A side channel key recovery method based on random forest and center loss regularization
By employing random forest and center loss regularization, the problems of noise interference and low training efficiency in side-channel security assessment are solved, achieving efficient and accurate key recovery and improving the separation degree of feature space and attack efficiency.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- CHONGQING UNIV OF POSTS & TELECOMM
- Filing Date
- 2026-04-15
- Publication Date
- 2026-07-14
Smart Images
Figure CN122394773A_ABST
Abstract
Description
Technical Field
[0001] This invention belongs to the field of cryptographic algorithm analysis, and specifically relates to a side-channel key recovery method based on random forest and central loss regularization. Background Technology
[0002] With the widespread application of IoT devices, smart cards, and embedded security chips, the practical security of cryptographic algorithms faces severe challenges. Side-channel attacks, by collecting physical information (such as power consumption, electromagnetic radiation, and time) leaked during the operation of cryptographic devices, can effectively deduce internal keys, posing a serious threat to deployed cryptographic systems. Among various side-channel attacks, power consumption analysis-based methods have become a hot topic in current side-channel security research due to their low cost of attack equipment and ease of operation.
[0003] Currently, mainstream side-channel power analysis methods can be divided into two categories: non-modeling attacks and modeling attacks. Non-modeling attack methods, such as Differential Power Analysis (DPA) and Correlated Power Analysis (CPA), do not require prior training data, but their robustness is weak when the device has protective measures. In contrast, modeling attack methods construct a model by collecting a large number of power waveforms corresponding to known keys on identical devices, and then attack the target device. They exhibit significant advantages in attack efficiency and success rate, and have become the mainstream technical approach in current side-channel security assessments.
[0004] However, existing modeling attack methods still face several prominent problems: First, when traditional machine learning models directly model high-dimensional full-time power consumption waveforms, a large number of noise features unrelated to the key will seriously interfere with the model's probability output, reducing the accuracy of key scoring; Second, although ensemble learning methods represented by random forests have an inherent feature importance evaluation mechanism, they are essentially axis-aligned split linear model ensembles, which are difficult to capture the complex temporal dependencies between sampling points, limiting their ability to mine nonlinear leakage patterns in power consumption trajectories; Finally, although convolutional neural networks have good local temporal feature extraction capabilities, if they directly process noisy complete waveforms, the model needs to undertake the dual tasks of leakage region localization and feature extraction, resulting in problems such as low training efficiency and easy getting trapped in local optima, and its performance is particularly limited under small sample conditions.
[0005] Therefore, how to construct a more efficient and accurate side-channel security assessment method has become an important problem that urgently needs to be solved in the field of cryptographic hardware security. Summary of the Invention
[0006] To address the above problems, this invention provides a side-channel key recovery method based on random forest and center loss regularization, comprising the following steps:
[0007] S1. Divide the side-channel waveform dataset into a modeling set and an attack set, and fit normalization parameters on the modeling set. Then, apply the normalization parameters to the normalization processing of the modeling set and the attack set. Each power waveform in the modeling set and the attack set contains 700 sampling points, and its corresponding plaintext matrix and key matrix are provided as metadata.
[0008] S2. Based on the nonlinear transformation lookup table of the cryptographic algorithm, map the plaintext matrix and key matrix corresponding to each power consumption waveform to 256 types of integer tags, calculate the Hamming weight corresponding to each integer tag, and finally generate 9 types of Hamming weight tags.
[0009] S3. Using the normalized modeling set as input and integer labels as supervision signals, train the random forest classifier; then, calculate the feature importance score at each sampling time using the Gini impurity reduction, and construct the interest point set based on the feature importance score;
[0010] S4. Train a multilayer perceptron using a simplified feature subset as input; wherein, cross-entropy loss is calculated using integer labels as the main supervision signal, and center loss is calculated using Hamming weight labels as the auxiliary supervision signal as the regularization term, and the two are jointly optimized by weighting coefficients that adaptively increase with the training process.
[0011] S5. Prune the normalized attack set according to the set of interest points, input the pruned data into the trained multilayer perceptron, and generate a score for each candidate key byte;
[0012] S6. All candidate key bytes are sorted in descending order of score. Check the position of the real key in the sorting result, KeyRank. When KeyRank drops to 0, the target key byte is determined to have been successfully recovered.
