Graph neural network-based trojan detection method for FPGA netlist

Abstract

The present invention relates to the field of Trojan detection, and in particular to a graph neural network-based Trojan detection method for an FPGA netlist, aiming to solve the problem in the prior art of the lack of an effective Trojan detection mechanism. The method comprises: using an HDL to describe digital logic and a system architecture to obtain an HDL code; converting the HDL code into a gate-level representation by an EDA tool, mapping a logic block of the gate-level representation onto an FPGA chip, planning interconnections, and generating a bit stream file; downloading the bit stream file to the FPGA chip and obtaining an FPGA netlist file; converting the netlist file into an original directed graph; setting Trojan features of a node in the original directed graph, and further extracting features of the original directed graph to obtain a feature directed graph; balancing a malicious logic node and a normal node in the feature directed graph; and using a graph convolutional network to classify nodes in a balanced directed graph to obtain a Trojan detection result. In the present invention, Trojan can be accurately detected.

Description

Trojan detection method for FPGA netlist based on graph neural network The present application claims priority to the Chinese patent application No. 2024106544898, filed on May 24, 2024, and entitled "Trojan detection method for FPGA netlist based on graph neural network", the whole content of which is incorporated herein by reference. TECHNICAL FIELD

[0001] The present application belongs to the field of Trojan detection, and specifically relates to a Trojan detection method for FPGA netlist based on graph neural network. BACKGROUND

[0002] In today's digital environment, Field-Programmable Gate Arrays (FPGA) have become a key component in numerous fields, including telecommunications, automotive systems, medical devices, and data processing infrastructure. The tunability and superior performance of FPGAs make them indispensable in meeting the dynamic demands of modern electronic systems. Therefore, protecting the integrity and security of FPGAs is of utmost importance, not only to protect intellectual property and confidential information, but also to ensure the reliability and stability of the information ecosystem. However, the widespread deployment of FPGAs in critical mission applications makes them vulnerable to sophisticated security threats, among which Hardware Trojans (HD) are a particularly insidious form of attack. Hardware Trojans refer to malicious code or modifications implanted in electronic hardware with the purpose of stealing information, disrupting system functionality, or engaging in other malicious activities that go unnoticed. Unlike software Trojans, Hardware Trojans are more difficult to detect and mitigate because they are hidden within the physical structure of the hardware. Hardware Trojans pose a significant threat because they can bypass traditional security measures, causing significant damage to systems and data, and posing long-term risks to security and trustworthiness. The development lifecycle of FPGA-based applications requires the use of specialized Integrated Development Environments (IDEs), which help write, compile, and generate binary bitstreams. These bitstreams configure FPGAs to execute custom designs, providing developers with extraordinary flexibility. However, this flexibility also provides opportunities for the implantation of Hardware Trojans, including the integration of third-party IP cores, the use of external libraries, and at various stages of bitstream generation and distribution.

[0003] Despite the importance of FPGA security, the current application development process often lacks effective Trojan detection mechanisms, which not only increases the risk of system attacks by Hardware Trojans, but also poses significant challenges to security protection. SUMMARY

[0004] To solve the above problems in the prior art, that is, the current application development process usually lacks an effective Trojan detection mechanism, the present application provides a Trojan detection method for an FPGA netlist based on a graph neural network, the method comprising:

[0005] HDL code is obtained by describing digital logic and system architecture with HDL; the HDL code is converted into a gate-level representation by an EDA tool, logic blocks of the gate-level representation are allocated to an FPGA chip and connections are planned, and a bitstream file is generated based on the FPGA chip after the planning of connections;

[0006] The bitstream file is downloaded to the FPGA chip, and a netlist file of the FPGA is obtained based on the downloaded bitstream file;

[0007] The edges and nodes of an original directed graph are determined, the netlist file is converted into the original directed graph, Trojan features of the nodes in the original directed graph are set, and the original directed graph is converted into a feature directed graph based on the Trojan features of the nodes in the original directed graph;

[0008] Malicious logic nodes and normal nodes in the feature directed graph are balanced to obtain a balanced directed graph;

[0009] The nodes of the balanced directed graph are classified using a trained graph convolutional network to obtain a classification result of the nodes of the balanced directed graph, that is, a Trojan detection result of the netlist file.

[0010] In a preferred embodiment, the Trojan features of each node in the original directed graph include: the number of fan-in signals at a distance of x levels from the current node; the number of flip-flops in the input and output directions at a distance of x levels from the current node; the number of multiplexers within a distance of x levels from the current node; the number of inverters within a distance of x levels from the current node; x = 1, 2, 3, 4, 5; the distance of the nearest basic input from the current node; the distance of the nearest basic output from the current node; and the number of y-level ring structures contained in the current node, y = 3, 4, 5.

[0011] In a preferred embodiment, the method for extracting the Trojan features of the nodes in the original directed graph to obtain a feature directed graph is as follows:

[0012] For the i-th node v i in the original directed graph, the i-th node v i is put into an initialization queue Q; when a certain dimension Trojan feature of the node v i is calculated, the traversal layer number m = x or y, where x and y are the number of levels of the certain dimension feature from the node v i ;

[0013] Take the first node v of the initialization queue Q as the first element, and obtain all adjacent nodes of the first element v according to the structure of the original directed graph;

[0014] Put all adjacent nodes of the first element v into the initialization queue Q in turn for a traversal loop; after the traversal loop ends, calculate the eigenvalues of all nodes put into the initialization queue; when the current layer j of the initialization queue satisfies the traversal condition, traverse the current layer j of the initialization queue Q, until all layers satisfying the traversal condition are traversed; the traversal condition is that j < m and the initialization queue Q is not empty;

[0015] For node v i , the method for calculating its eigenvalue is: the distance between the current Trojan feature of node v i and node v i is m levels, and the current traversal layer is m; m = x or y; put all nodes meeting the current Trojan feature into the current initial queue, and perform a traversal loop in turn, after the traversal loop, the number of nodes meeting the current Trojan feature type in the current initial queue is the eigenvalue of the current Trojan feature of v i ;

[0016] The eigenvalues of all Trojan features of all nodes together form a feature matrix F; F[v i ,:] represents the feature of node v i ;

[0017] Based on the feature matrix F, a feature directed graph is obtained:

[0018] V = {v1, v2, …, v n}; A ∈ R n×n ; F ∈ R n*d ;

[0019] Wherein, V = {v1, v2, …, v n} is a set composed of n nodes, is the adjacency matrix of, represents the feature matrix of the node, is the feature of node j, and d is the dimension of the node feature.

