Multi-task interpretable hardware Trojan horse detection method and system based on graph attention mechanism

Abstract

The invention discloses a multi-task interpretable hardware Trojan horse detection method and system based on a graph attention mechanism, and belongs to the field of integrated circuit hardware safety. The method comprises the following steps: analyzing a gate-level netlist, abstracting the gate-level netlist into a directed graph, and extracting node features; the multi-head graph attention network is used for learning nodes and embedding representation of the graph; node-level Trojan classification and graph-level risk classification are executed at the same time through a multi-task learning framework, and joint optimization training is carried out; based on probability distribution output by the model, calculating a hazard severity risk value and a triggering score in combination with a preset risk assessment function, and fusing to obtain a comprehensive risk score; and for the high-risk netlist, the feature contribution degree is quantified by adopting GNNExplainer, an evidence chain is constructed, and a large language model is driven to generate an interpretable report containing risk composition, key evidence and an abnormal mode. According to the method, high-precision Trojan horse detection and fine-grained risk assessment are realized, an intuitive and credible decision basis is provided, and the practicability and interpretability of a detection result are remarkably improved.

Description

Technical Field

[0001] This invention relates to the field of integrated circuit hardware security technology, and in particular to a multi-task interpretable hardware Trojan detection method and system based on graph attention mechanism. Background Technology

[0002] With the globalization of integrated circuits and the increasing complexity of design and manufacturing processes, hardware trojans have become one of the core threats to supply chain security. Hardware trojans are hidden structures maliciously implanted in circuits. When activated under specific conditions, they can lead to information leakage, functional errors, performance degradation, or system attacks.

[0003] Existing machine learning-based detection methods represent circuit netlists as graph structures and process them using graph neural networks. However, existing GNN methods mostly focus on achieving high accuracy in binary classification, which has two limitations: first, they lack fine-grained assessment of Trojan risks and cannot distinguish between hazard types and severity levels; second, the model decision-making process is opaque, resulting in low reliability of detection results and making it difficult to provide effective decision support for security analysts. Summary of the Invention

[0004] In view of this, the purpose of this invention is to provide a multi-task interpretable hardware Trojan detection method and system based on graph attention mechanism. Through a multi-task learning framework, it can simultaneously achieve accurate localization of Trojan nodes and fine-grained classification of graph-level risks. Furthermore, it integrates interpretable artificial intelligence technology to generate an easy-to-understand security analysis report, thereby effectively improving the reliability, practicality, and decision support capabilities of the detection results.

[0005] To achieve the above objectives, the present invention adopts the following technical solution: a multi-task interpretable hardware Trojan detection method based on graph attention mechanism, comprising the following steps:

[0006] Step S1: For the input gate-level netlist description file, parse and abstract it into a directed graph. and adjacency matrix For directed graphs Each logic gate unit node in Extracting the initial feature vector The initial feature matrix is ​​formed by stacking the initial feature vectors of all nodes. ;

[0007] Step S2: Input the initial feature matrix and adjacency matrix into the multi-head graph attention network, and then... Layer propagation yields the final hidden state of the final node. Graph-level vectors are generated through a global pooling function. ;

[0008] Step S3: Based on the final hidden vector of each node Graph-level vectors of netlists Perform node-level Trojan classification and graph-level risk classification tasks respectively, and calculate the joint loss function of the multi-task tasks. Joint optimization training of the model;

[0009] Step S4: For the newly input netlist file, construct the graph structure and feature matrix according to steps S1-S3, input them into the trained model, obtain the node-level classification results, the prediction probability of the major hazard category, and the prediction probability of the minor severity category. Combined with the preset risk assessment function, calculate the hazard severity risk value of the netlist. and triggerability score Then, a weighted fusion is performed to obtain a comprehensive risk score. ;

[0010] Step S5: For the netlists identified as high-risk in Step S4, the GNNExplainer method is used to optimize an explanatory subgraph that maximizes the mutual information with the model prediction results. This is used to quantify the contribution of features to the prediction, and based on the feature contribution and the large model LLM, interpretable results containing risk composition, key evidence and anomalous patterns are generated.

[0011] In a preferred embodiment, step S1 specifically includes the following steps:

[0012] Step S1.1: For the gate-level netlist description file Parse and abstract into a directed graph and adjacency matrix Used to represent logical connections in a netlist:

[0013]

[0014]

[0015] ,in

[0016] in, The graph abstraction mapping function performs netlist parsing, mapping all gate cell instances and signal connections to nodes. and edge , This represents all logic gate cell instances in the corresponding netlist. This represents the signal connection lines between logic gate units in the corresponding gate-level netlist. and Represents a directed graph The first in The and the first An instance of a logic gate, Represents a directed graph The total number of logic gate nodes;

[0017] Step S1.2, for the graph Each node in Extract its inherent logic gate fundamental features :

[0018]

[0019] in, Represents a node Unit gate type encoding, and Representing nodes respectively The number of fan-in and fan-out, represents the normalization function, and || represents feature connectivity;

[0020] Step S1.3, Calculation diagram Topological features in :

[0021]

[0022]

[0023]

[0024]

[0025] in, It is a node The control path distance feature represents the node. Compared to the logical depth of the main input and key nodes, It is a node Logical layer depth Represents the maximum value function. It is a node The forward input node, It is a node The set of forward input nodes, It is a node The betweenness centrality characteristic of a node represents the betweenness centrality characteristic of a node. Is it on the critical path from the main input to the main output in the circuit?