[0013] The beneficial effects of this invention are:
[0014] This invention utilizes the feature importance evaluation mechanism of random forest to compress the input dimension from 700 to 100, effectively removing noise features unrelated to the key, significantly improving the signal-to-noise ratio of the input signal, and reducing the training difficulty of the subsequent multilayer perceptron.
[0015] This invention introduces a center loss as a regularization term and uses Hamming weight labels as auxiliary supervision signals to guide the formation of a Hamming weight hierarchy in the 128-dimensional feature space that conforms to the physical mechanism of power leakage. Experiments show that after joint training, the comparison between inter-class and intra-class distances of Hamming weights in the feature space is improved by 98.7% compared to before training, the separation degree of the feature space is significantly improved, and key ranking convergence is effectively accelerated. The number of attack waveforms required to achieve a success rate of 90% is reduced from 500 to 300, and the attack efficiency is improved by 40%. In addition, this invention adopts a cosine annealing adaptive λ scheduling strategy, which focuses on classification learning in the early stage of training and gradually enhances physical constraints in the later stage, further optimizing the dynamic balance between feature space structuring and fine-grained classification capabilities compared to the fixed λ scheme.
[0016] This invention employs a statistical evaluation framework based on 100 random repeated samplings, using Mean Key Rank and success rate as dual indicators to objectively quantify attack efficiency. Compared to a single Key Rank evaluation, it better reflects the stability of the model under different attack waveforms, providing a more rigorous and reproducible evaluation standard for side-channel security assessment. Attached Figure Description
[0017] Figure 1 This is a flowchart of a side-channel key recovery method based on random forest and center loss regularization according to the present invention.
[0018] Figure 2 This is a flowchart illustrating the overall process of the method of the present invention.
[0019] Figure 3 This is a convergence curve of cross-entropy loss and center loss as a function of training rounds during the joint training process of this invention.
[0020] Figure 4 This is a two-dimensional visualization comparison of the t-SNE of the encoder's 128-dimensional feature space before and after training according to the present invention.
[0021] Figure 5 This is a comparison of the Mean Key Rank convergence curves and success rate curves of the present invention and three groups of ablation control experiments;
[0022] Figure 6 This is a comparison chart of the intra-class distance, inter-class distance, and their ratio of Hamming weights in the 128-dimensional feature space of the encoder before and after joint training in this invention. Detailed Implementation
[0023] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.
[0024] Please see Figures 1-2 This invention provides a side-channel key recovery method based on random forest and center loss regularization, comprising the following steps:
[0025] S1. Divide the side-channel waveform dataset into a modeling set and an attack set, and fit normalization parameters on the modeling set. Then, apply the normalization parameters to the normalization processing of the modeling set and the attack set. Each power waveform in the modeling set and the attack set contains 700 sampling points, and its corresponding plaintext matrix and key matrix are provided as metadata.
[0026] Preferably, the present invention uses the ASCAD standard dataset as the side channel waveform dataset.
[0027] Preferably, step S1 includes:
[0028] S11. Select 50,000 power waveforms from the side-channel waveform dataset as the modeling set and 10,000 power waveforms as the attack set; each power waveform contains 700 sampling points, corresponding to the power sequence collected during the first round of SubBytes operation of the AES-128 algorithm; at the same time, read the plaintext matrix and key matrix corresponding to each power waveform as metadata;
[0029] S12. Statistical modeling: The mean and standard deviation of all power consumption waveforms at each sampling time are represented as follows:
[0030] ,
[0031] ,
[0032] In the formula, This represents the mean value at sampling time j. The standard deviation of sampling time j is represented by N, and the number of power consumption waveforms is represented by N. This represents the value of the i-th power consumption waveform at sampling time j.
[0033] S13. Based on the mean and standard deviation calculated in step S12, perform Z-Score normalization on both the modeling set and the attack set.
[0034] The attack set strictly reuses the same normalization parameters (mean and standard deviation) for transformation to avoid information from the testing phase from seeping into the training process; after normalization, the mean amplitude at each sampling time is 0 and the standard deviation is 1, eliminating the interference of individual device differences and DC bias, while ensuring that the calculation of the importance of random forest features is not affected by differences in amplitude scale.
