hongtu can help developers create customized hardware accelerators and implement radiation-resistant and high-security designs on demand. These tools enable developers in the aerospace, defense, and industrial fields to use BMTI's high-reliability, radiation-resistant, and long-life chip solutions. Hongtu FPGA Design Suite (HT-FDS) is an FPGA EDA software independently developed by the Beijing Institute of Microelectronics Technology. It covers the complete design process from HDL circuit function description to bitstream download, and provides common functions such as project management, file editing, compilation flow call, information feedback, and log printing.

[0088] The present invention embeds a Trojan detection component in the HT-FDS framework to enhance the security of the FPGA. It is integrated into the post-synthesis stage and performs security checks to determine whether the design contains Trojan nodes. After the Trojan nodes are identified and filtered out, the subsequent steps of the design process (such as patch and routing) can continue while ensuring the security of the FPGA. By embedding this security function directly in HT-FDS, it ensures that potential vulnerabilities are identified and resolved early in the development cycle, thereby improving the overall security and integrity of FPGA-based systems. This innovation not only protects hardware from malicious threats, but also simplifies the design workflow, thereby improving the efficiency and reliability of FPGA development projects.

[0089] Downloading the bitstream file to the FPGA chip, and obtaining a netlist file of the FPGA based on the downloaded bitstream file;

[0090] The method for converting the netlist file into the original directed graph is as follows: each logic unit in the netlist file is converted into a node in the original directed graph, and each signal or current in the netlist file is converted into an edge in the original directed graph, and the arrow direction of the edge of the original directed graph represents the output direction of the signal or current.

[0091] Determine the edges and nodes of the original directed graph, and convert the netlist file into the original directed graph; set the Trojan horse features of the nodes in the original directed graph, and convert the directed graph into a feature directed graph based on the Trojan horse features of the nodes in the original directed graph;

[0092] The Trojan features of each node in the original directed graph include: the number of fan-in signals at x levels away from the current node; the number of flip-flops at x levels away from the current node in the input and output directions; the number of multiplexers at x levels away from the current node; the number of inverters within x levels away from the current node; x = 1, 2, 3, 4, 5; the distance to the nearest basic input from the current node; the distance to the nearest basic output from the current node; the number of y-level ring structures contained in the current node, where y = 3, 4, 5.

[0093] Seven types of features, including fan-in feature, flip-flop feature, multiplexer feature, input-output topological depth feature, etc., with a total of 30 dimensions of features, are selected as the structural features of the Trojan to describe the properties of the gate-level Trojan. The Trojan features of the nodes are shown in Table 1;

[0094] Table 1

[0095]

[0096] In this embodiment, the method for extracting the Trojan features of the nodes in the original directed graph to obtain the feature directed graph is as follows:

[0097] For the i-th node v of the original directed graph i , put the i-th node v i into the initialized queue Q; when calculating a certain dimension of the Trojan feature of node v i , the traversal layer number m = x or y, where x and y are the levels of the required certain dimension of the feature away from node v i .

[0098] Take out the first node v of the initialized queue Q as the first element, and obtain all adjacent nodes of the first element v according to the structure of the original directed graph;

[0099] Put all adjacent nodes of the first element v into the initialized queue Q in turn for traversal loop; after the traversal loop ends, calculate the feature values of all nodes put into the initialized queue; when the current layer j of the initialized queue satisfies the traversal condition, traverse the current layer j of the initialized queue Q until all layers that satisfy the traversal condition are traversed; the traversal condition is: j < m and the initialized queue Q is not empty;

[0100] For node v i , the method for calculating its feature value is: the current Trojan feature of node v i is away from node v iWhen the distance is m, the current traversal level is m; m = x or y; all nodes that meet the current Trojan feature are put into the current initial queue, and the traversal cycle is performed in turn. After the traversal cycle, the number of nodes that meet the current Trojan feature type in the current initial queue is v i The characteristic value of the current Trojan feature;

[0101] The eigenvalues ​​of all Trojan features of all nodes together form the feature matrix F; F[v i ,:] represents node v i Features;

[0102] Based on the feature matrix F, we get the feature directed graph:

[0103] V={v1,v2,…,v n}; A∈R n×n ; F∈R n*d ;

[0104] Where V = {v1,v2,…,v n} is a set of n nodes, yes The adjacency matrix of represents the feature matrix of the node, is the feature of node j, and d is the dimension of the node feature.