[0026] Step S1.4, Calculation diagram Global features in :

[0027]

[0028] in, This indicates the number of rare logic gate units. Indicates the number of rare connection signal lines;

[0029] Step S1.5: Concatenate the basic features of the logic gates, the topological features, and the global features of each node into a complete feature vector. ,picture All of them The feature vectors of each node are vectorized and stacked as follows: ;

[0030]

[0031]

[0032] in, This represents the complete feature vector of the first node. This represents the complete feature vector of the second node. Indicates the first The complete feature vector of each node express Feature dimensions, express The feature dimensions.

[0033] In a preferred embodiment, step S2 specifically includes the following steps:

[0034] Step S2.1: Initialize the feature matrix and adjacency matrix Input into graph attention network for:

[0035]

[0036] Updated Hidden state of layer nodes for:

[0037]

[0038] in, This represents the activation function. Indicates the first Layer nodes To the node Attention weights It is a learnable linear transformation matrix. Indicates the first Layer nodes The hidden state;

[0039] pass The final hidden state matrix of all nodes after message propagation in a layered graph attention network. for:

[0040]

[0041] in, Indicates matrix transpose. Indicates the first Layer nodes The final hidden state vector, Indicates the first Layer nodes The final hidden state vector, Indicates the first Layer nodes The final hidden state vector;

[0042] Step S2.2: Perform global pooling on the final hidden state matrix to generate graph-level embedding vectors representing the semantics of the entire netlist. :

[0043]

[0044] in, Indicates the first Layer nodes The final hidden state vector, It is a graph-level embedding vector Dimensions.

[0045] In a preferred embodiment, step S3 specifically includes the following steps:

[0046] Step S3.1, for each node to hide its final vector Input into a shared fully connected classification head to predict Trojan nodes;

[0047]

[0048] in, This represents the sigmoid activation function. To predict probability values, and These are the weight matrix and bias term of the node classifier, respectively; when At that time, identify the node If it is a Trojan node, otherwise it is considered a node. For normal nodes, among which It is a configurable parameter. ;

[0049] Step S3.2: Embed the graph-level vector The input is fed into two independent fully connected classifiers to achieve graph-level risk classification:

[0050]

[0051] in, This represents the probability distribution of major categories of Trojan horse threats. and These are the weight matrix and bias term of the hazard category classifier, respectively;

[0052]

[0053] in, The probability distribution representing the severity category. and These are the weight matrix and bias term of the severity subclass classifier, respectively;

[0054] Step S3.3: Calculate the joint loss function for multiple tasks. Joint optimization training of the model:

[0055]

[0056]

[0057]

[0058]

[0059] in, The cross-entropy loss value for binary classification of nodes. The loss value is the category of harm. The loss value for severity subclass classification. For nodes The true label, and These are the one-hot codes for the actual labels of the graph-level hazard categories and severity subcategories, respectively. These are learnable weight coefficients. It is the total number of categories within the major harm categories. This is the total number of categories in the severity subclass. It is the category index value for calculating the loss of major hazard categories. It is the category index value used to calculate the severity subclass loss.

[0060] In a preferred embodiment, step S4 specifically includes the following steps:

[0061] Step S4.1: Predict the probability distribution of hazard categories based on model output. Predicted probability distribution of severity subclasses Combined with preset weights for the harmfulness of various Trojans Severity weight Calculate the severity risk value of the hazard in the netlist. ;

[0062]

[0063] in, This indicates the total number of categories within the major hazard category. This indicates the total number of severity subcategories. This is the weight value of the severity subclass, used to reduce the proportion of risk values ​​in the severity subclass. Reflecting the safety impact level of Category 1 hazards, Reflecting the safety impact level of Category 2 hazards, Reflecting the Safety impact level of the hazard Reflecting the Safety impact level of the hazard The security impact level reflects the severity of Category 1. Safety impact values ​​reflecting Category 2 severity Reflecting the Security impact level of severity Reflecting the Security impact level of severity It is the category index value;

[0064] Step S4.2: Predict the probability of the node-level Trojan horse based on the model output. and judgment threshold Construct a set of Trojan logic gate nodes :

[0065]

[0066] For each Trojan node Extract the complete feature vector constructed in step S1. It is then decomposed into sub-features to calculate the triggerability score. ;

[0067] The deeper the logic of a Trojan node, the harder it is to trigger. The triggerability score for the logic depth of all Trojan nodes. Represented as:

[0068]

[0069] in, This represents the total number of nodes in the Trojan horse logic gate node set;

[0070] The more fan-ins a Trojan node has, the harder it is to trigger. The triggerability score for the fan-in complexity of all Trojan nodes... Represented as:

[0071]

[0072] Trojan nodes are more easily triggered on the critical path; critical path triggerability score for all Trojan nodes. Represented as:

[0073]

[0074] The more rare a Trojan's trigger signal or logic gate is, the harder it is to trigger. This is reflected in the rarity and triggerability score of all Trojan nodes. Represented as:

[0075]

[0076] Taking into account logic depth, fan-in complexity, critical path coverage, and rarity, the triggerability score is... Represented as:

[0077]

[0078]

[0079] in, , , , These are non-negative weighting coefficients, which can be preset based on the application scenario or obtained through historical data analysis;

[0080] Step S4.3: Weighted fusion of hazard severity risk value and triggerability score to obtain comprehensive risk score. ;

[0081]

[0082] in The fusion coefficient is an adjustable parameter used to balance the importance of "severity of harm" and "triggerability".

[0083] In a preferred embodiment, step S5 specifically includes the following steps:

[0084] Step S5.1: By analyzing the adjacency matrix Apply a continuous edge importance mask matrix Obtain the interpretation subgraph ;

[0085]

[0086] in, , express Matrix dimension It is the Hadamard product operator, used for element-wise multiplication of two matrices;

[0087] By analyzing the original node feature matrix Apply a continuous feature importance mask matrix The feature matrix after obtaining the mask ;

[0088]

[0089]

[0090] in, It is a learnable parameter matrix. express Matrix dimension express Nodes in the matrix The eigencomponents of dimension, express Middle node The The values ​​of each feature component after sigmoid optimization, i.e., the node The Each feature component affects the model's predicted value. Importance weights;

[0091] GNNExplainer generates explanations by optimizing the following objective function:

[0092]

[0093]

[0094] in, It is the predicted probability output by the multi-task graph attention network. Indicates mutual information, Represents information entropy. This represents the category index with the highest predicted value among the major hazard categories. This represents the category index with the highest predicted value among the severity subcategories;

[0095] Step S5.2: Extract key evidence from both node and global levels to construct a structured chain of evidence. ;

[0096]

[0097] in, It is a set of key node-level evidence, containing the key features associated with each Trojan node and their corresponding feature importance scores. For graph-level key evidence combination, it includes the most important feature-node pairs and their corresponding feature importance scores globally;

[0098]

[0099] in, Represents the set of key feature indices, which are nodes. Select the one with the highest absolute value of importance score Index of features, It is a key feature importance score vector, quantifying the importance of each key feature to the node. Contribution of classification It is the number of features with the highest absolute value of importance score. These represent the first major feature with the highest absolute value of importance score. These represent the numbers with the highest absolute values ​​of importance scores. Major features These represent the numbers with the highest absolute values ​​of importance scores. Major features Represents a node The The importance weights of each feature component for node-level risk prediction Represents a node The The importance weights of each feature component for node-level risk prediction Represents a node The The importance weights of each feature component for node-level risk prediction Represents the absolute value function;

[0100]

[0101] in, Represents a node The eigenvector of the first One portion, Represents a node The One characteristic, Represents a node The One characteristic, Represents a node The One characteristic, Represents a node The One characteristic, Represents a node The The importance weights of each feature component for graph-level risk classification prediction Represents the set of global key features - node pairs. This represents the maximum number of key feature-node pairs across the entire graph. Represents a node The The importance weights of each feature component for node-level risk prediction Represents a node The The importance weights of each feature component for node-level risk prediction Represents a node The The importance weight of each feature component to node-level risk prediction;

[0102] Step S5.3: Establish the chain of evidence. The model prediction results and the metadata of the netlist are input into the large language model to generate an interpretability report;

[0103]

[0104]

[0105] in, For the data tuples input into the large model, Represents a netlist file metadata, It can be customized according to specific application scenarios. The specific content includes netlist identifier information, source information, belonging to the process library and scale structure. It is a prompt word processing function. The final output is an interpretable report that includes the risk profile, key evidence, and a summary of unusual patterns.

[0106] This invention also provides a multi-task interpretable hardware Trojan detection system based on graph attention mechanism, including: a graph feature extraction module, a graph attention network module, a multi-task joint optimization module, a risk fusion and reasoning module, a GNNExplainer interpretation module, and an LLM report generation module; the modules work together to achieve the multi-task interpretable hardware Trojan detection method based on graph attention mechanism as described above.

[0107] Compared with the prior art, the present invention has the following beneficial effects:

[0108] (1) This invention uses a multi-task learning framework to simultaneously achieve accurate location of Trojan nodes and graph-level risk classification, enabling simultaneous Trojan location, hazard type detection, and hazard severity assessment. Compared to existing single-dimensional detection methods, the analysis results output by this invention are more comprehensive and have higher usability.