[0035] Specifically, the modeling set uses known real keys, and supervisory labels are generated based on these keys to train the model; while the attack set uses unknown real keys, which are only used for subsequent Key Rank evaluation, are not disclosed to the model, and do not participate in any training process.
[0036] S2. Based on the nonlinear transformation lookup table of the cryptographic algorithm, map the plaintext matrix and key matrix corresponding to each power consumption waveform to 256 types of integer tags, calculate the Hamming weight corresponding to each integer tag, and finally generate 9 types of Hamming weight tags.
[0037] Preferably, step S2, which processes the plaintext matrix and key matrix corresponding to each power consumption waveform, includes:
[0038] S21. For the plaintext matrix and the key matrix, select the 3rd byte as the attack target.
[0039] Specifically, the third byte is chosen as the attack target primarily because it corresponds to a position with a high power leakage signal-to-noise ratio in the first round of SubBytes output of the AES-128 algorithm, making it a standard attack point in the ASCAD dataset. If this method is applied to other block cipher algorithms, simply replace the S-box with the corresponding algorithm's nonlinear transformation lookup table; the tag generation logic remains unchanged.
[0040] S22. Based on the S-box lookup table of the AES algorithm, map the plaintext matrix and the key matrix to 256 classes of integer tags in the range of 0 to 255; the mapping relationship is shown in the following formula:
[0041] ,
[0042] In the formula, k represents the 3rd byte of the key matrix, p i This indicates that the 3rd byte of the plaintext matrix corresponds to the i-th power consumption waveform. This indicates a bitwise XOR operation; The integer label represents the i-th power consumption waveform, which corresponds to the intermediate value of the first round of SubBytes operation in the AES-128 algorithm and is the main source of side-channel leakage; N represents the number of power consumption waveforms.
[0043] S23. Calculate the Hamming weight label based on the integer label, using the following formula:
[0044] ,
[0045] In the formula, H i The Hamming weight label represents the power consumption waveform of the i-th waveform. Integer label The value of the b-th bit in the binary representation of HW() represents the Hamming weight calculation. The value ranges from 0 to 8, with a total of 9 categories; the Hamming weight tag and the Hamming weight model of power leakage have a direct physical correspondence, that is, the dynamic power consumption of CMOS devices is approximately proportional to the number of bits of data state flip (Hamming weight), which will be used as an auxiliary monitoring signal for the center loss.
[0046] Both the modeling set and the attack set generate labels independently in this manner.
[0047] S3. Using the normalized modeling set as input and integer labels as supervision signals, train the random forest classifier; then, calculate the feature importance score at each sampling time using the Gini impurity reduction, and construct the interest point set based on the feature importance score.
[0048] Preferably, step S3 includes:
[0049] S31. Initialize the random forest classifier, set the number of decision trees T=200, and fix the random seed to 0 to ensure the reproducibility of the experiment; during the training process, each decision tree is constructed based on the Bootstrap random sampling of features and samples, and each decision tree grows independently until convergence;
[0050] S32. The feature importance scores at each sampling time are extracted using a trained random forest classifier and expressed as follows:
[0051] ,
[0052] ,
[0053] In the formula, I(f) represents the feature importance score at sampling time f. Let f represent the set of all nodes in the t-th decision tree that are split based on the sampling time f. Represents a node The amount of impurity reduction at the location of the Gini is reduced. This represents the function for calculating Gini impurity. , Representing nodes respectively The left and right child nodes after the split, This indicates the number of samples contained in the corresponding node; The larger the value, the higher the correlation between the sampling time and key leakage, indicating a noise sampling point unrelated to the key. If the value approaches zero, it will eventually be eliminated.
[0054] S33. Sort the 700 sampling times in descending order of feature importance scores, and select the top 100 sampling times to form a set of points of interest.
[0055] Through the above operations, the input dimension can be compressed from 700 to 100, with a compression ratio of 7:1.