[0020] In a preferred embodiment, the method for obtaining a balanced directed graph is:

[0021] Using an encoder to extract the original features of the feature directed graph to a low-dimensional embedding space to obtain the embedding representation of the original features:

[0022]

[0023] in, It is the embedding representation of the original node v; F[v,:] represents the features of v; A[:,v] is The v-th column of the adjacency matrix, σ is the activation function, W 1 Represents the weight matrix;

[0024] The neighboring nodes of the new node are generated using the synthetic point generator based on the original feature embedding representation;

[0025]

[0026] Where nn(v) represents the nearest neighbor node of node v. The embedding representation of node u, argmin u This indicates that the function The node u; Y reaches its minimum value. u Y represents the type of node u. v Indicates the type of node v;

[0027] The synthesized point generator generates new nodes based on the embedding representation of the original features and the neighboring nodes of the new node:

[0028]

[0029] Among them, v * Indicates a new node. It is v * Embedded representation, It is the embedded representation of the neighboring nodes of the new node;

[0030] By controlling the number of newly synthesized nodes, the number of samples in each class can be balanced.

[0031] The decoder establishes a connection between the new node and the original node:

[0032]

[0033] It is the predicted v * The connection relationship between u, w represents any node in the graph, v * This indicates the newly generated node. This represents the embedding representation of the new node. Let S represent the embedding representation of any node, and let S represent the feature matrix, i.e., the training target.

[0034] Based on the new node and the original node, update the adjacency matrix:

[0035]

[0036] wherein, denotes the updated adjacency matrix, v' denotes, u denotes, E v′,u denotes, η denotes a constant value;

[0037] Based on the updated node, the updated adjacent matrix, the balanced directed graph is obtained

[0038] wherein, is the updated node set, is the updated adjacency matrix of, denotes the feature matrix of the updated node.

[0039] In a preferred embodiment, the method for updating the node features of the balanced directed graph by the graph convolution network is:

[0040] inputting the balanced directed graph into the graph convolution network, the graph convolution network updates the node features of the balanced directed graph by aggregating the own features and the adjacent nodes:

[0041]

[0042] wherein, H (l) is the activation matrix of the lth layer, is the original adjacency matrix plus self-connection, I is the unit matrix, is the diagonal node degree matrix of, W (l) is the weight matrix of the lth layer, σ is a nonlinear activation function; H (l+1) is the activation matrix of the (l+1)th layer;

[0043] For each node in the balanced directed graph, the trained GCN model uses the softmax function to calculate the probability of non-malicious nodes and the probability of malicious nodes P(P) according to the features and the connection relationship.

[0044] If P(N)>P(P), the node is determined to be a negative node; if P(N)<P(P), the node is determined to be a positive node.

[0045] In a preferred embodiment, the training process of the encoder, the synthetic node generator and the decoder is:

[0046] obtaining a first training data set; the first training data set includes a feature directed graph converted based on the netlist file;

[0047] Inputting the sample in the first training data set into the encoder, sequentially passing through the processing of the encoder, the synthetic node generator and the decoder, a prediction result of the connection relationship between nodes is obtained;

[0048] Based on the prediction result of the connection relationship between nodes and the corresponding label, a loss value is calculated, and the parameters of the encoder, the synthetic node generator and the decoder are updated;

[0049] The loss function of the decoder during training is:

[0050]

[0051] The loss function of the edge generator is represented by E, wherein E is the predicted node connection relationship, A is the known node connection relationship in the directed graph, The square of the Frobenius norm is represented by || || F ;

[0052] Cyclic training is performed until the trained encoder, synthetic node generator and decoder are obtained.

[0053] In a preferred embodiment, the graph convolutional network is trained by assigning a weight to the loss function of the training graph convolutional network, and the loss function after assigning the weight is:

[0054] Wherein N is the number of nodes in the balanced directed graph , K is the number of categories of nodes, y i,k is a one-hot code of whether node i belongs to category k, is the predicted probability that node i belongs to category k, is the loss function, w k is the weight of category k.

[0055] The second aspect of the application provides a FPGA netlist-oriented Trojan detection method system based on a graph neural network, the system comprising:

[0056] A file generation module is configured to obtain HDL code by describing digital logic and system architecture with HDL, convert the HDL code into a gate-level representation by an EDA tool, allocate the logic blocks of the gate-level representation to an FPGA chip and plan the connections, and generate a bitstream file based on the FPGA chip after planning the connections;

[0057] A file download module is configured to download the bitstream file to the FPGA chip, and obtain a netlist file of the FPGA based on the downloaded bitstream file;

[0058] A directed graph generation module is configured to convert the netlist file into an original directed graph, set a Trojan feature of a node in the original directed graph, and extract the Trojan feature of the node in the original directed graph to obtain a feature directed graph.

[0059] A directed graph balancing module is configured to balance malicious logic nodes and normal nodes in the feature directed graph to obtain a balanced directed graph.

