A hardware Trojan detection method based on the fusion of structural information and semantic information

Abstract

The embodiment of the present application provides a hardware Trojan detection method that integrates structural information and semantic information, which can solve the technical problem of poor hardware Trojan detection capabilities. The method includes: determining a first file; the first file includes multiple code files for a chip design; establishing an abstract syntax tree based on the first file; extracting node features and node adjacency relationships based on the abstract syntax tree; obtaining structural information based on the node features and node adjacency relationships; obtaining code semantic features based on multiple code files; fusing structural information and code semantic features based on a cross-attention mechanism to obtain a target feature vector; training a hardware Trojan detection model based on the target feature vector; inputting the code to be tested into the hardware Trojan detection model to obtain a hardware Trojan detection result. In this way, there is no need to manually process and analyze suspicious signals or statements, which improves the degree of automation and thus improves the hardware Trojan detection capability.

Description

Technical Field

[0001] The present application relates to the field of integrated circuits, and in particular to a hardware Trojan detection method that integrates structural information and semantic information. Background Art

[0002] With the rapid development of the integrated circuit industry, in order to shorten R&D cycles, reduce manufacturing costs, ensure chip product performance, and create greater economic value, most design companies have divided various aspects of chip design and manufacturing among different companies and individuals. Outsourcing of integrated circuit design and manufacturing has become the norm. While the involvement of third-party companies and personnel brings convenience, it also poses serious hardware security risks. Among the numerous hardware security threats, hardware Trojans are a typical example. Hardware Trojans refer to malicious logic implanted in hardware by malicious attackers. They are usually silent and activated when trigger conditions are met. They can leak internal signals, alter circuit functions, reduce circuit reliability, and even cause physical damage to the chip. Hardware Trojans can be implanted at various stages of the design process, but implanting them at a higher level of abstraction, such as the register transfer level (RTL) design stage, offers significant advantages. On the one hand, RTL design is closer to the functional level, making it easier to design and implement malicious logic. Typically, only a small amount of code is needed to implement malicious functionality. On the other hand, as subsequent design processes such as synthesis and place-and-route are completed, the security threat posed by Trojans becomes increasingly profound, significantly increasing the difficulty and cost of later detection. Therefore, hardware Trojan detection at the RTL code stage is crucial to ensuring the security of chip design.

[0003] Currently, the detection method for RTL hardware Trojans is based on functional testing, which creates test cases to check whether the actual output is consistent with the expected output.

[0004] However, building a complete test case is very complex and time-consuming, and it is ineffective against hardware Trojans that do not modify functionality. Therefore, how to improve the detection capability of hardware Trojans has become an urgent problem to be solved. Summary of the Invention

[0005] The embodiment of the present application provides a hardware Trojan detection method that integrates structural information and semantic information, which can solve the technical problem of poor hardware Trojan detection capability.

[0006] To achieve the above objectives, the embodiments of the present application adopt the following technical solutions:

[0007] In the first aspect, an embodiment of the present application provides a hardware Trojan detection method that integrates structural information and semantic information. The hardware Trojan detection method that integrates structural information and semantic information includes: determining a first file; the first file includes multiple code files of a chip design; establishing an abstract syntax tree based on the first file; extracting node features and node adjacency relationships based on the abstract syntax tree; obtaining structural information based on the node features and node adjacency relationships; obtaining code semantic features based on multiple code files; based on a cross-attention mechanism, integrating structural information and code semantic features to obtain a target feature vector; training a hardware Trojan detection model based on the target feature vector; inputting the code to be tested into the hardware Trojan detection model to obtain a hardware Trojan detection result.

[0008] Based on the above description of the hardware Trojan detection method for the fusion of structural information and semantic information provided in the embodiment of the present application, it can be seen that the hardware Trojan detection method for the fusion of structural information and semantic information does not require manual processing to analyze suspicious signals or statements, reduces the manual burden, improves the degree of automation, and thus improves the hardware Trojan detection capability. The present application can directly detect various types of hardware Trojans (including unknown hardware Trojans) without relying on the setting of security attributes. At the same time, it does not face the problem of state space explosion. The present application does not rely on the golden model. Features are obtained from images and texts to capture more code information, thereby improving the detection accuracy.

[0009] In a feasible implementation of the first aspect, when executing the step of extracting node features and node adjacency relationships based on the abstract syntax tree, the hardware Trojan detection method that integrates structural information and semantic information also includes: obtaining all node types of the abstract syntax tree; and obtaining node features through one-hot encoding based on the node type.