[0105] A specific example of calculating its eigenvalue is: when calculating the fan_in_5 of node v, traverse the number of layers m=5, put all the 5-level fan-in nodes of v's input distance into queue Q, and then count the number of elements in queue Q, which is the fan_in_5 eigenvalue of node v; when calculating the out_flipflop_4 of node v, traverse the number of layers m=4, put all the 4-level nodes of v's output distance into queue Q, and then count the number of nodes with the flipflop attribute in queue Q, which is the out_flipflop_4 eigenvalue of node v.

[0106] Balancing the malicious logic nodes and normal nodes in the characteristic directed graph to obtain a balanced directed graph; Figure 3 As shown, the method to obtain a balanced directed graph is:

[0107] The encoder is used to extract the original features of the feature directed graph into a low-dimensional embedding space to obtain an embedded representation of the original features:

[0108]

[0109] in, is the embedding representation of the original node v; F[v,:] represents the features of v; A[:,v] is The vth column of the adjacency matrix, σ is the activation function, W 1 represents the weight matrix;

[0110] Generate neighboring nodes of the new node based on the original feature embedding representation using a synthetic point generator;

[0111]

[0112] Among them, nn(v) represents the nearest neighbor node of node v, Embedding representation of node u, argmin u Represents that the function The node u where the value reaches the minimum; Y u Indicates the type of node u, Y v Indicates the type of node v;

[0113] Generate a new node based on the embedded representation of the original feature and the neighboring nodes of the new node by using the synthetic point generator:

[0114]

[0115] Among them, v * Represents a new node, Yes * The embedding representation of is the embedding representation of the neighboring nodes of the new node;

[0116] By controlling the number of synthesized new nodes, the number of samples in each class can be balanced;

[0117] The decoder establishes a connection relationship between the new node and the original node:

[0118]

[0119] is the predicted v * ,u, w represents any node in the graph, v * Represents the new node generated, represents the embedding representation of the new node, represents the embedding representation of any node, and S represents the feature matrix, i.e., the training target;

[0120] Based on the new node and the original node, update the adjacency matrix:

[0121]

[0122] in, represents the updated adjacency matrix, v′ represents, u represents, E v′,u represents, η represents a constant value;

[0123] Based on the updated nodes and the updated proximity matrix, we get a balanced directed graph.

[0124] in, is the updated node set, After the update The adjacency matrix of Represents the feature matrix of the updated node.

[0125] Hardware Trojans are usually small, hidden, and designed to be activated under specific conditions, making them difficult to detect during standard testing. This results in Trojan nodes being extremely rare compared to normal nodes in netlists (datasets that describe the logic and structure of hardware circuits), resulting in a highly unbalanced dataset. This imbalance poses a huge challenge to hardware Trojan detection methods based on machine learning.

[0126] Therefore, we use GraphSMOTE to balance the data set. Through the previous steps, we get a directed graph To solve the problem of data imbalance, we apply the GraphSMOTE algorithm to the original dataset as input following Section 2. Through the processes of encoding, node generation, and decoding, we obtain a balanced dataset, represented as This balanced approach greatly improves the efficiency of subsequent analysis.

[0127] Table 2 compares the number of normal nodes and Trojan nodes in several circuits before and after balancing. The processed data set achieves a balance between the number of normal nodes and Trojan nodes.

[0128] Table 2

[0129]

[0130] The trained graph convolutional network is used to classify the nodes of the balanced directed graph to obtain the classification results of the nodes of the balanced directed graph, that is, the Trojan detection results of the netlist file.

[0131] In this embodiment, the method of using a trained graph convolutional network to classify the nodes of the balanced directed graph includes:

[0132] The balanced directed graph Input into the graph convolutional network, the graph convolutional network updates the node features of the balanced directed graph by aggregating its own features and adjacent nodes:

[0133]

[0134] Among them, H (l) is the activation matrix of layer l, is the original adjacency matrix plus self-connection, I is the identity matrix, yes The diagonal node degree matrix, W (l) is the weight matrix of the lth layer, and σ is a nonlinear activation function.

