31 results about "Hardware trojan horse" patented technology

The invention discloses an FPGA (Field Programmable Gate Array) netlist-level hardware Trojan horse detection method based on a large language model, and relates to the technical field of integrated circuit safety and hardware Trojan horse detection, and the method comprises the following steps: constructing an original FPGA netlist into a text attribute graph containing textualized attributes, generating a path text sequence through bidirectional random walk, and carrying out two-way random walk on the path text sequence; constructing a corpus to pre-train a large language model; then, delimiting a local neighborhood by taking each node as a center, generating a path text set, extracting semantic vector representation of the path text set by utilizing a pre-training model, and further constructing a node-level training sample set; on the basis, supervised fine tuning is carried out by combining a classifier and CB-Focal Loss, and a final model is obtained; in the reasoning stage, representation construction and discrimination are carried out on nodes to be detected, and node-level hardware Trojan horse detection is achieved. According to the method, circuit topology and semantic information can be reserved at the same time, node-level hardware Trojan positioning is achieved, the detection precision and generalization ability are improved, and the automation degree is improved.

The invention discloses a sensor hardware Trojan horse detection method and system based on image processing, and belongs to the field of sensor anomaly detection. The method comprises the following steps: acquiring sensor circuit images containing different types and manufacturing processes and containing implanted and non-implanted Trojan horses and corresponding original design files, and introducing quality defects into part of the images; registering images and files, marking Trojan horse areas to construct a first training sample set, and cutting different types of interested areas to construct a second training sample set; the two sample sets are used for training a target recognition model for recognizing a Trojan horse area and a detection model for judging whether the interested area contains image quality defects or not, and finally, the two models are combined, an image restoration technology is introduced, and whether Trojan horses exist in a circuit image of a to-be-detected sensor sample or not is judged. The method can accurately identify the malicious circuit of the sensor, reduces the false alarm through image evaluation and feature extraction, improves the efficiency through automatic detection, guarantees the safety of the sensor, and is suitable for various circuit Trojan horses.

A method for detecting a hardware Trojan horse performed by a processor on hardware may be provided. The method for detecting a hardware Trojan horse includes the steps of: collecting an electromagnetic signal radiated from the hardware; converting the electromagnetic signal into frequency spectrum data; selecting frequency spectrum data of a first frequency band based on the operating frequency of the hardware from the entire frequency band of the frequency spectrum data; extracting a plurality of first feature values ​​from the frequency spectrum data of the selected first frequency band; and comparing an outlier score output from a classification model that takes the plurality of first feature values ​​as input with a set threshold to classify the hardware as normal hardware or abnormal hardware with a hardware Trojan horse inserted.

The invention discloses a hardware Trojan horse design method based on an RISC-V architecture processor branch predictor, and relates to the field of processors and hardware Trojan horses. The hardware Trojan horse designed by the invention is divided into three parts: an interference triggering module, an interference signal generator and a control signal generator, and can implement hidden attack on a branch predictor in a processor. The hardware Trojan is based on a condition triggering mechanism, and allows an attacker to set a specific triggering condition according to the actual operation state and environment of the system, so that the interference behavior is accurately controlled. When the interference triggering module detects a predefined triggering instruction, the interference signal generator generates a specific interference signal and injects the specific interference signal into the branch predictor, so that normal work of the branch predictor is interfered, and the performance of the processor is reduced. Aiming at the working principle of the branch predictor, a targeted interference mode and a non-targeted interference mode are designed and can be flexibly selected according to requirements. The purposeless interference mode comprises a random interference mode and a branch historical interference mode, and disordered interference is carried out on a processor branch prediction mechanism. The purposeful interference mode directly interferes the normal operation process of the processor by modifying the content of the branch target buffer in a targeted manner. The hardware Trojan can effectively interfere the normal operation of the branch predictor, so that the overall performance of the processor is remarkably reduced.

The invention discloses a performance evaluation method and device for a hardware Trojan detection algorithm, equipment and a medium, and relates to the technical field of information security, and the method comprises the steps: controlling a hardware Trojan simulation circuit to generate a first pseudo-random sequence according to a random number seed issued by an upper computer; comparing the first pseudo-random sequence with a second pseudo-random sequence issued by an upper computer to obtain a sequence comparison result; if it is judged that the hardware Trojan simulation circuit meets the preset activation condition according to the sequence comparison result, an encryption protection removal circuit in the hardware Trojan simulation circuit is enabled to replace a side channel protection design circuit in the encryption circuit to operate; performing hardware Trojan detection on the to-be-detected circuit by using the hardware Trojan detection algorithm to obtain a detection result, and performing performance evaluation on the hardware Trojan detection algorithm based on the detection result; wherein the circuit to be detected is a coupling circuit of the encryption circuit and the hardware Trojan simulation circuit. And the performance of the hardware Trojan horse detection algorithm can be evaluated more reliably.