[0010] In a feasible implementation of the first aspect, when executing the step of extracting node features and node adjacency relationships based on the abstract syntax tree, the hardware Trojan detection method that integrates structural information and semantic information also includes: generating an adjacency matrix based on the abstract syntax tree to obtain node adjacency relationships.

[0011] In a feasible implementation of the first aspect, when executing the step of obtaining code semantic features based on multiple code files, the multiple code files include a first code file, and the hardware Trojan detection method that fuses structural information and semantic information also includes: segmenting the first code file through a sliding window method to obtain multiple first segmented texts; inputting the multiple first segmented texts into a large language model to extract multiple semantic information; and merging the multiple extracted semantic information to obtain code semantic features.

[0012] In a feasible implementation of the first aspect, when executing the step of obtaining structural information based on node features and node adjacency relationships, the hardware Trojan detection method that fuses structural information and semantic information also includes: inputting node features and node adjacency relationships into a graph neural network model to obtain structural information; wherein, the graph neural network model includes a first-layer graph attention network, a second-layer graph attention network, a third-layer graph attention network, a fourth-layer graph attention network, a pooling layer and a readout layer that are arranged in sequence; the first-layer graph attention network, the second-layer graph attention network, the third-layer graph attention network and the fourth-layer graph attention network respectively add activation functions.

[0013] In a feasible implementation of the first aspect, when executing the step of determining the first file, the hardware Trojan detection method integrating structural information and semantic information further includes: determining the first file based on flattening processing.

[0014] In a feasible implementation of the first aspect, when executing the step of fusing structural information and code semantic features based on a cross-attention mechanism to obtain a target feature vector, the hardware Trojan detection method fusing structural information and semantic information also includes: generating a query matrix based on the first feature vector and the first weight corresponding to the structural information; generating a key matrix based on the second feature vector and the second weight corresponding to the code semantic feature; generating a value matrix based on the second feature vector and the third weight corresponding to the code semantic feature; and obtaining the target feature vector based on the query matrix, the key matrix and the value matrix.

[0015] In a feasible implementation of the first aspect, when executing the step of fusing structural information and code semantic features based on the cross-attention mechanism to obtain the target feature vector, the calculation formula of the cross-attention mechanism includes:

[0016]

[0017] Among them, U i Represented as the i-th single cross attention output value, h g Represented as the first eigenvector corresponding to the structural information; h t Represented as the second feature vector corresponding to the code semantic feature; W Q Represented as the first weight; W K Expressed as the second weight; W V It is represented as the third weight; Q is represented as the query matrix; K is represented as the key matrix; V is represented as the value matrix; d k represents the dimension of query and key vectors; h represents the number of heads; h f Expressed as the multi-head attention output value, h f The calculation formula includes h f =W o concate(U1, U2, ..., Uh ), concate(·) represents vector concatenation, W o Represented as a linear transformation matrix.

[0018] In the second aspect, an embodiment of the present application provides a hardware Trojan detection system that integrates structural information and semantic information. The hardware Trojan detection system that integrates structural information and semantic information includes: at least one processor; a memory that is communicatively connected to the at least one processor; wherein the memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the method provided in the first aspect.

[0019] The hardware Trojan detection system that integrates structural information and semantic information does not require manual processing to analyze suspicious signals or statements by executing the method provided in the first aspect, thereby reducing the manual burden and improving the degree of automation, thereby improving the hardware Trojan detection capability. The present application can directly detect various types of hardware Trojans (including unknown hardware Trojans) without relying on the setting of security attributes. At the same time, it does not face the problem of state space explosion. The present application does not rely on the golden model. Features are obtained from graphs and texts to capture more code information, thereby improving the detection accuracy.

[0020] In a third aspect, an embodiment of the present application provides a computer-readable medium having computer program instructions stored thereon, and the computer program instructions can be executed by a processor to implement the method provided in the first aspect.