[0056] S4. Train a multilayer perceptron using a simplified feature subset as input; wherein, cross-entropy loss is calculated using integer labels as the main supervision signal, and center loss is calculated using Hamming weight labels as the auxiliary supervision signal as the regularization term, and the two are jointly optimized by weighting coefficients that adaptively increase with the training process.
[0057] Preferably, step S4 includes:
[0058] S41. For each power consumption waveform in the normalized modeling set, extract its value at a specified sampling time in the set of interest points to form a 100-dimensional simplified feature; during the training process, each training batch carries 256 classes of integer value labels and 9 classes of Hamming weight labels.
[0059] S42. Construct a multilayer perceptron, which includes an encoder and a classification head:
[0060] The encoder consists of three cascaded coding units, with a dropout layer with a dropout rate of 0.1 connected in series between every two coding units; each coding unit includes a fully connected layer, a batch normalization layer, and a SiLU activation layer; the output dimensions of the three coding units are 512, 256, and 128, respectively;
[0061] The classification head consists of a first fully connected layer, a SiLU activation layer, a Dropout layer with a dropout rate of 0.3, and a second fully connected layer connected in series. The output dimension of both the first and second fully connected layers is 256.
[0062] The SiLU activation function is defined as:
[0063] ,
[0064] SiLU maintains a smooth gradient near zero, which can more effectively alleviate the problem of neuron death compared to ReLU, and is beneficial for full training of the 128-dimensional feature space.
[0065] S43. Design the joint loss function for:
[0066] ,
[0067] In the formula, Represents cross-entropy loss, Indicates the loss at the center. This represents the weighting coefficient.
[0068] The center loss function maintains a set of learnable class center vectors, denoted as... These correspond to Hamming weights from 0 to 8, respectively. The loss function is defined as:
[0069] ,
[0070] This represents the feature vector of the i-th power consumption waveform output by the encoder. Let represent the learnable center vector of the Hamming weight label corresponding to the i-th power consumption waveform; each center vector is initialized with zero and updated by moving average with an independent learning rate during training; the center loss guides the feature vectors of samples with the same Hamming weight to cluster towards their respective class centers in the 128-dimensional space, so that the feature space forms a Hamming weight hierarchy consistent with the physical mechanism of power leakage, such as Figure 4 , Figure 6 As shown. Among them, Figure 4 The left image shows the feature distribution during random initialization, and the right image shows the feature distribution after joint training. The color intensity indicates the Hamming weight category corresponding to the sample.
[0071] Cross-entropy loss targets 256 classes of integer value labels:
[0072] ,
[0073] M represents the number of power consumption waveforms in a batch; This represents the posterior probability that the multilayer perceptron predicts the input power waveform as belonging to class c. This represents the c-th component in the one-hot encoding of the integer label of the i-th power consumption waveform.
[0074] Weighting coefficient Adaptive scheduling strategy using cosine annealing:
[0075] ,
[0076] In the formula, This represents the minimum value of the weighting coefficient. This represents the maximum value of the weighting coefficient. This indicates the total number of training rounds.
[0077] The physical motivation behind this scheduling strategy is as follows: In the early stages of training, model parameters are randomly initialized, and the feature space has not yet formed an effective representation. If λ is too large at this time, the center loss will force the features to be pulled towards the 9 fixed class centers, interfering with the establishment of the 256-class fine-grained classification ability. As training progresses, the encoder has acquired preliminary discriminative ability, and gradually increasing λ can guide the feature space to evolve towards the Hamming heavyweight hierarchical structure without destroying the existing classification structure. Ablation experiments show that the fixed λ scheme is sensitive to the hyperparameter values, and the performance varies significantly under different λ values, requiring additional parameter tuning costs. The adaptive λ scheme does not require manual selection of fixed values. It automatically achieves a dynamic balance between classification learning in the early stages of training and gradually increasing physical constraints in the later stages of training through cosine annealing, ensuring performance while having stronger engineering reproducibility.
[0078] Preferably, λ min =0.001, λ max =0.05.
[0079] S44. Based on a simplified feature subset and a joint loss function, the multilayer perceptron is trained using the Adam optimizer, with an initial learning rate of... for The weight decays to The learning rate is adjusted in conjunction with the cosine annealing learning rate scheduling strategy, as follows:
[0080] ,
[0081] In the formula, This represents the learning rate in round t. This represents the minimum learning rate.