[0135] For each node in the balanced directed graph, the trained GCN model uses the softmax function to calculate the probability of a non-Trojan node and the probability P(P) of a Trojan node based on the features and the connection relationship.

[0136] The true positive rate (TPR), true negative rate (TNR) and F1 score are used as evaluation indicators of the experiment. Assume that TP is the number of true positive predictions (correctly identified Trojan nodes), TN is the number of true negative predictions (correctly identified normal nodes), FP is the number of false positive predictions (normal nodes are incorrectly classified as Trojans), and FN is the number of false negative predictions (Trojan nodes are incorrectly classified as normal nodes). TPR, TNR and F1 score can be expressed as:

[0137]

[0138]

[0139]

[0140]

[0141] All PTA-level Trojan circuits on Tρυστ-ηυβ are selected for experiments. The experimental results are shown in Table 3;

[0142] Table 3

[0143] Netlists TPR TNR F1 rs232_t100.v 95.74％ 97.54％ 94.74％ rs232_t200.v 100.00％ 88.41％ 84.62％ rs232_t300.v 97.40％ 100.00％ 98.68％ rs232_t400.v 100.00％ 99.35％ 94.74％ rs232_t500.v 96.61％ 98.69％ 96.61％ rs232_t600.v 92.86％ 88.73％ 74.29％ rs232_t700.v 97.14％ 88.15％ 80.00％ rs232_t800.v 100.00％ 92.24％ 90.72％ rs232_t900.v 100.00％ 89.33％ 95.96％ rs232_t901.v 98.97％ 92.31％ 96.48％ pic_16f84_t100.v 91.67％ 84.95％ 77.34％ pic_16f84_t200.v 98.36％ 97.38％ 94.49％ pic_16f84_t300.v 91.03％ 93.30％ 81.48％ pic_16f84_t400.v 90.21％ 94.99％ 83.77％ mc8051_t300.v 98.34％ 95.06％ 89.49％ mc8051_t500.v 98.30％ 98.68％ 95.37％ mc8051_t600.v 87.50％ 99.48％ 72.73％ mc8051_t700.v 97.60％ 99.59％ 93.85％ mc8051_t800.v 93.89％ 86.91％ 78.39％ Average 96.09％ 93.95％ 88.09％

[0144] Table 4 summarizes the results obtained by several other research methods; some of the other literature uses the GraphSAGE model to train the classifier, and the true negative rate (TNR) of this method reaches 99.8%; however, our method improves the true positive rate (TPR) and F1 score, but the TNR decreases slightly. The random forest method, although it can identify hardware Trojans without false positives, thus achieving a TNR of 100%, has a low TPR, resulting in a decrease in F1 score. Reference

[15] introduced adversarial training in Trojan detection, and achieved a TPR of 96.8%, but the F1 score decreased significantly due to the decrease in TNR. In summary, the method proposed in this paper not only focuses on improving the accuracy of Trojan detection (as can be seen from the improvement in TPR), but also obtains the highest F1 score among the compared methods, showing its balanced performance in terms of F1 score and TPR.

[0145] Table 4

[0146] Method TPR TNR F1 GraphSMOTE+GCN 96.1％ 94.0％ 88.1％ GraphSAGE

[12] 92.9％ 99.8％ 86.2％ Random Forest

[14] 63.6％ 100.00％ 77.8％ R-HTDetector

[15] 96.8％ 94.5％ 59.9％

[0147] Different weight values ​​can produce different detection results, as shown in Table 5:

[0148] Table 5

[0149] Weight TPR TNR F1 1:6 96.1％ 94.0％ 88.1％ 1:1 87.6％ 97.8％ 77.8％ 1:4 95.3％ 94.3％ 83.6％ 1:10 96.8％ 92.5％ 81.7％ 1:15 98.2％ 89.7％ 72.6％

[0150] The present invention also includes a training process for the encoder, the synthesis node generator, and the decoder:

[0151] Acquire a first training data set; the first training data set includes a feature directed graph converted based on the netlist file;

[0152] Inputting samples in the first training data set into the encoder, and sequentially processing them through the encoder, the synthetic node generator, and the decoder to obtain a prediction result of the connection relationship between nodes;

[0153] Based on the prediction results of the connection relationship between the nodes and their corresponding labels, the loss value is calculated, and then the parameters of the encoder, the synthetic node generator, and the decoder are updated;

[0154] The loss function of the decoder during training is:

[0155]

[0156] represents the loss function of the edge generator, where E is the predicted node connection relationship, A is the known node connection relationship in the directed graph, represents the square of the Frobenius norm;

[0157] Perform cyclic training until a trained encoder, synthesis node generator, and decoder are obtained.

[0158] During the training of the GCN, it is found that the weight parameter (Weight) in the CrossEntropyLoss function has a significant impact on the training results of the GCN. Different results are obtained for different weight values. Since in the process of Trojan detection, the cost of misjudging a positive node as a negative node (false negative, FN) is much higher than the cost of misjudging a negative node as a positive node (false positive, FP), that is, the weight ratios of the two different errors are different. Therefore, the weight parameter in the cross-entropy function is adjusted, and the optimal parameter value is obtained through adjustment. After completing the training of the GCN, we can start the detection process and use the trained model to classify each node in the circuit. This step includes inputting the graph data representing the circuit into the GCN model. Then, based on the provided features and connection information, the model uses the learned weights and graph structure to predict the category of each node. For each point in the directed graph data, the GCN model calculates the probability P(N) that it belongs to a negative node (i.e., a non-Trojan node) and the probability P(P) that it belongs to a positive node (i.e., a Trojan node), and compares the two; if P(N) > P(P), then the node is a negative node; if P(N) < P(P), then the node is a positive node.

[0159] Train the graph convolutional neural network by assigning weights to the loss function of the graph convolutional neural network. The loss function after assigning weights is:

[0160]

[0161] where N is the number of nodes in the balanced directed graph in the graph, K is the number of node categories, y i,k is a one-hot code indicating whether node i belongs to category k, is the predicted probability that node i belongs to category k, is the loss function, and w k is the weight of category k.

[0162] Although the above embodiments describe the various steps in the above sequential order, those skilled in the art can understand that in order to achieve the effects of this embodiment, different steps do not have to be executed in such an order. They can be executed simultaneously (in parallel) or in a reversed order, and these simple changes are all within the protection scope of the present invention.

[0163] The Trojan detection method system for an FPGA netlist based on a graph neural network according to the second embodiment of the present invention is characterized in that the system includes:

[0164] A file generation module is used to describe digital logic and system architecture using HDL to obtain HDL code; the HDL code is converted into gate-level representation by an EDA tool, the logic blocks of the gate-level representation are allocated to the FPGA chip and the connection is planned, and a bitstream file is generated based on the planned and connected FPGA chip;

[0165] A file download module, used to download the bit stream file to the FPGA chip, and obtain a netlist file of the FPGA based on the downloaded bit stream file;

[0166] A directed graph generation module is used to convert the netlist file into an original directed graph; set the Trojan horse features of the nodes in the original directed graph, and extract the Trojan horse features of the nodes in the original directed graph to obtain a feature directed graph;

[0167] A directed graph balancing module, used to balance malicious logical nodes and normal nodes in the directed graph to obtain a balanced directed graph;

[0168] The node classification module uses the trained graph convolutional network to classify the nodes of the balanced directed graph to obtain the classification results of the nodes of the balanced directed graph, that is, the Trojan detection results of the netlist file.

[0169] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process and related instructions of the system described above can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0170] It should be noted that the Trojan detection method system for FPGA netlist based on graph neural network provided in the above embodiment is only illustrated by the division of the above functional modules. In practical applications, the above functions can be assigned to different functional modules as needed, that is, the modules or steps in the embodiments of the present invention can be decomposed or combined. For example, the modules in the above embodiments can be combined into one module, or further divided into multiple sub-modules to complete all or part of the functions described above. The names of the modules and steps involved in the embodiments of the present invention are only for distinguishing the modules or steps, and are not regarded as improper limitations of the present invention.