[0021] The computer program instructions in the computer-readable medium implement the method provided in the first aspect, and do not require manual processing to analyze suspicious signals or statements, thereby reducing the manual burden and improving the degree of automation, thereby improving the hardware Trojan detection capability. The present application can directly detect various types of hardware Trojans (including unknown hardware Trojans) without relying on the setting of security attributes. At the same time, it does not face the problem of state space explosion. The present application does not rely on the golden model. Features are obtained from images and text to capture more code information, thereby improving detection accuracy. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Figure 1 A schematic diagram of the structure of a hardware Trojan detection system that integrates structural information and semantic information provided in an embodiment of the present application;

[0023] Figure 2 A flowchart of a hardware Trojan detection method that integrates structural information and semantic information provided in an embodiment of the present application;

[0024] Figure 3 A schematic diagram of the structure of an abstract syntax tree in a hardware Trojan detection method that integrates structural information and semantic information provided in an embodiment of the present application;

[0025] Figure 4 A schematic diagram of the structure of a graph neural network model and a sliding window in a hardware Trojan detection method that integrates structural information and semantic information provided in an embodiment of the present application. DETAILED DESCRIPTION

[0026] The technical solutions in the embodiments of the present invention will be described below in conjunction with the accompanying drawings in the embodiments of the present invention. In the description of the embodiments of the present invention, unless otherwise specified, "multiple" refers to two or more than two. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single items or plural items. For example, at least one of a, b, or c can represent: a, b, c, ab, ac, bc, or abc, where a, b, and c can be single or multiple.

[0027] In addition, in order to facilitate the clear description of the technical solutions of the embodiments of the present invention, in the embodiments of the present invention, words such as "first" and "second" are used to distinguish between identical or similar items with substantially the same functions and effects. Those skilled in the art will understand that words such as "first" and "second" do not limit the quantity and execution order, and words such as "first" and "second" do not necessarily limit differences. At the same time, in the embodiments of the present invention, words such as "exemplary" or "for example" are used to indicate examples, illustrations or explanations. Any embodiment or design scheme described as "exemplary" or "for example" in the embodiments of the present invention should not be interpreted as being more preferred or advantageous than other embodiments or design schemes. Specifically, the use of words such as "exemplary" or "for example" is intended to present related concepts in a concrete way for easy understanding.

[0028] The principles and features of the present application are described below. The examples given are only used to explain the present application and are not used to limit the scope of the present application.

[0029] The embodiment of the present application provides a hardware Trojan detection method that integrates structural information and semantic information, which is applicable to the integrated circuit industry. For example, the chip manufacturing industry. Through this method, Trojans can be detected during the chip design phase, thereby ensuring the security of chip design. The present application can directly detect various types of hardware Trojans (including unknown hardware Trojans) without relying on the setting of security attributes. At the same time, it does not face the problem of state space explosion. The present application does not rely on the golden model. Features are obtained from images and text to capture more code information, thereby improving detection accuracy.

[0030] The following describes in detail the hardware Trojan detection method that integrates structural information and semantic information provided in the embodiment of the present application, taking the application to RTL hardware as an example.

[0031] The embodiment of the present application provides a hardware Trojan detection system that integrates structural information and semantic information, which can execute the hardware Trojan detection method that integrates structural information and semantic information provided by the embodiment of the present application. Figure 1 A schematic diagram of the structure of a hardware Trojan detection system that integrates structural information and semantic information provided in an embodiment of the present application.

[0032] like Figure 1 As shown, the hardware Trojan detection system 001 that integrates structural information and semantic information includes at least one processor 011 and a memory 012 that is communicatively connected to the at least one processor; wherein the memory 012 stores instructions that can be executed by the at least one processor 011, and the instructions are executed by the at least one processor 011 so that the at least one processor 011 can execute the hardware Trojan detection method that integrates structural information and semantic information provided in an embodiment of the present application.

[0033] Figure 2 The flowchart of a hardware Trojan detection method that integrates structural information and semantic information is provided in an embodiment of the present application. Figure 2 As shown, in some embodiments, the hardware Trojan detection method that integrates structural information and semantic information includes the following steps:

[0034] S1, determining the first file.

[0035] The first file includes multiple code files for a chip design.

[0036] Merge multiple code files of the same chip design into one file as the first file, wherein the code file may be RTL code.

[0037] Exemplarily, a chip design includes multiple modules (e.g., a first module, a second module, and a third module), each of which corresponds to a code file. For example, the first module corresponds to a first sub-code file (e.g., mod1.v), the second module corresponds to a second sub-code file (e.g., mod2.v), and the third module corresponds to a third sub-code file (e.g., top_module.v). Merge "mod1.v," "mod2.v," and "top_module.v" to obtain a single "top_module.v" file.

[0038] In some embodiments, when executing step S1, the hardware Trojan detection method integrating structural information and semantic information further includes: determining the first file based on flattening processing. In one implementation, a python script is used to flatten each RTL code.

[0039] An example is given based on the flattening process.