[0082] Cosine annealing avoids the oscillations that occur with a fixed learning rate in the later stages of training, helping the model converge to a better parameter space, such as... Figure 3 As shown, the left figure is the cross-entropy loss curve, the middle figure is the center loss curve, and the right figure is the weighting coefficient λ. t The cosine annealing curve increases with each training epoch; the batch size is set to 256, and all parameters are saved after 80 epochs of training for reuse in S5 and S6.
[0083] S5. Prune the normalized attack set according to the set of interest points, input the pruned data into the trained multilayer perceptron, and generate a score for each candidate key byte.
[0084] Preferably, step S5 includes:
[0085] S51. For each power consumption waveform in the normalized attack set, extract its value at a specified sampling time in the set of interest points to form a 100-dimensional simplified attack feature; ensure that the attack set input and the training set input are completely aligned in the feature space.
[0086] S52. Input the simplified attack features into the trained multilayer perceptron for forward propagation inference to obtain 256 posterior probability vectors. During the inference phase, Dropout is disabled, all neurons participate in the computation, and a Softmax function is applied after the multilayer perceptron classification head. The Softmax function converts the raw output of the classification head into a normalized probability distribution, ensuring that the sum of the predicted probabilities for the 256 categories is 1.
[0087] S53. Calculate 256 hypothetical intermediate values for each power waveform in the attack set based on 256 classes of posterior probability vectors. The score for each candidate key byte is obtained by summing the logarithmic fields, and is expressed as:
[0088] ,
[0089] In the formula, Represents candidate key bytes The rating, Let x represent the posterior probability predicted by the multilayer perceptron for the i-th power consumption waveform in the attack set, indicating that it belongs to the category corresponding to the hypothetical median value. i h represents the simplified feature vector of the i-th power waveform in the attack set. i This indicates the power consumption waveform of the i-th element in the attack set within the candidate key byte. The assumed median value, This indicates a numerical protection term to prevent logarithmic underflow when the probability value approaches zero; This indicates the number of attack waveforms that participated in this scoring.
[0090] The cumulative summation over the logarithmic field is mathematically equivalent to the direct multiplication of posterior probabilities, but it fundamentally eliminates the risk of floating-point underflow; as the number of waveforms involved in the scoring increases... As the number of bytes increases, the cumulative score of the correct key bytes will consistently be higher than that of the remaining 255 incorrect candidates, and the score gap will increase accordingly. Monotonically increasing.
[0091] S6. All candidate key bytes are sorted in descending order of score. Check the position of the real key in the sorting result, KeyRank. When KeyRank drops to 0, the target key byte is determined to have been successfully recovered.
[0092] Preferably, Key Rank uses a 0-based index and ranges from 0 to 255. Key Rank=0 indicates that the real key byte score ranks first among 256 candidates, meaning that the key recovery is successful. The smaller the Key Rank value, the better the attack effect. When Key Rank drops to 0, the target key byte is determined to be successfully recovered.
[0093] Preferably, the following statistical evaluation method is used to quantify and verify the attack efficiency of the present invention and is not a core step in key recovery. N waveforms are randomly and non-repeatingly selected from the attack set, and the above scoring and ranking process is repeated 100 times. The Mean Key Rank and standard deviation are then calculated.
[0094] ,
[0095] ,
[0096] In the formula, This indicates the rank position of the real key byte when N attack waveforms are used in the r-th random sampling.
[0097] The success rate is calculated as the proportion of Key Rank = 0 in 100 repeated experiments.
[0098] ,
[0099] in, The indicator function is defined as the minimum number of attack waveforms required to achieve a 90% success rate, which is used as a quantitative indicator of attack efficiency.