[0060] A node classification module is configured to classify nodes of the balanced directed graph by using a trained graph convolutional network to obtain a classification result of the nodes of the balanced directed graph, i.e., a Trojan detection result of the netlist file.

[0061] In a third aspect, the present application provides an electronic device, comprising:

[0062] at least one processor; and

[0063] a memory in communication with the at least one processor; wherein

[0064] The memory stores instructions executable by the processor, and the instructions are used to be executed by the processor to implement the above-mentioned FPGA netlist Trojan detection method based on a graph neural network.

[0065] In a fourth aspect, the present application provides a computer readable storage medium, which stores computer instructions, and the computer instructions are used to be executed by the computer to implement the above-mentioned FPGA netlist Trojan detection method based on a graph neural network.

[0066] The present application has the following advantages:

[0067] (1) The present application aims to develop a hardware Trojan detection algorithm based on a graph neural network applied to EDA software, combine the algorithm with a design workflow, and finally integrate the algorithm into a proprietary EDA tool HT-FDS, so that the Trojan detection result has excellent performance.

[0068] (2) The present application proposes a security-oriented design workflow, adopts a special algorithm that can produce excellent Trojan detection results, and integrates the Trojan detection algorithm into a development environment to ensure continuous security. The introduction of a design process that prioritizes security from the beginning is a major change in the FPGA design method. This preemptive security concern aims to address potential vulnerabilities in the initial stages of design, thereby reducing the risk of security vulnerabilities and ensuring the integrity of the final product.

[0069] (3) By utilizing deep learning and graph network technologies, this paper demonstrates the effectiveness of these algorithms in identifying and mitigating hidden malicious circuits, thereby significantly enhancing the security of EDA and FPGA designs. By embedding the Trojan detection algorithm into the EDA design workflow, this research ensures that security checks become an integral part of the design process. This seamless integration facilitates continuous security verification throughout the development cycle, enabling developers to identify and correct potential vulnerabilities in real-time. Therefore, this approach not only enhances the security of the design process but also simplifies the workflow, making security checks less intrusive and more efficient. BRIEF DESCRIPTION OF DRAWINGS

[0070] Other features, objects, and advantages of the application will become more apparent from the following detailed description of non-limiting embodiments, when read in conjunction with the accompanying drawings:

[0071] Fig. 1 is a flowchart of a graph neural network-based FPGA netlist-oriented Trojan detection method according to an embodiment of the present application;

[0072] Fig. 2 is a flowchart of a method for balancing malicious logic nodes and normal nodes in a balanced feature directed graph according to an embodiment of the present application;

[0073] Fig. 3 is a flowchart of a software design and development process for the Hongtu series according to an embodiment of the present application;

[0074] Fig. 4 is a structural diagram of a computer system of a server for implementing the method, system, and device embodiments of the present application. DETAILED DESCRIPTION

[0075] The present application will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are intended to explain the relevant application, but not to limit the application. In addition, it should be noted that only the parts related to the application are shown in the drawings for ease of description.

[0076] It should be noted that the embodiments and features in the embodiments of the present application can be combined with each other without conflict. The present application will be described in detail below with reference to the accompanying drawings and embodiments.

[0077] The present application provides a graph neural network-based FPGA netlist-oriented Trojan detection method, which comprises:

[0078] HDL code is obtained by describing digital logic and system architecture with HDL; the HDL code is converted into a gate-level representation by an EDA tool, the logic blocks of the gate-level representation are allocated to an FPGA chip and the connections are planned, and a bitstream file is generated based on the FPGA chip after planning the connections;

[0079] download the bitstream file to the FPGA chip, and obtain a netlist file of the FPGA based on the downloaded bitstream file;

[0080] determine edges and nodes of an original directed graph, convert the netlist file into the original directed graph, set a Trojan feature of a node in the original directed graph, and convert the directed graph into a feature directed graph based on the Trojan feature of the node in the original directed graph;

[0081] balance malicious logic nodes and normal nodes in the feature directed graph, and obtain balanced features;

[0082] use the trained graph convolutional network to classify nodes of the balanced directed graph, and obtain a classification result of the nodes of the balanced directed graph, that is, a Trojan detection result of the netlist file.

[0083] In order to more clearly describe the FPGA netlist-oriented Trojan detection method based on a graph neural network of the present application, the steps in the embodiments of the present application will be described in detail below in combination with FIG. 1.

[0084] The FPGA netlist-oriented Trojan detection method based on a graph neural network of the first embodiment of the present application is described in detail as follows:

[0085] obtain HDL code by describing digital logic and system architecture with HDL, convert the HDL code into a gate-level representation by an EDA tool, allocate logic blocks of the gate-level representation to an FPGA chip and plan connections, and generate a bitstream file based on the FPGA chip after the planning of the connections;