[0040] The file contents of "mod1.v" are as follows:

[0041] module mod1(input a,output b);

[0042] / / module1 internal logic

[0043] endmodule

[0044] The file contents of "mod2.v" are as follows:

[0045] The contents of the mod2.v file are as follows:

[0046] module mod2(input x,output y);

[0047] / / module2 internal logic

[0048] endmodule

[0049] The file contents of "top_module.v" are as follows:

[0050] module top_module(input a,input x,output y);

[0051] wire temp;

[0052] mod1 u1(.a(a),.b(temp));

[0053] mod2 u2(.x(temp),.y(y));

[0054] endmodule

[0055] Based on the flattening process, the file contents of the "single top_module.v" file are as follows:

[0056] module mod1(input a,output b);

[0057] / / module1 internal logic

[0058] endmodule

[0059] module mod2(input x,output y);

[0060] / / module2 internal logic

[0061] endmodule

[0062] module top_module(input a,input x,output y);

[0063] mod1 u1(.a(a),.b(temp));

[0064] mod2 u2(.x(temp),.y(y));

[0065] endmodule

[0066] In this way, the Verilog code of the entire RTL design is flattened as a preprocessing method, which reduces the number of files that need to be processed and simplifies the subsequent processing process.

[0067] In some embodiments, there are multiple first files. A portion of the first files serves as a training set, and another portion of the files serves as a test set. Each first file can be a file derived from a single chip design. For example, the number of first files in the training set is 80, and the number of first files in the test set is 20. It will be appreciated that this application does not limit the number of first files in the training set or the test set.

[0068] S2: Building an abstract syntax tree based on the first file.

[0069] In some embodiments, the RTL code is modeled as an abstract syntax tree using the python language.

[0070] Here is a feasible implementation of RTL code:

[0071]

[0072]

[0073] like Figure 3 As shown, in some embodiments, an abstract syntax tree is built based on the flattened first file, avoiding the complex relationships between multiple files and modules, making the build process more direct and clear. The entire chip design is placed in a unified context, which facilitates design management and reduces potential issues caused by dependencies between files.

[0074] S3, extracts node features and node adjacency relationships based on the abstract syntax tree.

[0075] In some embodiments, when executing step S3, the hardware Trojan detection method integrating structural information and semantic information further includes:

[0076] S311, obtaining all node types of the abstract syntax tree.

[0077] There are many node types, and possible implementations are given below.

[0078] In one implementation, all node types include seventy-nine.

[0079] for example:

[0080] {'names','always','none','senslist','sens','identifier','nonblockingsubstitution','lvalue','rvalue','intconst','pointer','ifs tatement','purenumeric','assign','cond','unot','plus','land','reg','partselect','eq','lessthan','greaterthan','decl','wire','width','output','inpu t','moduledef','portarg','instancelist','source','description','port','portlist','ulnot','instance','or','and','lor','block','xor','ioport','block ingsubstitution','minus','times','casestatement','case','parameter','sll','srl','sra','divide','systemcall','singlestatement','stringconst','noteq ','concat','repeat','integer','xnor','dimensions','length','lconcat','uminus','greatereq','initial','uor','casexstatement','forstatement','localpar am','eventstatement','mod','delaystatement','floatconst','task','paramarg','paramlist','inout'}

[0081] In some embodiments, the abstract syntax tree built based on the first file may include at least one of the seventy-nine possible node types. For example, the node type may include 'names', 'always', or 'none'.

[0082] S312: Obtain node features through one-hot encoding according to the node type.

[0083] In some embodiments, when executing step S312, the hardware Trojan detection method integrating structural information and semantic information further includes:

[0084] S3121, assign a unique index value to each node type.

[0085] For example, when there are seventy-nine node types in total, each node type is sequentially assigned a unique index value from 0 to 78.

[0086] S3122: Generate node features based on the index value of the node type.

[0087] Node features, which can be node feature vectors.

[0088] For example, when the node type is 'assign', according to the seventy-nine node types provided in step S311, the index of 'assign' is 13. The feature vector of the node is a seventy-nine-dimensional vector, in which the thirteenth dimension (counting from 0) is 1 and the remaining dimensions are 0. For example: [0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0 ... This indicates that the node type is 'assign', and its feature vector has a value of 1 at index 13, with all other dimensions being 0. In summary, the feature vector of a node is generated by one-hot encoding the node type. Each node's feature vector is a one-dimensional array with a length of seventy-nine. It can be understood that "seventy-nine" represents the number of possible node types.