[0171] An electronic device according to the third embodiment of the present invention comprises: at least one processor; and a memory communicatively connected to at least one of the processors; wherein the memory stores instructions executable by the processor, and the instructions are used to be executed by the processor to implement the above-mentioned Trojan detection method for FPGA netlist based on graph neural network.

[0172] A computer-readable storage medium according to a fourth embodiment of the present invention stores computer instructions, and the computer instructions are used to be executed by the computer to implement the above-mentioned Trojan detection method for FPGA netlist based on graph neural network.

[0173] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process and related instructions of the storage device and processing device described above can refer to the corresponding process in the aforementioned method embodiment and will not be repeated here.

[0174] Those skilled in the art should be able to appreciate that the modules and method steps of each example described in conjunction with the embodiments disclosed herein can be implemented with electronic hardware, computer software or a combination of the two, and the programs corresponding to the software modules and method steps can be placed in random access memory (RAM), internal memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disks, removable disks, CD-ROMs, or any other form of storage medium known in the technical field. In order to clearly illustrate the interchangeability of electronic hardware and software, the composition and steps of each example have been generally described in the above description according to the function. Whether these functions are performed in electronic hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered to exceed the scope of the present invention.

[0175] Reference below Figure 4 , which shows a schematic diagram of the structure of a computer system of a server for implementing the method, system, and device embodiments of the present application. Figure 4 The server shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0176] like Figure 4 As shown, the computer system includes a central processing unit (CPU) 601, which can perform various appropriate actions and processes according to the program stored in the read-only memory (ROM) 602 or the program loaded from the storage part 608 to the random access memory (RAM) 603. Various programs and data required for system operation are also stored in the RAM 603. The CPU 601, ROM 602 and RAM 603 are connected to each other through a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.

[0177] The following components are connected to the I / O interface 605: an input section 606 including a keyboard, a mouse, etc.; an output section 607 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker; a storage section 608 including a hard disk, etc.; and a communication section 609 including a network interface card such as a LAN (Local Area Network) card, a modem, etc. The communication section 609 performs communication processing via a network such as the Internet. A drive 610 is also connected to the I / O interface 605 as needed. A removable medium 611, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 610 as needed so that a computer program read therefrom is installed into the storage section 608 as needed.

[0178] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 609, and / or installed from the removable medium 611. When the computer program is executed by the central processing unit (CPU) 601, the above-mentioned functions defined in the method of the present application are executed. It should be noted that the above-mentioned computer-readable medium of the present application can be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium can be, for example, - but not limited to - an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to, an electrical connection with one or more conductors, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, an apparatus or a device. In the present application, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. A computer-readable signal medium may also be any computer-readable medium other than a computer-readable storage medium, which may send, propagate, or transmit a program for use by or in combination with an instruction execution system, an apparatus or a device. The program code contained on the computer-readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wire, optical cable, RF, etc., or any suitable combination of the above.

[0179] Computer program code for performing the operations of the present application may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0180] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present application. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0181] The terms "first", "second", etc. are used to distinguish similar objects rather than to describe or indicate a particular order or sequence.

[0182] The term "comprise" or any other similar term is intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus / device that includes a list of elements includes not only those elements but also other elements not expressly listed, or also includes elements inherent to such process, method, article, or apparatus / device.

[0183] So far, the technical solutions of the present invention have been described in conjunction with the preferred embodiments shown in the accompanying drawings. However, it is easy for those skilled in the art to understand that the protection scope of the present invention is obviously not limited to these specific embodiments. Without departing from the principle of the present invention, those skilled in the art can make equivalent changes or substitutions to the relevant technical features, and the technical solutions after these changes or substitutions will fall within the protection scope of the present invention.