[0109] (2) This invention integrates GNNExplainer and large language model, which can transform the decision basis of the model into a structured chain of evidence and an easy-to-understand natural language report, giving the reasons for high-risk judgment, key circuit features and their contribution. Compared with existing detection methods, this invention not only reduces the ambiguity of the model's "black box" decision, but also realizes the verifiability and interpretability of the model training features by extracting the contribution of node features.

[0110] (3) This invention uses a dual-track quantization mechanism to calculate the triggerability score using the training features input into the model, and combines the risk value of the Trojan's harm and severity classification to define the risk value of the Trojan network list. Compared with existing binary classification detection methods, this invention achieves a multi-dimensional comprehensive risk assessment of the Trojan network list, avoiding the shortcomings of binary classification methods in judging high-risk Trojans. Attached Figure Description

[0111] Figure 1 This is a flowchart of the method and system according to an embodiment of the present invention;

[0112] Figure 2 This is a schematic diagram of the evidence chain generation process of the GNNExplainer method in an embodiment of the present invention. Detailed Implementation

[0113] The present invention will be further described below with reference to the accompanying drawings and embodiments.

[0114] It should be noted that the following detailed descriptions are illustrative and intended to provide further explanation of this application. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application pertains.

[0115] It should be noted that the terminology used herein is for the purpose of describing particular implementations only and is not intended to limit the exemplary implementations according to this application; as used herein, the singular form is intended to include the plural form as well, unless the context clearly indicates otherwise; furthermore, it should be understood that when the terms “comprising” and / or “including” are used in this specification, they indicate the presence of features, steps, operations, devices, components and / or combinations thereof.

[0116] like Figure 1-2As shown, this embodiment provides a multi-task interpretable hardware Trojan detection system based on graph attention mechanism, including the following steps:

[0117] Step S1: For the input gate-level netlist description file, parse and abstract it into a directed graph. and adjacency matrix For the graph Each logic gate unit node in Extracting the initial feature vector The initial feature matrix is ​​formed by stacking the initial feature vectors of all nodes. .

[0118] In this embodiment, step S1 specifically includes the following steps:

[0119] Step S1.1: For the gate-level netlist description file Parse and abstract into a directed graph and adjacency matrix Used to represent logical connections in a netlist:

[0120]

[0121]

[0122] ,in

[0123] in, The graph abstraction mapping function performs netlist parsing, mapping all gate cell instances and signal connections to nodes. and edge , This represents all logic gate cell instances in the corresponding netlist. This represents the signal connection lines between logic gate units in the corresponding gate-level netlist. and Represents a directed graph The first in The and the first An instance of a logic gate, Represents a directed graph The total number of logic gate nodes;

[0124] Step S1.2, for the graph Each node in Extract its inherent logic gate fundamental features :

[0125]

[0126] in, Represents a node Unit gate type encoding, and Representing nodes respectively The number of fan-in and fan-out, represents the normalization function, and || represents feature connectivity;

[0127] Step S1.3, Calculation diagram Topological features in :

[0128]

[0129]

[0130]

[0131]

[0132] in, It is a node The control path distance feature represents the node. Compared to the logical depth of the main input and key nodes, It is a node Logical layer depth Represents the maximum value function. It is a node The forward input node, It is a node The set of forward input nodes, It is a node The betweenness centrality characteristic of a node represents the betweenness centrality characteristic of a node. Is it on the critical path from the main input to the main output in the circuit?

[0133] Step S1.4, Calculation diagram Global features in :

[0134]

[0135] in, This indicates the number of rare logic gate units. Indicates the number of rare connection signal lines;

[0136] Step S1.5: Concatenate the basic features of the logic gates, the topological features, and the global features of each node into a complete feature vector. ,picture All of them The feature vectors of each node are vectorized and stacked as follows: ;

[0137]

[0138]

[0139] in, This represents the complete feature vector of the first node. This represents the complete feature vector of the second node. Indicates the first The complete feature vector of each node express Feature dimensions, express The feature dimensions.

[0140] Step S2: Input the initial feature matrix and adjacency matrix into the multi-head graph attention network. In the middle, after Layer propagation yields the final hidden state of the final node. Graph-level vectors are generated through a global pooling function. ;

[0141] In this embodiment, step S2 specifically includes the following steps:

[0142] Step S2.1: Initialize the feature matrix and adjacency matrix Input into graph attention network In the middle, let the 0th layer be a hidden state. for:

[0143]

[0144] Updated Hidden state of layer nodes for:

[0145]

[0146] in, This represents the activation function. Indicates the first Layer nodes To the node Attention weights It is a learnable linear transformation matrix. Indicates the first Layer nodes The hidden state;

[0147] pass The final hidden state matrix of all nodes after message propagation in a layered graph attention network. for:

[0148]

[0149] in, Indicates matrix transpose. Indicates the first Layer nodes The final hidden state vector, Indicates the first Layer nodes The final hidden state vector, Indicates the first Layer nodes The final hidden state vector;

[0150] Step S2.2: Perform global pooling on the final hidden state matrix to generate graph-level embedding vectors representing the semantics of the entire netlist. :

[0151]

[0152] in, Indicates the first Layer nodes The final hidden state vector, It is a graph-level embedding vector The dimension;

[0153] Step S3: Based on the final hidden vector of each node Graph-level vectors of netlists Perform node-level Trojan classification and graph-level risk classification tasks respectively, and calculate the joint loss function of the multi-task tasks. The model is then jointly optimized and trained.