[0089] Through the above example, node feature vectors corresponding to all node types are generated. In this way, each node type is converted into a node feature vector of fixed length to facilitate subsequent processing or analysis.

[0090] In some embodiments, when executing step S3, the hardware Trojan detection method integrating structural information and semantic information further includes:

[0091] S321: Generate an adjacency matrix based on the abstract syntax tree to obtain node adjacency relationships.

[0092] The adjacency matrix describes the connection relationship between nodes in the abstract syntax tree structure and provides data support for subsequent structural analysis.

[0093] In some embodiments, by traversing all nodes in the abstract syntax tree, for each node, record which nodes it is directly connected to, and finally generate an adjacency matrix based on the recorded connection relationship. In one implementation, the adjacency matrix can be a two-dimensional matrix used to represent the connection relationship between nodes in the graph. In the adjacency matrix A of the graph, each element A[i][j] of the matrix represents whether there is a direct connection (edge) between node i and node j. Exemplarily, according to the feasible implementation method of establishing an abstract syntax tree provided in step S2, the root node "module" is connected to the nodes "port" and "always", so, And A[i module ][j others ]=0.

[0094] S4, based on node features and node adjacency relationships, obtains structural information.

[0095] In some embodiments, when executing step S4, the hardware Trojan detection method of fusing structural information and semantic information further includes:

[0096] S41, input the node features and node adjacency relationships into the graph neural network model to obtain structural information.

[0097] like Figure 4 As shown in the figure, the graph neural network model includes four layers of graph attention networks (GAT), namely the first layer of graph attention network, the second layer of graph attention network, the third layer of graph attention network, and the fourth layer of graph attention network. The graph neural network model also includes a pooling layer and a readout layer. The first layer of graph attention network, the second layer of graph attention network, the third layer of graph attention network, and the fourth layer of graph attention network are respectively added with an activation function (ReLU). In this way, each layer of the graph attention network is sequentially added with an activation function. After calculation by the four layers of graph attention network, it passes through a pooling layer and a readout layer.

[0098] S5, obtains code semantic features based on multiple code files.

[0099] In some embodiments, when executing step S5, the multiple code files include the first code file, and the hardware Trojan detection method integrating structural information and semantic information further includes:

[0100] S51, segmenting the first code file using a sliding window method to obtain a plurality of first segmented texts.

[0101] When processing RTL code, the sliding window method can effectively split the RTL code into blocks of uniform length for easy analysis, training and processing.

[0102] In some embodiments, when executing step S51, the multiple code files include the first code file, and the hardware Trojan detection method integrating structural information and semantic information further includes:

[0103] S511: Determine the window size based on the large language model.

[0104] In some embodiments, the large language model may be a jina-base-code. In one implementation, it supports 8192 grammatical structure minimum units (tokens) input. The maximum sequence length is set to 8192, that is, the window size is 8192.

[0105] S512 sets the sliding window stride to 4096. This means that each time the window slides, it moves backward by 4096 tokens.

[0106] S513: A sliding window is placed at the beginning of the RTL code. Each sliding window extracts a code block with a length of 8192 tokens.

[0107] S514: Slide the window backward according to the set stride.

[0108] Each time the window slides, a new code block of 8192 tokens is extracted. If the code block extracted in the last window is less than 8192 tokens, it is padded with 0 to a length of 8192 tokens.

[0109] By executing steps S511 to S514 , a first segmented text is obtained.

[0110] S52: Input the plurality of first segmented texts into a large language model to extract a plurality of semantic information.

[0111] It can be understood that the large language model in step S511 is the same model.

[0112] S53: Merge the multiple extracted semantic information to obtain code semantic features.

[0113] S6, based on the cross-attention mechanism, fuses structural information and code semantic features to obtain the target feature vector.

[0114] In some embodiments, when executing step S6, the hardware Trojan detection method integrating structural information and semantic information further includes:

[0115] S61: Generate a query matrix according to the first eigenvector and the first weight corresponding to the structural information.

[0116] S62: Generate a key matrix according to the second feature vector and the second weight corresponding to the code semantic feature.

[0117] S63: Generate a value matrix according to the second eigenvector and the third weight corresponding to the code semantic feature.

[0118] S64, obtaining a target feature vector based on the query matrix, the key matrix, and the value matrix.