Claims

1. A Trojan detection method for FPGA netlist based on graph neural network, characterized in that: The method includes: Describing digital logic and system architecture in HDL to obtain HDL code; converting the HDL code into a gate-level representation by an EDA tool, allocating the logic blocks of the gate-level representation to an FPGA chip and planning the connections, and generating a bitstream file based on the FPGA chip after the planned connections. Downloading the bitstream file to the FPGA chip and obtaining a netlist file of the FPGA based on the downloaded bitstream file. Determining the edges and nodes of the original directed graph, and converting the netlist file into the original directed graph; setting the Trojan features of the nodes in the original directed graph, and extracting the Trojan features of the nodes in the original directed graph to obtain a feature directed graph. Balancing the malicious logic nodes and normal nodes in the feature directed graph to obtain a balanced directed graph. Using the trained graph convolutional network to classify the nodes of the balanced directed graph to obtain the classification results of the nodes of the balanced directed graph, that is, the Trojan detection results of the netlist file. The method for extracting the Trojan features of the nodes in the original directed graph to obtain a feature directed graph is: For the i-th node v of the original directed graph i , the i-th node v i Put it into the initialization queue Q; calculate node v i When a certain dimension of Trojan horse feature is obtained, the number of layers traversed is m = x or y, where x, y is the distance node v of the required certain dimension feature. i The number of series; Taking out the first node v of the initialized queue Q as the first element, and obtaining all adjacent nodes of the first element v according to the structure of the original directed graph. Successively putting all adjacent nodes of the first element v into the initialized queue Q for traversal loop; when the current layer j of the initialized queue satisfies the traversal condition, traversing the current layer j of the initialized queue Q until all layers that satisfy the traversal condition are traversed; the traversal condition is: j < m and the initialized queue Q is not empty; after the traversal loop ends, calculating the feature values of all nodes put into the initialized queue. For node v i , the method to calculate its eigenvalue is: node v i The current Trojan feature distance node v i When the distance is m, the current traversal level is m; m = x or y; all nodes that meet the current Trojan characteristics are put into the current initial queue, and the traversal cycle is performed in turn. After the traversal cycle, the number of nodes that meet the current Trojan characteristic type in the current initial queue is v i The characteristic value of the current Trojan feature; The eigenvalues ​​of all Trojan features of all nodes together form the feature matrix F; F[v i ,:] represents node v i Features; Obtaining a feature directed graph based on the feature matrix F: g=(V, A, F). V={v1,v2,…,v n };A∈R n×n ;F∈R n*d ; Where V = {v1,v2,…,v n } is a set of n nodes, is the adjacency matrix of θ, represents the feature matrix of the node, is the feature of node j, and d is the dimension of the node feature; The method for obtaining a balanced directed graph is: Using an encoder to extract the original features of the feature directed graph into a low-dimensional embedding space to obtain an embedding representation of the original features. in, is the embedding representation of the original node v; F[v,:] represents the features of v; A[:,v] is the vth column of the adjacency matrix of g, σ is the activation function, W 1 represents the weight matrix; Using a synthetic point generator to generate adjacent nodes of a new node based on the original feature embedding representation. Among them, nn(v) represents the nearest neighbor node of node v, Embedding representation of node u, argmin u Represents that the function The node u where the value reaches the minimum; Y u Indicates the type of node u, Y v Indicates the type of node v; Using the synthetic point generator to generate a new node based on the embedding representation of the original features and the adjacent nodes of the new node. Among them, v * Represents a new node, Yes * The embedding representation of is the embedding representation of the neighboring nodes of the new node; Balancing the number of samples of each class by controlling the number of synthetic new nodes. Establishing a connection relationship between the new node and the original node through a decoder. is the predicted v * The connection relationship between and w, w represents any node in the graph, v * Represents the new node generated, represents the embedding representation of the new node, represents the embedding representation of any node, and S represents the feature matrix, i.e., the training target; Updating the adjacency matrix based on the new node and the original node. in, represents the updated adjacency matrix, η represents a constant value; Based on the updated nodes and the updated proximity matrix, we get a balanced directed graph. in, is the updated node set, After the update The adjacency matrix of Represents the feature matrix of the updated node.

2. The Trojan detection method for FPGA netlist based on graph neural network according to claim 1 is characterized in that: The method for converting the netlist file into the original directed graph is: Each logic unit in the netlist file is converted into a node in the original directed graph, and each signal or current in the netlist file is converted into an edge in the original directed graph. The arrow direction of the edge in the original directed graph represents the output direction of the signal or current.