[0154] In this embodiment, step S3 specifically includes the following steps:

[0155] Step S3.1, for each node to hide its final vector Input into a shared fully connected classification head to predict Trojan nodes;

[0156]

[0157] in, This represents the sigmoid activation function. To predict probability values, and These are the weight matrix and bias term of the node classifier, respectively; when At that time, identify the node If it is a Trojan node, otherwise it is considered a node. For normal nodes, among which It is a configurable parameter. ;

[0158] Step S3.2: Embed the graph-level vector The input is fed into two independent fully connected classifiers to achieve graph-level risk classification:

[0159]

[0160] in, This represents the probability distribution of major categories of Trojan horse threats. and These are the weight matrix and bias term of the hazard category classifier, respectively;

[0161]

[0162] in, The probability distribution representing the severity category. and These are the weight matrix and bias term of the severity subclass classifier, respectively;

[0163] Step S3.3: Calculate the joint loss function for multiple tasks. Joint optimization training of the model:

[0164]

[0165]

[0166]

[0167]

[0168] in, The cross-entropy loss value for binary classification of nodes. The loss value is the category of harm. The loss value for severity subclass classification. For nodes The true label, and These are the one-hot codes for the actual labels of the graph-level hazard categories and severity subcategories, respectively. These are learnable weight coefficients. It is the total number of categories within the major harm categories. This is the total number of categories in the severity subclass. It is the category index value for calculating the loss of major hazard categories. It is the category index value used to calculate the severity subclass loss.

[0169] Step S4: For the newly input netlist file, construct the graph structure and feature matrix according to steps S1-S3, input them into the trained model, obtain the node-level classification results, the prediction probability of the major hazard category, and the prediction probability of the minor severity category. Combined with the preset risk assessment function, calculate the hazard severity risk value of the netlist. and triggerability score Then, a weighted fusion is performed to obtain a comprehensive risk score. .

[0170] In this embodiment, step S4 specifically includes the following steps:

[0171] Step S4.1: Predict the probability distribution of hazard categories based on model output. Predicted probability distribution of severity subclasses Combined with preset weights for the harmfulness of various Trojans Severity weight Calculate the severity risk value of the hazard in the netlist. ;

[0172]

[0173] in, This indicates the total number of categories within the major hazard category. This indicates the total number of severity subcategories. This is the weight value of the severity subclass, used to reduce the proportion of risk values ​​in the severity subclass. Reflecting the safety impact level of Category 1 hazards, Reflecting the safety impact level of Category 2 hazards, Reflecting the Safety impact level of the hazard Reflecting the Safety impact level of the hazard The security impact level reflects the severity of Category 1. Safety impact values ​​reflecting Category 2 severity Reflecting the Security impact level of severity Reflecting the Security impact level of severity It is the category index value;

[0174] Step S4.2: Predict the probability of the node-level Trojan horse based on the model output. and judgment threshold Construct a set of Trojan logic gate nodes :

[0175]

[0176] For each Trojan node Extract the complete feature vector constructed in step S1. It is then decomposed into sub-features to calculate the triggerability score. ;

[0177] The deeper the logic of a Trojan node, the harder it is to trigger. The triggerability score for the logic depth of all Trojan nodes. Represented as:

[0178]

[0179] in, This represents the total number of nodes in the Trojan horse logic gate node set;

[0180] The more fan-ins a Trojan node has, the harder it is to trigger. The triggerability score for the fan-in complexity of all Trojan nodes... Represented as:

[0181]

[0182] Trojan nodes are more easily triggered on the critical path; critical path triggerability score for all Trojan nodes. Represented as:

[0183]

[0184] The more rare a Trojan's trigger signal or logic gate is, the harder it is to trigger. This is reflected in the rarity and triggerability score of all Trojan nodes. Represented as:

[0185]

[0186] Taking into account logic depth, fan-in complexity, critical path coverage, and rarity, the triggerability score is... Represented as:

[0187]

[0188]

[0189] in, , , , These are non-negative weighting coefficients, which can be preset based on the application scenario or obtained through historical data analysis.

[0190] Step S4.3: Weighted fusion of hazard severity risk value and triggerability score to obtain comprehensive risk score. ;

[0191]

[0192] in The fusion coefficient is an adjustable parameter used to balance the importance of "severity of harm" and "triggerability".