[0086] Specifically, in the workflow of FPGA design, EDA (Electronic Design Automation) tools play a crucial role in bridging the gap between design concepts and actual hardware. In this process, designers first use hardware description languages (HDLs) such as Verilog or VHDL to meticulously describe digital logic and system architecture. Subsequently, EDA tools perform the synthesis phase, converting the HDL code into a gate-level representation while optimizing it to meet constraints on timing, power consumption, and area. Then, the design enters the verification phase, where designers use simulation to ensure that the synthesized logic aligns with the original design intent and to verify the absence of logical errors. This step is critical as it prevents costly rework. After verification, the design enters the place and route phase, where EDA tools assign logic blocks to physical locations on the FPGA chip and plan their connections, addressing any potential timing issues. Finally, after careful optimization during the place and route process, EDA tools generate a bitstream file, which is a sequence of data that precisely configures the internal logic cells and their interconnections of the FPGA. Designers then download the bitstream onto the FPGA chip, realizing the design concept. From the input of the design to the final hardware implementation, each step of this process relies on the powerful capabilities of EDA tools, ensuring efficient implementation and rapid iteration, significantly improving development efficiency and success rate. The Hongtu series software is a set of powerful tools developed by the Beijing Microelectronics Technology Institute (BMTI) for software and hardware development environments and embedded platforms. As shown in Figure 2, Hongtu can meet various needs such as full-process FPGA development, configuration download, soft error sensitivity evaluation, soft error mitigation optimization, embedded integrated development, and on-chip programmable system development. Hongtu can help developers create custom hardware accelerators and implement radiation-resistant and high-security designs as needed. These tools enable developers in the aerospace, defense, and industrial sectors to use BMTI's high-reliability, radiation-resistant, and long-life chip solutions. The Hongtu FPGA Design Suite (HT-FDS) is an FPGA EDA software independently developed by the Beijing Microelectronics Technology Institute, covering the complete design flow from HDL circuit function description to bitstream download, providing common functions such as project management, file editing, compilation flow calling, information feedback, and log printing.

[0087] The Trojan detection component is embedded in the HT-FDS framework to enhance the security of the FPGA. It is integrated into the post-synthesis stage and performs security checks to determine whether the design contains Trojan nodes. After identifying and filtering out Trojan nodes, the subsequent steps of the design flow, such as placement and routing, will continue, while ensuring the security of the FPGA. By directly embedding this security function in HT-FDS, potential vulnerabilities can be identified and addressed early in the development cycle, thereby improving the overall security and integrity of FPGA-based systems. This innovation not only protects hardware from malicious threats, but also simplifies the design workflow, thereby improving the efficiency and reliability of FPGA development projects.

[0088] The bitstream file is downloaded onto the FPGA chip, and a netlist file of the FPGA is obtained based on the downloaded bitstream file;

[0089] The method for converting the netlist file into a primitive directed graph is: each logic unit in the netlist file is converted into a node in the primitive directed graph, and each signal or current in the netlist file is converted into an edge in the primitive directed graph, and the arrow direction of the edge in the primitive directed graph represents the output direction of the signal or current.

[0090] The edges and nodes of the primitive directed graph are determined, the netlist file is converted into a primitive directed graph, the Trojan features of the nodes in the primitive directed graph are set, and the directed graph is converted into a feature directed graph based on the Trojan features of the nodes in the primitive directed graph.

[0091] The Trojan features of each node in the primitive directed graph include: the number of fan-in signals at a distance of x levels from the current node; the number of flip-flops at a distance of x levels in the input and output directions of the current node; the number of multiplexers within a distance of x levels from the current node; the number of inverters within a distance of x levels from the current node; x = 1, 2, 3, 4, 5; the distance of the nearest basic input from the current node; the distance of the nearest basic output from the current node; the number of y-level ring structures contained in the current node, y = 3, 4, 5.

[0092] Seven types of features, including fan-in features, flip-flop features, multiplexer features, and input-output topology depth features, are selected, totaling 30 features, as structural features of the Trojan to describe the properties of the gate-level Trojan. The Trojan features of the nodes are shown in Table 1.

[0093] In this embodiment, the method for extracting the Trojan features of the nodes in the primitive directed graph to obtain a feature directed graph is:

[0094] For the i-th node v i , the i-th node v iPut into the initialization queue Q; calculate the node v i When traversing a certain dimension Trojan feature, the layer number m=x or y is traversed, where x, y are the order of the certain dimension feature distance node v i ;

[0095] Take the first node v of the initialization queue Q as the first element, and obtain all adjacent nodes of the first element v according to the structure of the original directed graph;

[0096] Put all adjacent nodes of the first element v into the initialization queue Q in turn for traversal cycle; after the traversal cycle ends, calculate the feature values of all nodes put into the initialization queue; when the current layer j of the initialization queue satisfies the traversal condition, traverse the current layer j of the initialization queue Q until all layers satisfying the traversal condition are traversed; the traversal condition is: j

[0097] For node v i , the method for calculating the feature value is: the current Trojan feature distance of node v i from node v i is m levels, and the current traversal layer number is m; m=x or y; put all nodes meeting the current Trojan feature into the current initial queue, and perform traversal cycle in turn; after the traversal cycle, the number of nodes meeting the current Trojan feature type in the current initial queue is the feature value of the current Trojan feature of v i ;

[0098] The feature values of all Trojan features of all nodes together form a feature matrix F; F[v i ,:] represents the feature of node v i ;

[0099] Based on the feature matrix F, a feature directed graph is obtained:

[0100] V={v1,v2,…,v n}; A∈R n×n ; F∈R n*d ;

[0101] Where V={v1,v2,…,v n} is a set consisting of n nodes, is the adjacency matrix of V, represents the feature matrix of the node, is the feature of node j, and d is the dimension of the node feature.

[0102] Specific examples of calculating the eigenvalues are as follows: when calculating the fan_in_5 of node v, the number of elements in the queue Q is the eigenvalue of the fan_in_5 of node v after traversing the layer number m = 5 and putting all the 5-level fan-in nodes of the input distance of v into the queue Q; when calculating the out_flipflop_4 of node v, the number of nodes with the attribute flipflop in the queue Q is the eigenvalue of the out_flipflop_4 of node v after traversing the layer number m = 4 and putting all the 4-level nodes of the output distance of v into the queue Q.