3. The Trojan detection method for FPGA netlist based on graph neural network according to claim 2 is characterized in that: The Trojan features of each node in the original directed graph include: the number of fan-in signals at an x-level distance from the current node; the number of triggers at an x-level distance from the current node in the input and output directions; the number of multiplexers at an x-level distance from the current node; the number of inverters within an x-level distance from the current node; x=1,2,3,4,5; the distance to the basic input closest to the current node; the distance to the basic output closest to the current node; the number of y-level ring structures contained in the current node y=3,4,5.

4. The Trojan detection method for FPGA netlist based on graph neural network according to claim 3 is characterized in that: The method of using the trained graph convolutional network to classify the nodes of the balanced directed graph includes: The balanced directed graph Input into the trained graph convolutional network, the trained graph convolutional network updates the node features of the balanced directed graph by aggregating its own features and adjacent nodes: Among them, H (l) is the activation matrix of layer l, is the original adjacency matrix plus self-connection, I is the identity matrix, yes The diagonal node degree matrix, W (l) is the weight matrix of the lth layer, σ is a nonlinear activation function; H (l+1) is the activation matrix of the l+1th layer; For each node in the balanced directed graph, the trained GCN model uses the softmax function to calculate the probability of a non-Trojan node and the probability P(P) of a Trojan node based on the features and the connection relationship.

5. The Trojan detection method for FPGA netlist based on graph neural network according to claim 4 is characterized in that: The training process of the encoder, the synthetic point generator, and the decoder is as follows: Acquire a first training data set; the first training data set includes a feature directed graph converted based on the netlist file; Inputting samples in the first training data set into the encoder, and sequentially processing them through the encoder, the synthetic point generator, and the decoder to obtain a prediction result of the connection relationship between nodes; Based on the prediction results of the connection relationship between the nodes and their corresponding labels, the loss value is calculated, and then the parameters of the encoder, the synthetic point generator, and the decoder are updated; The loss function of the decoder during training is: represents the loss function of the edge generator, where E is the predicted node connection relationship, A is the known node connection relationship in the directed graph, represents the square of the Frobenius norm; The training is repeated until the trained encoder, synthetic point generator and decoder are obtained.

6. The Trojan detection method for FPGA netlist based on graph neural network according to claim 5 is characterized in that: The graph convolutional network is trained by assigning weights in the loss function of the training graph convolutional network. The loss function after assigning weights is: Where N is a balanced directed graph The number of nodes in , K is the number of node categories, y i,k is a one-hot code of whether node i belongs to category k, is the predicted probability that node i belongs to category k, is the loss function, w k is the weight of class k.

7. A Trojan detection method system for FPGA netlist based on graph neural network, based on the Trojan detection method for FPGA netlist based on graph neural network as described in any one of claims 1 to 6, characterized in that: The system comprises: A file generation module is used to describe digital logic and system architecture using HDL to obtain HDL code; the HDL code is converted into gate-level representation by an EDA tool, the logic blocks of the gate-level representation are allocated to the FPGA chip and the connection is planned, and a bitstream file is generated based on the planned and connected FPGA chip; A file download module, used to download the bit stream file to the FPGA chip, and obtain a netlist file of the FPGA based on the downloaded bit stream file; A directed graph generation module is used to convert the netlist file into an original directed graph; set the Trojan horse features of the nodes in the original directed graph, and extract the Trojan horse features of the nodes in the original directed graph to obtain a feature directed graph; A directed graph balancing module, used to balance malicious logical nodes and normal nodes in the feature directed graph to obtain a balanced directed graph; The node classification module uses the trained graph convolutional network to classify the nodes of the balanced directed graph to obtain the classification results of the nodes of the balanced directed graph, that is, the Trojan detection results of the netlist file.

8. An electronic device, characterized in that: include: at least one processor; as well as a memory communicatively connected to at least one of the processors; wherein, The memory stores instructions that can be executed by the processor, and the instructions are used to be executed by the processor to implement the Trojan detection method for FPGA netlist based on graph neural network as described in any one of claims 1-6.

Images