[0100] Take in sequence Repeat the above evaluation process, plot the Mean Key Rank ± Standard Deviation convergence curve and success rate curve respectively, and compare them with the results of the three ablation control experiments: RF-Full, RF-Top100, and RF-POI + pure CE MLP. Figure 5 As shown, the left figure is the Mean Key Rank ± Standard Deviation curve, and the right figure is the success rate curve. The horizontal axis represents the number of attack waveforms N, and the vertical axis represents the key ranking and the success rate percentage, respectively. Experimental results show that RF-Full and RF-Top100 still do not reach a success rate of 90% when the number of attack waveforms N=1000; RF-POI+pure CE MLP achieves a success rate of 90% for the first time when N=500; the method of this invention (RF-POI+MLP+CenterLoss) achieves a success rate of 90% when N=300, reducing the attack waveform requirement by 40% compared to pure CE MLP, verifying the significant improvement effect of center loss regularization on key recovery efficiency.
[0101] In summary, this invention organically combines the efficient and interpretable feature selection capability of random forests, the deep nonlinear modeling capability of multilayer perceptrons, and the physical constraint effect of central loss on the feature space. Through a six-stage serial architecture, it effectively improves the signal-to-noise ratio of side-channel waveforms and guides the feature space to form a Hamming weight hierarchy structure that conforms to the physical mechanism of power leakage, thereby accelerating the convergence process of key ranking. This provides an efficient and reproducible technical path for the side-channel security assessment of cryptographic devices.
[0102] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.
Claims
1. A side-channel key recovery method based on random forest and center loss regularization, characterized in that, Includes the following steps: S1. Divide the side-channel waveform dataset into a modeling set and an attack set, and fit normalization parameters on the modeling set. Then, apply the normalization parameters to the normalization processing of the modeling set and the attack set. Each power waveform in the modeling set and the attack set contains 700 sampling points, and its corresponding plaintext matrix and key matrix are provided as metadata. S2. Based on the nonlinear transformation lookup table of the cryptographic algorithm, map the plaintext matrix and key matrix corresponding to each power consumption waveform to 256 types of integer tags, calculate the Hamming weight corresponding to each integer tag, and finally generate 9 types of Hamming weight tags. S3. Using the normalized modeling set as input and integer labels as supervision signals, train the random forest classifier; then, calculate the feature importance score at each sampling time using the Gini impurity reduction, and construct the interest point set based on the feature importance score; S4. Train a multilayer perceptron using a simplified feature subset as input; wherein, cross-entropy loss is calculated using integer labels as the main supervision signal, and center loss is calculated using Hamming weight labels as the auxiliary supervision signal as the regularization term, and the two are jointly optimized by weighting coefficients that adaptively increase with the training process. S5. Prune the normalized attack set according to the set of interest points, input the pruned data into the trained multilayer perceptron, and generate a score for each candidate key byte; S6. All candidate key bytes are sorted in descending order of score. Check the position of the real key in the sorting result, KeyRank. When KeyRank drops to 0, the target key byte is determined to have been successfully recovered.
2. The side-channel key recovery method based on random forest and center loss regularization according to claim 1, characterized in that, Step S1 includes: S11. Select 50,000 power waveforms from the side-channel waveform dataset as the modeling set and 10,000 power waveforms as the attack set; each power waveform contains 700 sampling points, corresponding to the power sequence collected during the first round of SubBytes operation of the AES-128 algorithm; at the same time, read the plaintext matrix and key matrix corresponding to each power waveform as metadata; S12. Statistical modeling of the mean and standard deviation of all power consumption waveforms at each sampling time; S13. Based on the mean and standard deviation calculated in step S12, perform Z-Score normalization on both the modeling set and the attack set.
3. The side-channel key recovery method based on random forest and center loss regularization according to claim 1, characterized in that, Step S2 involves processing the plaintext matrix and key matrix corresponding to each power consumption waveform, including: S21. For the plaintext matrix and the key matrix, select the 3rd byte as the attack target; S22. Based on the S-box lookup table of the AES algorithm, map the plaintext matrix and the key matrix to 256 classes of integer tags in the range of 0 to 255; the mapping relationship is shown in the following formula: ， In the formula, k represents the 3rd byte of the key matrix, p i This indicates that the 3rd byte of the plaintext matrix corresponds to the i-th power consumption waveform. This indicates a bitwise XOR operation; The integer label represents the i-th power consumption waveform, which corresponds to the intermediate value of the first round of SubBytes operation in the AES-128 algorithm; N represents the number of power consumption waveforms. S23. Calculate the Hamming weight label based on the integer label, using the following formula: ， In the formula, H i The Hamming weight label represents the power consumption waveform of the i-th waveform. Integer label The value of the b-th bit in the binary representation of HW() represents the Hamming weight calculation.