[0119] In some embodiments, the calculation formula of the cross-attention mechanism includes:

[0120]

[0121] Among them, U i Represented as the i-th single cross attention output value, h g Represented as the first eigenvector corresponding to the structural information; h t Represented as the second feature vector corresponding to the code semantic feature; W Q Represented as the first weight; W K Expressed as the second weight; W V It is represented as the third weight; Q is represented as the query matrix; K is represented as the key matrix; V is represented as the value matrix; d k represents the dimension of query and key vectors; h represents the number of heads; h f Expressed as the multi-head attention output value, h f The calculation formula includes h f =W o concate(U1, U2, ..., U h ), concate(·) represents vector concatenation, W o Represented as a linear transformation matrix.

[0122] In one implementation, h is set to 8.

[0123] S7, based on the target feature vector, trains the hardware Trojan detection model.

[0124] In some embodiments, when executing step S7, the hardware Trojan detection method integrating structural information and semantic information further includes:

[0125] S71, input the fused feature vector into the training model for training to obtain the code detection result.

[0126] S72, according to the loss function, calculate the loss between the predicted result and the actual result, and use the back propagation algorithm to optimize the model parameters.

[0127] Among them, the loss function L formula is as follows:

[0128] L=L cross +αL kl ;

[0129]

[0130] L kl =KL(h g ||h t );

[0131] Among them, L cross is the cross entropy loss function, which is used to evaluate the difference between the model prediction results and the actual results, y pred is the predicted value, y true is the true value, L kl is the alignment loss, which is used to measure the difference between the two modal vectors, h g is the structural characteristic vector, h t is the semantic feature vector, α is a hyperparameter, and its value in this example is 0.5.

[0132] S73, repeat the training process and finally obtain the optimized model for actual code detection tasks.

[0133] The training process is to minimize the value of the loss function L.

[0134] In some embodiments, the code detection results are obtained through a classifier, and then the loss is calculated and backpropagation is performed based on the detection results to update the model weights, thereby improving the model effect and finally obtaining a trained model.

[0135] S8, inputting the code to be tested into the hardware Trojan detection model to obtain the Trojan detection result.

[0136] y pred =softmax(MLP(h f ));

[0137] Among them, y pred is the prediction result, h f The MLP layer outputs the predicted probabilities of the two categories for the fused feature vector. At the same time, the present invention applies the Softmax function to normalize the predicted values and takes the category with the highest predicted probability as the final detection result.

[0138] This application does not require manual processing to analyze suspicious signals or statements, reduces the manual burden, improves the degree of automation, and thus improves the hardware Trojan detection capability.

[0139] This application can directly detect various types of hardware Trojans (including unknown ones) without relying on security attribute settings. It also avoids the state space explosion problem. It does not rely on golden models. It extracts features from graphs and text to capture more code information, thereby improving detection accuracy.

[0140] The following describes the verification results of the hardware Trojan detection method that integrates structural information and semantic information provided in this application.

[0141] Table 1 shows the experimental results. As shown in Table 1, the embodiment of the present application adopts the leave-one-out cross-validation method. The core of this method is to set aside the basic circuit of a chip as a test set each time, and use the remaining circuits for model training to test the model's detection effect on unknown Trojans.

[0142]

[0143] Among them, accuracy (A) reflects the correctness of the model's overall prediction, that is, the proportion of correctly classified samples; precision (P) measures the proportion of samples predicted by the model as positive that are actually positive examples; recall (R) indicates the ratio of the number of positive examples correctly identified by the model to the total number of true positive examples; F1 score (F1 score) is a comprehensive indicator that comprehensively considers precision and recall, and evaluates the balance between accuracy and recall of the model.

[0144] Among them, TP (True Positive), TN (True Negative), FN (False Negative) and FP (False Positive) represent the four basic results of the model in prediction.

[0145] Table 1 Experimental results of the embodiment

[0146] Test circuit A(％) P(％) R(％) F1 Score (%) AES 82.14 100 81.48 89.80 RS232 93.33 100 92.86 96.30 PIC 100 100 100 100 DES 100 100 100 100 Average 93.87 100 93.58 96.53

[0147] As can be seen from Table 1, in this embodiment, the average accuracy, precision, recall rate, and F1 value of detecting hardware Trojans are 93.87%, 100%, 93.58%, and 96.53%, respectively, indicating that this model performs well in detecting unknown Trojans.

[0148] At the same time, Table 2 shows the time required for model training and verification.

[0149] Table 2 Model training and detection time in the embodiment

[0150] Test circuit Training time (s) Test time (s) AES 136.696 0.403 RS232 161.381 0.411 PIC 170.712 0.436 DES 171.277 0.413 Average 160.017 0.416

[0151] Table 2 shows that after a relatively long training period, the model can complete hardware Trojan detection in a significantly shorter time. This model is less complex and consumes less time and computational resources.