[0193] Step S5: For the netlists identified as high-risk in Step S4, the GNNExplainer method is used to optimize an explanatory subgraph that maximizes the mutual information with the model prediction results. This is used to quantify the contribution of features to the prediction, and based on the feature contribution and the large model LLM, interpretable results containing risk composition, key evidence and anomalous patterns are generated.

[0194] In this embodiment, step S5 specifically includes the following steps:

[0195] Step S5.1: By analyzing the adjacency matrix Apply a continuous edge importance mask matrix Obtain the interpretation subgraph ;

[0196]

[0197] in, , express Matrix dimension It is the Hadamard product operator, used for element-wise multiplication of two matrices;

[0198] By analyzing the original node feature matrix Apply a continuous feature importance mask matrix The feature matrix after obtaining the mask ;

[0199]

[0200]

[0201] in, It is a learnable parameter matrix. express Matrix dimension express Nodes in the matrix The eigencomponents of dimension, express Middle node The The values ​​of each feature component after sigmoid optimization, i.e., the node The Each feature component affects the model's predicted value. Importance weights;

[0202] GNNExplainer generates explanations by optimizing the following objective function:

[0203]

[0204]

[0205] in, It is the predicted probability output by the multi-task graph attention network. Indicates mutual information, Represents information entropy. This represents the category index with the highest predicted value among the major hazard categories. This represents the category index with the highest predicted value among the severity subcategories;

[0206] Step S5.2: Extract key evidence from both node and global levels to construct a structured chain of evidence. ;

[0207]

[0208] in, It is a set of key node-level evidence, containing the key features associated with each Trojan node and their corresponding feature importance scores. For graph-level key evidence combination, it includes the most important feature-node pairs and their corresponding feature importance scores globally;

[0209]

[0210] in, Represents the set of key feature indices, which are nodes. Select the one with the highest absolute value of importance score Index of features, It is a key feature importance score vector, quantifying the importance of each key feature to the node. Contribution of classification It is the number of features with the highest absolute value of importance score. These represent the first major feature with the highest absolute value of importance score. These represent the numbers with the highest absolute values ​​of importance scores. Major features These represent the numbers with the highest absolute values ​​of importance scores. Major features Represents a node The The importance weights of each feature component for node-level risk prediction Represents a node The The importance weights of each feature component for node-level risk prediction Represents a node The The importance weights of each feature component for node-level risk prediction Represents the absolute value function;

[0211]

[0212] in, Represents a node The eigenvector of the first One portion, Represents a node The One characteristic, Represents a node The One characteristic, Represents a node The One characteristic, Represents a node The One characteristic, Represents a node The The importance weights of each feature component for graph-level risk classification prediction Represents the set of global key features - node pairs. This represents the maximum number of key feature-node pairs across the entire graph. Represents a node The The importance weights of each feature component for node-level risk prediction Represents a node The The importance weights of each feature component for node-level risk prediction Represents a node The The importance weight of each feature component to node-level risk prediction;

[0213] Step S5.3: Establish the chain of evidence. The model prediction results and the metadata of the netlist are input into the large language model to generate an interpretability report;

[0214]

[0215]

[0216] in, For the data tuples input into the large model, Represents a netlist file metadata, It can be customized according to specific application scenarios. The specific content includes netlist identifier information, source information, belonging to the process library and scale structure. It is a prompt word processing function. The final output is an interpretable report that includes the risk profile, key evidence, and a summary of unusual patterns.

[0217] In this embodiment, the evidence chain generation process of the GNNExplainer method is as follows: Figure 2 As shown.

[0218] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0219] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0220] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0221] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0222] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention in any other way. Any person skilled in the art may make changes or modifications to the above-disclosed technical content to create equivalent embodiments. However, any simple modifications, equivalent changes, and modifications made to the above embodiments based on the technical essence of the present invention without departing from the scope of the present invention shall still fall within the protection scope of the present invention.

Claims

1. A method for multi-task explainable hardware Trojan detection based on graph attention mechanism, characterized in that, The method comprises the following steps: Step S1, for the input gate level netlist description file, parse and abstract into a directed graph and adjacency matrix , for the directed graph each logic gate unit node extract the initial feature vector , the initial feature vector of all nodes is stacked to form an initial feature matrix ; Step S2, input the initial feature matrix and the adjacency matrix into the multi-head graph attention network, and obtain the final hidden state of the final node through layer propagation , and generate a graph-level vector through a global pooling function ;​ Step S3, according to the final hidden vector of each node and the graph-level vector of the netlist respectively performing the node Trojan classification and the graph-level risk classification tasks, and calculating a multi-task joint loss function jointly optimizing and training the model; Step S4, for the newly inputted netlist file, construct the graph structure and feature matrix according to steps S1-S3, input the trained model to obtain the node-level classification result, the prediction probability of the hazard category and the prediction probability of the severity subcategory, combine the preset risk assessment function to calculate the hazard severity risk value of the netlist and the triggerability score , and then perform weighted fusion to obtain the comprehensive risk score ; Step S5: For the netlists identified as high-risk in Step S4, the GNNExplainer method is used to optimize an explanatory subgraph that maximizes the mutual information with the model prediction results. This is used to quantify the contribution of features to the prediction, and based on the feature contribution and the large model LLM, interpretable results containing risk composition, key evidence and anomalous patterns are generated.