4. The side-channel key recovery method based on random forest and center loss regularization according to claim 1, characterized in that, Step S3 includes: S31. Initialize the random forest classifier, set the number of decision trees T=200, and fix the random seed to 0; during training, each decision tree is constructed based on the Bootstrap random sampling of features and samples, and each decision tree grows independently until convergence; S32. The feature importance scores at each sampling time are extracted using a trained random forest classifier and expressed as follows: ， ， In the formula, I(f) represents the feature importance score at sampling time f. Let f represent the set of all nodes in the t-th decision tree that are split based on the sampling time f. Represents a node The amount of impurity reduction at the location of the Gini is reduced. This represents the function for calculating Gini impurity. , Representing nodes respectively The left and right child nodes after the split, This indicates the number of samples contained in the corresponding node; S33. Sort the 700 sampling times in descending order of feature importance scores, and select the top 100 sampling times to form a set of points of interest.
5. The side-channel key recovery method based on random forest and center loss regularization according to claim 1, characterized in that, Step S4 includes: S41. For each power consumption waveform in the normalized modeling set, extract its value at a specified sampling time in the set of points of interest to form a 100-dimensional simplified feature. S42. Construct a multilayer perceptron, which includes an encoder and a classification head: The encoder consists of three cascaded coding units, with a dropout layer with a dropout rate of 0.1 connected in series between every two coding units; each coding unit includes a fully connected layer, a batch normalization layer, and a SiLU activation layer; the output dimensions of the three coding units are 512, 256, and 128, respectively; The classification head consists of a first fully connected layer, a SiLU activation layer, a Dropout layer with a dropout rate of 0.3, and a second fully connected layer connected in series. The output dimension of both the first and second fully connected layers is 256. S43. Design the joint loss function for: ， ， ， In the formula, Represents cross-entropy loss, Indicates the loss at the center. This represents the feature vector of the i-th power consumption waveform output by the encoder. Let represent the learnable center vector of the Hamming weight tag corresponding to the i-th power consumption waveform; M represents the number of power consumption waveforms in a batch. This represents the posterior probability that the multilayer perceptron predicts the input power waveform as belonging to class c. This represents the c-th component in the one-hot encoding of the integer label of the i-th power consumption waveform; The weighting coefficients are represented by a cosine annealing adaptive scheduling strategy. ， In the formula, This represents the minimum value of the weighting coefficient. This represents the maximum value of the weighting coefficient. Indicates the total number of training rounds; S44. Based on a simplified feature subset and a joint loss function, the multilayer perceptron is trained using the Adam optimizer, with an initial learning rate of... for The weight decays to The learning rate is adjusted in conjunction with the cosine annealing learning rate scheduling strategy, as follows: ， In the formula, This represents the learning rate in round t. This represents the minimum learning rate.
6. The side-channel key recovery method based on random forest and center loss regularization according to claim 1, characterized in that, Step S5 includes: S51. For each power consumption waveform in the normalized attack set, extract its value at a specified sampling time in the set of interest points to form a 100-dimensional simplified attack feature. S52. Input the simplified attack features into the trained multilayer perceptron for forward propagation inference to obtain 256 classes of posterior probability vectors; wherein, Dropout is turned off during the inference phase, all neurons participate in the calculation, and a Softmax function is applied after the multilayer perceptron classification head; S53. Based on the 256 classes of posterior probability vectors, calculate the 256 hypothetical intermediate values for each power waveform in the attack set, and sum them in the logarithmic field to obtain the score for each candidate key byte, expressed as: ， In the formula, Represents candidate key bytes The rating, () represents the posterior probability predicted by the multilayer perceptron for the i-th power consumption waveform in the attack set, indicating that it belongs to the category corresponding to the hypothetical median value. h represents the simplified feature vector of the i-th power waveform in the attack set. i This indicates the power consumption waveform of the i-th element in the attack set within the candidate key byte. The assumed median value, Indicates a value protection item. This indicates the number of power consumption waveforms in the attack set.