[0103] Balancing the malicious logic nodes and normal nodes in the feature directed graph to obtain a balanced directed graph; as shown in FIG. 3, the method for obtaining the balanced directed graph is as follows:

[0104] Extracting the original features of the feature directed graph to a low-dimensional embedding space by using an encoder to obtain an embedding representation of the original features:

[0105]

[0106] wherein, is the embedding representation of the original node v; F[v, : ] represents the features of v; A[:, v] is the v-th column of the adjacency matrix of ; σ is an activation function, and W 1 represents a weight matrix;

[0107] Generating the neighboring nodes of a new node based on the embedding representation of the original features by using a synthetic point generator;

[0108]

[0109] wherein, nn(v) represents the nearest neighbor nodes of node v, is the embedding representation of node u, and argmin u represents the node u that makes the function reach the minimum value; Y u represents the category of node u, and Y v represents the category of node v;

[0110] Generating a new node based on the embedding representation of the original features and the neighboring nodes of the new node by using the synthetic point generator:

[0111]

[0112] wherein, v * represents the new node, is the embedding representation of v * , and is the embedding representation of the neighboring nodes of the new node;

[0113] By controlling the number of new nodes synthesized, the number of samples of each class is balanced;

[0114] Through the decoder, the new node and the original node establish a connection relationship:

[0115]

[0116] is the predicted connection relationship between v * and u, w represents any node in the graph, v * represents the generated new node, represents the embedding representation of the new node, represents the embedding representation of any node, and S represents the feature matrix, i.e., the training target;

[0117] Based on the new node and the original node, update the adjacency matrix:

[0118]

[0119] wherein, represents the updated adjacency matrix, v' represents, u represents, E v′,u represents, and η represents a constant value;

[0120] Based on the updated node, the updated adjacency matrix, a balanced directed graph

[0121] wherein, is the updated node set, is the updated adjacency matrix of, represents the feature matrix of the updated node.

[0122] Hardware Trojans are usually small in size and highly concealed, and are designed to be activated under certain conditions, so they are difficult to detect during standard testing. This results in a highly imbalanced dataset in the netlist (a dataset describing the logic and structure of the hardware circuit), with Trojan nodes being extremely rare compared to normal nodes. This imbalance poses a great challenge to hardware Trojan detection methods based on machine learning.

[0123] Therefore, we use GraphSMOTE to balance the dataset. Through the previous steps, we obtain a directed graph To solve the problem of data imbalance, we apply the GraphSMOTE algorithm to the original dataset as input after the second section. Through the processes of encoding, node generation, and decoding, we obtain a balanced dataset, denoted as This balanced method greatly improves the efficiency of subsequent analysis.

[0124] Table 2 is the number of normal nodes and Trojan nodes of several circuits before and after balancing processing. The processed data set achieves the balance of the number of normal nodes and Trojan nodes. Table 2

[0125] The trained graph convolutional network is used to classify the nodes of the balanced directed graph, and the classification results of the nodes of the balanced directed graph are obtained, that is, the Trojan detection results of the netlist file.

[0126] In this embodiment, the method for classifying the nodes of the balanced directed graph using the trained graph convolutional network comprises:

[0127] The balanced directed graph is input into the graph convolutional network, and the graph convolutional network updates the node features of the balanced directed graph by aggregating its own features and adjacent nodes:

[0128]

[0129] wherein H (l) is the activation matrix of the lth layer, is the original adjacency matrix plus self-connection, and I is the unit matrix, is the diagonal node degree matrix of , W (l) is the weight matrix of the lth layer, and sigma is a nonlinear activation function.

[0130] For each node in the balanced directed graph, the trained GCN model uses a softmax function to calculate the probability of a non-Trojan node and the probability of a Trojan node P(P) according to the features and connection relationships.

[0131] The true positive rate (TPR), true negative rate (TNR), and F1 score are used as evaluation indicators for the experiment. Assuming that TP is the number of true positive predictions (correctly identifying Trojan nodes), TN is the number of true negative predictions (correctly identifying normal nodes), FP is the number of false positive predictions (normal nodes being incorrectly classified as Trojans), and FN is the number of false negative predictions (Trojan nodes being incorrectly classified as normal nodes). TPR, TNR, and F1 score can be expressed as: All PTΛ-level Trojan circuits on the trust-ηυβ are selected for the experiment. The experimental results are shown in Table 3; Table 3

[0132] Table 4 summarizes the results of several other research methods; other literature uses the GraphSAGE model to train the classifier, and the true negative rate (TNR) of this method reaches 99.8%; however, our method improves the true positive rate (TPR) and F1 score, but the TNR decreases slightly. The random forest method can identify hardware Trojans without false positives, resulting in a TNR of 100%, but the TPR is low, resulting in a lower F1 score. Reference

[0015] introduces adversarial training in Trojan detection, with a TPR of 96.8%, but the F1 score is significantly reduced due to the decrease in TNR. In summary, the method proposed in this paper not only focuses on improving the accuracy of Trojan detection (as evidenced by the improvement in TPR), but also achieves the highest F1 score among the compared methods, showing its balanced performance in F1 score and TPR.

[0133] Different weight values can result in different detection results, as shown in Table 5: Table 5

[0134] The present application also includes the training process of the encoder, the synthetic node generator, and the decoder:

[0135] Obtain a first training data set; the first training data set includes a feature directed graph converted based on the netlist file;

[0136] Input the samples in the first training data set into the encoder, and sequentially pass through the processing of the encoder, the synthetic node generator, and the decoder to obtain a prediction result of the connection relationship between nodes;

[0137] Based on the prediction result of the connection relationship between nodes and its corresponding label, calculate the loss value, and then update the parameters of the encoder, the synthetic node generator, and the decoder;

[0138] The loss function of the decoder during training is:

[0139]

[0140] The loss function of the edge generator is represented as E, where E is the predicted node connection relationship, A is the known node connection relationship in the directed graph, represents the square of the Frobenius norm;

[0141] Loop training until the trained encoder, synthetic node generator, and decoder are obtained.