2. The multi-task explainable hardware Trojan detection method based on a graph attention mechanism according to claim 1, characterized in that, The step S1 specifically comprises the following steps: Step S1.1, for the gate level netlist description file , parse and abstract into a directed graph and an adjacency matrix , for representing the logical connections of the netlist: wherein wherein, represents a graph abstraction mapping function that performs netlist parsing to map all gate cell instances and signal connections to nodes and edges , represents all logic gate cell instances in the corresponding netlist, represents signal connections between logic gate cell instances in the corresponding gate-level netlist, and represents the th and the th logic gate instance in the directed graph , represents the total number of logic gate nodes in the directed graph ; Step S1.2, for each node in the graph extract its inherent logical gate base features : wherein, denotes a node unit gate type encoding, and denotes the in-degree and out-degree of a node respectively, denotes a normalization function, and || denotes a feature concatenation; Step S1.3, computing the topological features in the graph :​ in, It is a node The control path distance feature represents the node. Compared to the logical depth of the main input and key nodes, It is a node Logical layer depth Represents the maximum value function. It is a node The forward input node, It is a node The set of forward input nodes, It is a node The betweenness centrality characteristic of a node represents the betweenness centrality characteristic of a node. Is it on the critical path from the main input to the main output in the circuit? Step S1.4, computing global features in the graph : wherein, represents the number of rare logic gate units, represents the number of rare connection signal lines; Step S1.5, concatenate the logical gate basis features, topology features, and global features of each node into a complete feature vector , the features of all nodes in FIG. are vectorized and stacked into ; wherein, denotes the complete feature vector of the first node, denotes the complete feature vector of the second node, denotes the complete feature vector of the first node, denotes the complete feature vector of the first node, denotes the feature dimension of denotes the feature dimension of denotes the feature dimension of denotes the feature dimension of 3. The multi-task explainable hardware Trojan detection method based on a graph attention mechanism according to claim 1, characterized in that, The step S2 specifically comprises the following steps: Step S2.1, inputting the initial feature matrix and the adjacency matrix into the graph attention network, let the 0th layer hidden state be: Updated first Layer node hidden state Is: in, This represents the activation function. Indicates the first Layer nodes To the node Attention weights It is a learnable linear transformation matrix. Indicates the first Layer nodes The hidden state; By Final hidden state matrix of all nodes after message passing by the layer-wise attention network is: wherein, denotes matrix transpose, denotes the final hidden state vector of the layer node , denotes the final hidden state vector of the layer node , denotes the final hidden state vector of the layer node ; Step S2.2, globally pooling the final hidden state matrix to generate a graph-level embedding vector representing the semantics of the entire netlist : wherein, represents represents the final hidden state vector of the layer node , is a graph-level embedding vector of dimension d.

4. The multi-task explainable hardware Trojan detection method based on a graph attention mechanism of claim 1, wherein, The step S3 specifically comprises the following steps: Step S3.1, for each node its final hidden vector into a shared fully connected classification head to predict the trojan node; in, This represents the sigmoid activation function. To predict probability values, and These are the weight matrix and bias term of the node classifier, respectively; when At that time, identify the node If it is a Trojan node, otherwise it is considered a node. For normal nodes, among which It is a configurable parameter. ; Step S3.2, embedding graph-level vectors Input to two independent fully connected classifiers, implementing the graph-level risk classification task: wherein, represents a probability distribution of a large class of Trojan harm, and are a weight matrix and a bias term of the large class classifier, respectively; wherein, a probability distribution representing the severity class, and are a weight matrix and a bias term, respectively, of the severity sub-class classifier; Step S3.3, computing a multi-task joint loss function jointly optimizing the model: wherein, is the node binary cross-entropy loss value, is the loss value of the hazard major category classification, is the loss value of the severity minor category classification, is the true label of the node is the true label of the node and are one-hot encodings of the graph-level hazard major category and severity minor category true labels, respectively, is a learnable weight coefficient, is the total number of classes of the hazard major category, is the total number of classes of the severity minor category, is the class index value for calculating the hazard major category loss, is the class index value for calculating the severity minor category loss.