[0152] In summary, in this embodiment, the present invention overcomes the limitations of previous methods and achieves better detection effects.

[0153] Based on the same application concept, an embodiment of the present application also provides a hardware Trojan detection system that integrates structural information and semantic information. The method corresponding to the hardware Trojan detection system that integrates structural information and semantic information can be the hardware Trojan detection method that integrates structural information and semantic information in the aforementioned embodiment, and its principle of solving the problem is similar to that of the method. The hardware Trojan detection system that integrates structural information and semantic information provided in the embodiment of the present application includes: at least one processor; and a memory that is communicatively connected to the at least one processor; wherein the memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the methods and / or technical solutions of the aforementioned multiple embodiments of the present application.

[0154] Another embodiment of the present application further provides a computer-readable storage medium having computer program instructions stored thereon, which can be executed by a processor to implement the methods and / or technical solutions of any one or more embodiments of the present application.

[0155] Specifically, the present embodiment can adopt any combination of one or more computer-readable media. The computer-readable medium can be a computer-readable signal medium or a computer-readable storage medium. The computer-readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or component, or any combination thereof. More specific examples (non-exhaustive list) of computer-readable storage media include: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In this document, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device.

[0156] A computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, which carries computer-readable program code. This propagated data signal may take a variety of forms, including, but not limited to, electromagnetic signals, optical signals, or any suitable combination thereof. A computer-readable signal medium may also be any computer-readable medium other than a computer-readable storage medium that can transmit, propagate, or transport a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0157] Program code embodied on a computer readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[0158] Computer program code for performing the operations of the present application can be written in one or more programming languages, or a combination thereof, including object-oriented programming languages such as Java, Smalltalk, C++, and conventional procedural programming languages such as "C" or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a stand-alone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computer (e.g., through the Internet using an Internet service provider).

[0159] The secondary flow chart or block diagram in the accompanying drawings shows the possible architecture, function and operation of the device, method and computer program product according to various embodiments of the present application. In this regard, each box in the secondary flow chart or block diagram can represent a module, program segment or a part of code, and the module, program segment or a part of code contains one or more executable instructions for realizing the logical function of the specification. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a sequence different from that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or secondary flow chart, and the combination of the boxes in the block diagram and / or secondary flow chart can be implemented with a dedicated system for hardware that performs the specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0160] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0161] In the several embodiments provided in this application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or page components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0162] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this embodiment according to actual needs.

[0163] In addition, the functional units in the various embodiments of the present application may be integrated into a single processing unit, or each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or in the form of hardware plus software functional units.

[0164] The above-mentioned integrated unit implemented in the form of a software functional unit can be stored in a computer-readable storage medium. The above-mentioned software functional unit is stored in a storage medium and includes a number of instructions for causing a computer device (which can be a personal computer, server, or network device, etc.) or a processor to execute some steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and other media that can store program code.

[0165] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.

[0166] Furthermore, it is clear that the word "comprising" does not exclude other units or steps, and the singular does not exclude the plural. Multiple units or devices recited in a device claim may also be implemented by a single unit or device through software or hardware. Terms such as "first" and "second" are used to indicate names and do not imply any particular order.

Claims

1. A hardware Trojan detection method that integrates structural information and semantic information, characterized in that: include: Identify the first file; The first file is obtained by merging multiple code files of a chip design through module merging and hierarchical flattening, and includes the instance name, port binding relationship and signal driving path of each module to build a signal interaction context covering the entire design; the code file includes register transfer level code; Based on the first file, an abstract syntax tree is established; and according to the abstract syntax tree, node features and node adjacency relationships are extracted; Input the node features and node adjacency relationships into the graph neural network model, and obtain the embedded representation of each node through multiple rounds of information propagation and aggregation; aggregate the embedded representations of each node to obtain structural information; Based on the multiple code files, a pre-trained large language model that supports code semantic modeling is used, and the multiple code files are segmented in combination with a sliding window mechanism to obtain multiple local semantic features; Obtain the global semantic feature vector through feature optimization operation and obtain the code semantic features; The feature optimization operation includes splicing; Based on a cross-attention mechanism, the structural information and the code semantic features are fused to obtain a target feature vector; the cross-attention mechanism adopts a multi-head attention structure, takes the structural information as a query and the semantic feature vector as a key and value, and outputs a fused multimodal representation vector to obtain the target feature vector; Training a hardware Trojan detection model based on the target feature vector; Inputting the code to be tested into the hardware Trojan detection model to obtain a hardware Trojan detection result; The step of establishing an abstract syntax tree based on the first file includes: Extracting construction units with structural semantics; the construction units include module definition, port declaration, signal declaration, module instantiation, conditional control statements and sequential logic blocks, The construction units are used as graph nodes, and syntax nesting edges, signal driving edges and module instantiation edges are constructed according to syntax nesting relationships, signal driving relationships and module calling relationships to generate multiple structure graphs; The multiple structure graphs are merged into the abstract syntax tree to model the hierarchical structure, signal propagation path and timing behavior of the first file.