[0142] In the training process of GCN, it is found that the weight parameter (Weight) in the CrossEntropyLoss has a great influence on the training results of GCN. Different results are obtained for different weight values. Since in the process of Trojan detection, the cost of judging a positive node as a negative node (false negative, FN) is much higher than that of judging a negative node as a positive node (false positive, FP), that is, the weight proportions of the two different errors are different, therefore, the weight parameter in the CrossEntropyLoss is adjusted, and the optimal parameter value is obtained by adjustment. After the training of GCN is completed, we can start the detection process and apply the trained model to classify each node in the circuit. This step includes inputting the graph data representing the circuit into the GCN model. Then, the model will use the learned weights and graph structure to predict the class of each node based on the provided features and connection information. For each point in the directed graph data, the GCN model will calculate the probability P(N) that it belongs to a negative node (i.e. a non-Trojan node) and the probability P(P) that it belongs to a positive node (i.e. a Trojan node), and compare the two; if P(N)>P(P), the node is a negative node; if P(N)<P(P), the node is a positive node.

[0143] The graph convolutional network is trained by assigning a weight to a loss function of the graph convolutional network, and the loss function after assigning the weight is:

[0144] Where N is the number of nodes in the balanced directed graph , K is the number of node classes, y i,k is a one-hot code of whether node i belongs to class k, is the predicted probability that node i belongs to class k, is the loss function, w k is the weight of class k.

[0145] Although the above embodiments describe the steps in the above order, those skilled in the art can understand that, in order to achieve the effect of the embodiments, the steps do not have to be executed in this order, they can be executed simultaneously (in parallel) or in reverse order, and these simple changes are within the protection scope of the present application.

[0146] The Trojan detection method system for FPGA netlist based on graph neural network of the second embodiment of the present application, characterized in that the system comprises:

[0147] The file generation module is configured to generate HDL code by using HDL to describe digital logic and system architecture; the HDL code is converted into a gate-level representation by an EDA tool, logic blocks of the gate-level representation are allocated to an FPGA chip and connection planning is performed, and a bitstream file is generated based on the FPGA chip after the connection planning;

[0148] The file download module is configured to download the bitstream file to the FPGA chip, and obtain a netlist file of the FPGA based on the downloaded bitstream file.

[0149] The directed graph generation module is configured to convert the netlist file into an original directed graph, set a Trojan feature of a node in the original directed graph, and extract the Trojan feature of the node in the original directed graph to obtain a feature directed graph.

[0150] The directed graph balancing module is configured to balance malicious logic nodes and normal nodes in the directed graph to obtain a balanced directed graph.

[0151] The node classification module is configured to classify nodes of the balanced directed graph by using a trained graph convolutional network to obtain a classification result of the nodes of the balanced directed graph, that is, a Trojan detection result of the netlist file.

[0152] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process and related description of the system described above can refer to the corresponding process in the foregoing method embodiments, which will not be described here.

[0153] It should be noted that the FPGA netlist-oriented Trojan detection method system based on a graph neural network provided in the foregoing embodiments is only exemplified by the division of the foregoing functional modules, and in actual application, the foregoing functions can be completed by different functional modules according to needs, that is, the modules or steps in the embodiments of the present application are further decomposed or combined, for example, the modules in the foregoing embodiments can be combined into one module, or can be further split into multiple sub-modules to complete all or part of the functions described above. The names of the modules and steps involved in the embodiments of the present application are only for distinguishing the modules and steps, and should not be considered as an improper limitation of the present application.

[0154] The third embodiment of the electronic device comprises at least one processor and a memory in communication connection with the at least one processor, wherein the memory stores instructions executable by the processor, and the instructions are used to implement the FPGA netlist-oriented Trojan detection method based on a graph neural network.

[0155] The fourth embodiment of the application is a computer readable storage medium storing computer instructions for being executed by a computer to implement the above-mentioned FPGA netlist-oriented Trojan detection method based on a graph neural network.

[0156] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the storage device and the processing device described above and the related descriptions can refer to the corresponding processes in the foregoing method embodiments, which will not be described here.

[0157] Those skilled in the art should be aware that the modules and method steps of each example described in connection with the embodiments disclosed herein can be implemented by electronic hardware, computer software, or a combination of the two. The software modules and method steps corresponding to the program can be stored in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM (EPROM), an electrically erasable programmable ROM (EEPROM), a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art. In order to clearly illustrate the interchangeability of electronic hardware and software, the components and steps of each example have been generally described in the foregoing description. Whether the functions are performed by electronic hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

[0158] Reference is made below to FIG. 4, which shows a structural schematic diagram of a computer system of a server for implementing the method, system, and device embodiments of the present application. The server shown in FIG. 4 is merely an example and should not impose any limitation on the functions and use range of the embodiments of the present application.

[0159] As shown in FIG. 4, the computer system includes a central processing unit (CPU) 601, which can perform various appropriate actions and processes according to programs stored in a read-only memory (ROM) 602 or loaded from a storage portion 608 to a random access memory (RAM) 603. In the RAM 603, various programs and data required for system operation are also stored. The CPU 601, the ROM 602, and the RAM 603 are connected to each other through a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.

[0160] The following components are connected to the I / O interface 605: an input section 606 including input devices such as a keyboard and mouse; an output section 607 including output devices such as a cathode ray tube (CRT), a liquid crystal display (LCD), and a speaker; a storage section 608 including a hard disk; and a communication section 609 including a network interface card such as a LAN (Local Area Network) card, a modem, and the like. The communication section 609 performs communication processing via a network such as the Internet. A drive 610 is also connected to the I / O interface 605 as necessary. A removable medium 611 such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, and the like is attached to the drive 610 as necessary, so that a computer program read out therefrom is installed in the storage section 608 as necessary.