5. The multi-task explainable hardware Trojan detection method based on a graph attention mechanism according to claim 1, characterized in that, The step S4 specifically comprises the following steps: Step S4.1, predicting a probability distribution of a hazard category based on the model output and a severity sub-category , in combination with preset weights of the respective categories of Trojan hazards and severity , calculating a risk value of the hazard severity of the netlist ; wherein, represents the total number of categories of the great harm category, represents the total number of categories of the small harm category, is a weight value of the small harm category, used to reduce the risk value proportion of the small harm category, reflects the safety impact level of the first harm, reflects the safety impact level of the second harm, reflects the safety impact level of the harm, reflects the safety impact level of the harm, reflects the safety impact level of the first severity, reflects the safety impact value of the second severity, reflects the safety impact level of the severity, reflects the safety impact level of the severity, is a category index value; Step S4.2, outputting node-level Trojan prediction probabilities according to the model and a decision threshold constructing a set of Trojan logic gate nodes : For each trojan node , extract its complete feature vector built in step S1 , and decompose into sub-feature items for computing the triggerability score ; the deeper the logical depth of the trojan node, the more difficult it is to trigger, all trojan nodes' logical depth triggerability score is represented as: wherein, represents the total number of nodes in the set of Trojan logic gate nodes; The more fan-in of the trojan node, the more difficult to trigger, all the fan-in complexity of the trojan node can trigger the score is represented as: Trojan nodes are more likely to be triggered on critical paths, all Trojan nodes critical path triggerability score is represented as: The trigger signal of the Trojan is a rare signal or the Trojan logic gate is a rare gate and is more difficult to be triggered. The rarity of all Trojan nodes can trigger the rarity triggerability score is represented as: The triggerability score is determined by considering logic depth, fan-in complexity, critical path coverage, and rarity is represented as: wherein, , , , are non-negative weighting coefficients, which can be preset based on application scenarios or obtained through historical data analysis; Step S4.3, weighted fusion of the hazard severity risk value and the triggerability score to obtain a comprehensive risk score ; wherein is the fusion coefficient, is a tunable parameter used to balance the importance of "severity of harm" and "trig- gability".

6. The multi-task explainable hardware Trojan detection method based on a graph attention mechanism according to claim 1, characterized in that, The step S5 specifically comprises the following steps: Step S5.1, obtaining an adjacency matrix applying a continuous edge importance mask matrix obtaining an explanation subgraph ; wherein , denotes matrix dimensions, is the Hadamard product operator for element-wise multiplication of two matrices; By applying a continuous feature importance mask matrix to the original node feature matrix to obtain a masked feature matrix ; wherein, is a learnable parameter matrix, represents the matrix dimension, represents the node 's th eigenvector, represents the node 's th eigenvector after sigmoid optimization, i.e., the importance weight of the node 's th eigenvector on the model predicted value ; The GNNExplainer generates an explanation by optimizing the following objective function: wherein, is a predicted probability of the multi-task graph attention network output, denotes mutual information, denotes information entropy, denotes the index of the class with the highest predicted value in the harm category, denotes the index of the class with the highest predicted value in the severity subcategory; Step S5.2, extract key evidence from both node and global level, build structured evidence chain ; wherein, is a node-level key evidence set containing each Trojan node associated with its key features and corresponding feature importance scores, is a graph-level key evidence set containing the most important feature-node pairs in the global scope and their corresponding feature importance scores. wherein, denotes a set of key feature indexes, is a node The index of the feature with the highest absolute value of importance score is selected The index of the feature with the highest absolute value of importance score is selected is a vector of importance scores of key features, quantifying the contribution of each key feature to the classification of the node is a vector of importance scores of key features, quantifying the contribution of each key feature to the classification of the node is the number of features with the highest absolute value of importance score, denotes the first largest feature with the highest absolute value of importance score, denotes the first largest feature with the highest absolute value of importance score, denotes the first largest feature with the highest absolute value of importance score, denotes the importance weight of the first feature component of the node to the node-level risk prediction, denotes the importance weight of the first feature component of the node to the node-level risk prediction, denotes the importance weight of the first feature component of the node to the node-level risk prediction, denotes the absolute value function; wherein, represents a node the first component of the feature vector, represents a node the first feature of the node represents a node the first feature of the node represents a node the first feature of the node represents a node the first feature of the node represents a node the first importance weight of the feature component pair of the node represents a global key feature-node pair set, represents the maximum number of all key feature-node pairs in the global graph, represents a node the first importance weight of the feature component pair of the node represents a node the first importance weight of the feature component pair of the node represents a node the first importance weight of the feature component pair of the node Step S5.3, inputting the evidence chain , the model prediction result, and the metadata of the netlist into a large language model to generate an explainability report; wherein, is a data tuple input into a large model, represents the metadata of a netlist file , can be customized according to specific application scenarios, and specific contents include netlist identification information, source information, belonging process library and scale structure, is a prompt word processing function, is an explainability report finally output, including risk composition, key evidence and abnormal mode summary.

7. A multi-task explainable hardware Trojan detection system based on a graph attention mechanism, characterized in that, Comprise: The feature extraction module, the graph attention network module, the multi-task joint optimization module, the risk fusion and reasoning module, the GNNExplainer explanation module and the LLM report generation module; The modules cooperate to realize the multi-task explainable hardware Trojan detection method based on the graph attention mechanism according to any one of claims 1-6.

Images