2. The hardware Trojan detection method based on the fusion of structural information and semantic information according to claim 1 is characterized in that: When performing the step of extracting node features and node adjacency relationships according to the abstract syntax tree, the hardware Trojan detection method integrating structural information and semantic information further includes: Obtain all node types of the abstract syntax tree; According to the node type, the node feature is obtained by one-hot encoding.

3. The hardware Trojan detection method based on the fusion of structural information and semantic information according to claim 1 or 2, characterized in that: When performing the step of extracting node features and node adjacency relationships according to the abstract syntax tree, the hardware Trojan detection method integrating structural information and semantic information further includes: Based on the abstract syntax tree, an adjacency matrix is generated to obtain the node adjacency relationship.

4. The hardware Trojan detection method based on the fusion of structural information and semantic information according to claim 1 or 2, characterized in that: When performing the step of obtaining code semantic features based on the multiple code files, the multiple code files include a first code file, and the hardware Trojan detection method of fusing structural information and semantic information further includes: Segmenting the first code file using a sliding window method to obtain a plurality of first segmented texts; Inputting the plurality of first segmented texts into a large language model to extract a plurality of semantic information; The multiple semantic information are combined to obtain the code semantic feature.

5. The hardware Trojan detection method based on the fusion of structural information and semantic information according to claim 1 or 2, characterized in that: The graph neural network model includes a first-layer graph attention network, a second-layer graph attention network, a third-layer graph attention network, a fourth-layer graph attention network, a pooling layer and a readout layer, which are arranged in sequence; the first-layer graph attention network, the second-layer graph attention network, the third-layer graph attention network and the fourth-layer graph attention network respectively add activation functions, and all node representations are aggregated through a layer of graph readout layer to form a structural representation of the entire code.

6. The hardware Trojan detection method based on the fusion of structural information and semantic information according to claim 1 or 2, characterized in that: When executing the step of determining the first file, the hardware Trojan detection method integrating structural information and semantic information further includes: determining the first file based on flattening processing.

7. The hardware Trojan detection method based on the fusion of structural information and semantic information according to claim 1 or 2, characterized in that: When executing the step of fusing the structural information and the code semantic features based on the cross-attention mechanism to obtain a target feature vector, the hardware Trojan detection method for fusing structural information and semantic information further includes: generating a query matrix according to the first eigenvector and the first weight corresponding to the structural information; Generate a key matrix according to the second feature vector and the second weight corresponding to the code semantic feature; generating a value matrix according to the second eigenvector and the third weight corresponding to the code semantic feature; The target feature vector is obtained based on the query matrix, the key matrix and the value matrix.

8. The hardware Trojan detection method based on the fusion of structural information and semantic information according to claim 7 is characterized in that: When executing the step of fusing the structural information and the code semantic features based on the cross attention mechanism to obtain the target feature vector, the calculation formula of the cross attention mechanism is include: Among them, U i Represented as the i-th single cross attention output value, h g Represented as the first eigenvector corresponding to the structural information; h t Represented as the second feature vector corresponding to the code semantic feature; W Q Represented as the first weight; W K Expressed as the second weight; W V It is represented as the third weight; Q is represented as the query matrix; K is represented as the key matrix; V is represented as the value matrix; d k represents the dimension of query and key vectors; h represents the number of heads; h f Expressed as the multi-head attention output value, h f The calculation formula includes h f =W o concate(U1, U2, ..., U h ), concate(·) represents vector concatenation, W o Represented as a linear transformation matrix.

9. A hardware Trojan detection system that integrates structural information and semantic information, characterized in that: include: at least one processor; a memory communicatively coupled to the at least one processor; The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method according to any one of claims 1 to 8.

10. A computer-readable medium having computer program instructions stored thereon, wherein the computer program instructions can be executed by a processor to implement the method according to any one of claims 1 to 8.

Images