[0161] In particular, the processes described above with reference to the flow charts can be implemented as a computer software program according to embodiments of the present disclosure. For example, embodiments of the present disclosure include a computer program product comprising a computer program carried on a computer readable medium, the computer program comprising program code for performing the methods illustrated by the flow charts. In such embodiments, the computer program can be downloaded and installed from a network via the communication section 609, and / or installed from the removable medium 611. When the computer program is executed by the central processing unit (CPU) 601, the above-described functions defined in the methods of the present application are performed. It should be noted that the computer readable medium of the present application can be a computer readable signal medium or a computer readable storage medium or any combination of the two. The computer readable storage medium can be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus or device, or any suitable combination of the above. More specific examples of the computer readable storage medium can include, but are not limited to, an electrical connection having one or more wires, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, the computer readable storage medium can be any tangible medium that contains or stores a program that can be used by or in connection with an instruction execution system, apparatus or device. In the present application, the computer readable signal medium can include a data signal carried in a baseband or as part of a carrier wave, in which the computer readable program code is carried. Such a propagated data signal can take any of a variety of forms, including but not limited to electro-magnetic, optical, or any suitable combination thereof. The computer readable signal medium can also be any computer readable medium that is not a computer readable storage medium and that can communicate, propagate or transport a program for use by or in connection with an instruction execution system, apparatus or device. The program code contained on the computer readable medium can be transmitted by any suitable medium, including but not limited to wireless, wire line, optical fiber cable, RF, etc., or any suitable combination of the above.

[0162] Computer program code for carrying out operations of the present application can be written in any combination of one or more programming languages, including an object oriented programming language such as Java, Smalltalk, C++ or the like and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code can execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the latter scenario, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection can be made to an external computer (for example, through the Internet using an Internet Service Provider).

[0163] The computer program instructions can also be loaded onto a computer or other programmable information processing apparatus to cause a series of operations to be performed on the computer or other programmable information processing apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable information processing apparatus implement the functions / acts specified in the flowchart and / or block diagram block or blocks.

[0164] The terms "first", "second", etc. are used to distinguish between similar objects, and are not used to describe or indicate a particular order or sequence.

[0165] The terms "comprises", "comprising", or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but can also include other elements not expressly listed or inherent to such process, method, article, or apparatus.

[0166] The technical scheme of the present application has been described in combination with the preferred embodiments shown in the drawings, but it is easy for those skilled in the art to understand that the protection scope of the present application is obviously not limited to these specific embodiments. Those skilled in the art can make equivalent changes or replacements to the related technical features without departing from the principles of the present application, and the technical schemes after the changes or replacements will all fall within the protection scope of the present application.

Claims

1. A Trojan detection method based on a graph neural network for an FPGA netlist, characterized in that, The method comprises: The HDL code is obtained by describing digital logic and system architecture with HDL; the HDL code is converted into a gate-level representation by an EDA tool, logical blocks of the gate-level representation are allocated to an FPGA chip and connection planning is performed, and a bitstream file is generated based on the FPGA chip after the connection planning; The bitstream file is downloaded to the FPGA chip, and a netlist file of the FPGA is obtained based on the downloaded bitstream file; Edges and nodes of an original directed graph are determined, the netlist file is converted into the original directed graph, the Trojan features of the nodes in the original directed graph are set, and the Trojan features of the nodes in the original directed graph are extracted to obtain a feature directed graph; Malicious logic nodes and normal nodes in the feature directed graph are balanced to obtain a balanced directed graph; The nodes of the balanced directed graph are classified by using a trained graph convolutional network to obtain the classification results of the nodes of the balanced directed graph, that is, the Trojan detection results of the netlist file.

2. The FPGA netlist-oriented Trojan detection method based on a graph neural network according to claim 1, characterized in that, The method for converting the netlist file into an original directed graph comprises: Each logical unit in the netlist file is converted into a node in the original directed graph, and each signal or current in the netlist file is converted into an edge in the original directed graph, and the arrow direction of the edge in the original directed graph represents the output direction of the signal or the current.

3. The FPGA netlist-oriented Trojan detection method based on a graph neural network according to claim 2, characterized in that, The Trojan features of each node in the original directed graph comprise: the number of fan-in signals at a distance of x levels from the current node; the number of flip-flops at a distance of x levels in the input and output directions of the current node; the number of multiplexers at a distance of x levels from the current node; the number of inverters within a distance of x levels from the current node; x = 1, 2, 3, 4, 5; the distance of the nearest basic input from the current node; the distance of the nearest basic output from the current node; and the number of y-level ring structures contained in the current node, y = 3, 4, 5.

4. The FPGA netlist-oriented Trojan detection method based on a graph neural network according to claim 3, characterized in that, The method for extracting the Trojan features of the nodes in the original directed graph to obtain a feature directed graph comprises: For the i-th node v of the original directed graph i put the i-th node v i into an initialization queue Q; Computing node v i Some dimension Trojan feature of v, traverses the layer number m=x or y, where x, y are the order of the distance node v i Some dimension feature A first node v of the initialization queue Q is taken as a first element, and all adjacent nodes of the first element v are obtained according to the structure of the original directed graph; All adjacent nodes of the first element v are sequentially put into the initialization queue Q for a traversal cycle; when the current layer j of the initialization queue satisfies a traversal condition, the current layer j of the initialization queue Q is traversed until all layers satisfying the traversal condition are traversed; the traversal condition is that j < m and the initialization queue Q is not empty; After the traversal cycle ends, the feature values of all nodes put into the initialization queue are calculated; For node v i , the method for calculating its eigenvalue is: the current Trojan feature distance of node v i from the distance of node v i is m levels, the current traversal layer is m; m=x or y; all nodes meeting the current Trojan feature are put into the current initial queue, and the traversal loop is performed in turn, after the traversal loop, the number of nodes meeting the current Trojan feature type in the current initial queue is the eigenvalue of the current Trojan feature of v i . The eigenvalues of all the Trojan features of all the nodes together form the feature matrix F; F[v i ,:] denotes the feature of node v i . Based on the feature matrix F, a feature directed graph is obtained: V = {v1, v2,..., v n}; A e R n×n ; F e R n*d ; where V = {v1, v2,..., vn} is a set of n nodes, n} is a set of n nodes, is the adjacency matrix of g, a feature matrix representing the nodes, is a feature of node j, and d is the dimension of the node feature.

5. The FPGA netlist-oriented Trojan detection method based on a graph neural network according to claim 4, characterized in that, The method for obtaining a balanced directed graph comprises: extracting original features of the feature directed graph to a low-dimensional embedding space by using an encoder to obtain an embedding representation of the original features: wherein is the embedded representation of the original node v; F[v, :] represents the features of v; A[:, v] is the vth column of the adjacency matrix of G, σ is an activation function, W 1 represent a weight matrix; generating, using a synthetic point generator, a nearest neighbor of the new node based on the original feature embedding representation; where nn(v) denotes the nearest neighbor of node v, The embedding representation of node u, argmin u represents such that the function the node u at which the value reaches a minimum; Y u Y represents the class of node u v Y represents the class of node v generating a new node using the synthetic point generator based on an embedding representation of the original feature and a neighboring node of the new node: wherein v * indicates a new node, is v * of the embedded representation, is an embedding representation of a neighboring node of a new node; The number of new nodes is controlled to balance the number of samples of each class; establishing a connection relationship between the new node and the original node by a decoder: is the predicted v * w represents any node in the graph, v * represents the generated new node, an embedded representation representing a new node, is an embedding representation of any node, and S represents a feature matrix, that is, a training target; updating an adjacency matrix based on the new node and the original node: wherein, denotes the updated adjacency matrix, v' denotes the updated vector, u denotes the updated vector, E v′,u denotes the updated vector, η denotes a constant value; Based on the updated node, the updated adjacency matrix, the balanced directed graph is obtained wherein is the updated set of nodes, is updated the adjacency matrix of the graph G, is an updated feature matrix of the node.

6. The FPGA netlist-oriented Trojan detection method based on a graph neural network according to claim 5, characterized in that, The method for classifying the nodes of the balanced directed graph by using a trained graph convolutional network comprises: balancing the directed graph Input into a trained graph convolutional network that updates the node features of the balanced directed graph by aggregating self-features and neighboring nodes: where H (l) is the activation matrix of the lth layer, is the original adjacency matrix plus self-connections, I is the identity matrix, is the diagonal node degree matrix of G, W (l) is the weight matrix of the lth layer, and σ is a nonlinear activation function; H (l+1) is the activation matrix of the (l+1)th layer; For each node in the balanced directed graph, the trained GCN model uses a softmax function to calculate the probability of a non-malicious node and the probability of a malicious node P(P) based on the features and connection relationships.

7. The FPGA netlist-oriented Trojan detection method based on a graph neural network according to claim 6, characterized in that, The training process of the encoder, the synthetic node generator, and the decoder is as follows: Obtain a first training data set; the first training data set includes a feature directed graph converted based on the netlist file; Input the samples in the first training data set into the encoder, and sequentially pass through the processing of the encoder, the synthetic node generator, and the decoder to obtain a prediction result of the connection relationship between nodes; Based on the prediction result of the connection relationship between nodes and its corresponding label, a loss value is calculated, and the parameters of the encoder, the synthetic node generator, and the decoder are updated; The loss function of the decoder at training time is: a loss function representing the edge generator, where E is the predicted node connection relationship, A is the known node connection relationship in the directed graph, denotes the square of the Frobenius norm; The training is repeated until a trained encoder, synthetic node generator, and decoder are obtained.

8. The FPGA netlist-oriented Trojan detection method based on a graph neural network according to claim 7, characterized in that, The graph convolutional network is trained by assigning a weight to a loss function for training the graph convolutional network, and the weighted loss function is: where N is the balanced digraph the number of middle nodes, K is the number of classes of nodes, y i,k is a one-hot code for whether node i belongs to class k, is the predicted probability that node i belongs to class k, is the loss function, w k is the weight of class k.

9. A Trojan detection method system based on a graph neural network for an FPGA netlist, characterized in that, The system comprises: A file generation module is configured to obtain HDL code by describing digital logic and system architecture using HDL; convert the HDL code into a gate-level representation by an EDA tool; allocate logic blocks of the gate-level representation to an FPGA chip and plan connections; and generate a bitstream file based on the FPGA chip after planning the connections; A file download module is configured to download the bitstream file to the FPGA chip and obtain a netlist file of the FPGA based on the downloaded bitstream file; A directed graph generation module is configured to convert the netlist file into an original directed graph; set the Trojan features of the nodes in the original directed graph; and extract the Trojan features of the nodes in the original directed graph to obtain a feature directed graph; A directed graph balancing module is configured to balance malicious logic nodes and normal nodes in the feature directed graph to obtain a balanced directed graph; A node classification module is configured to classify the nodes of the balanced directed graph using a trained graph convolutional network to obtain a classification result of the nodes of the balanced directed graph, i.e., a Trojan detection result of the netlist file.

10. An electronic device, comprising: It comprises: At least one processor; And A memory in communication connection with the at least one processor; wherein The memory stores instructions executable by the processor, and the instructions are used to be executed by the processor to implement the Trojan detection method for FPGA netlist based on graph neural network in any one of claims 1-8.

Images