The application discloses a hardware design security vulnerability qualitative analysis method and system, according to a mixed attribute label propagation logic element library and a mixed attribute model construction method based on discrete mapping, so that a corresponding mixed attribute model can be constructed for any HDL design in linear time; the label designed by the mixed attribute model integrates two types of attributes, so that the safety behavior related to the safety attribute and the clock attribute can be modeled simultaneously; the method provided by the application can realize effective discrimination of hardware Trojan horses and hardware time measurement channels by verifying the clock attribute and the safety attribute; the application is deployed in the design and verification stage of the EDA process, so that the HDL design security vulnerability can be detected early, and the design basis is provided for high-reliability hardware design.

The invention provides a hardware Trojan horse detection method and system based on LLM and RTL semantic compression. The method comprises the steps that a to-be-detected modular RTL design circuit containing coarse-grained hardware Trojan horses is prepared; an AST is generated by using PyVerilog and is stored; establishing a tree topology structure according to the instance circuit, and recording depth information; extracting port name and bit width information for each instance circuit; extracting an assignment logic occurrence frequency for each instance circuit; extracting a judgment condition occurrence frequency for each instance circuit; establishing feature similarity between instance circuits by using a cosine similarity algorithm; constructing a modular design current feature set, and preparing an LLM input prediction; proper cue words are designed, and cue word fine adjustment is carried out on the mainstream large model; and obtaining an output result, and carrying out statistical calculation according to the to-be-tested index. The technical problems that static analysis is restricted by code complexity and abstraction levels, and dynamic analysis is easily influenced by insufficient verification scenes are solved.

The application discloses a time-triggered Ethernet switch security test system, which is used for testing RTL design of a time-triggered Ethernet switch, taking RTL design code as platform input, converting the circuit design into a netlist based on a synthesis tool, and further converting the netlist into a model with a security attribute label by using a corresponding model library; meanwhile, according to the security requirement of the time-triggered Ethernet switch, the security attribute to be detected is determined, and the security attribute is mapped into the model by using a formal language. After the model is processed, the verification is carried out by a detection tool, and if a failure result is found, it is indicated that there may exist defects and vulnerabilities. The application is used for security evaluation in the design stage of the time-triggered Ethernet switch, and is used for detecting whether there exist security vulnerabilities and malicious modules in the time-triggered Ethernet switch, verifying whether there exist hardware Trojan horses and the like in third-party IP used in the time-triggered Ethernet switch, and verifying whether the syntax in a self-defined module is standard and whether there exist security vulnerabilities.

The present invention discloses a method and device for measuring the concealment of hardware Trojans based on control difficulty analysis. The method comprises the following steps: step S01. parsing the logic gate circuits in the gate-level netlist under test; step S02. determining whether the clock signal is abnormal; step S03. determining the type of each logic gate circuit; if it is a combinational logic gate circuit, calculating the control difficulty values ​​C0 and C1 of the corresponding combinational logic gate circuit according to the type of the logic gate; if it is a sequential logic gate circuit, calculating the control difficulty values ​​C0 and C1 of the sequential logic circuit according to whether the clock signal is abnormal; step S04. calculating the corresponding concealment value based on the C0 and C1 control difficulty values ​​of each logic gate circuit to evaluate the concealment degree of each logic gate circuit. The present invention can eliminate the dependence on test stimuli and suppress the influence of hardware Trojan morphology and clock signals on concealment measurement.

The hardware Trojan detection method and system based on low activity and low observation node joint analysis belong to the technical field of integrated circuit security, and solve the problem of how to improve the accuracy of identifying high-concealment hardware Trojan; the gate-level netlist is abstracted into a signal propagation directed graph, the nodes in the low activity candidate trigger node set are taken as the starting nodes, the nodes in the low observation candidate load node set are taken as the target nodes, the effective signal propagation path from the starting node to the target node is searched in the directed graph, and if the effective signal propagation path exists, it is determined as a high-risk hardware Trojan potential link; the application proposes a method for identifying high-concealment hardware Trojan potential signal link based on gate-level netlist static analysis, which does not depend on the golden reference model, and does not need to know the Trojan feature library, and is especially suitable for third-party IP core access security detection, backdoor review and logic credibility verification scenes.

The application provides a multi-dimensional layered hardware Trojan evaluation method for an IP soft core, constructs a Trojan multi-dimensional feature library, performs function integrity analysis to identify a first module in which a Trojan may exist, obtains equivalent RTL level code for a module in which no anomaly is found, takes each module of the RTL level code as a node and takes the calling relationship between each module as a weight to establish an information flow graph, compares the information flow graph with the Trojan multi-dimensional feature library to obtain a second module in which a Trojan may exist, analyzes the information flow graph, and takes a module in which the calling is less than a set threshold, a module with an isolated node and a module adjacent to the isolated node in the information flow graph as a third module in which a Trojan may exist, analyzes the first module, the second module and the third module, calculates code coverage, signal flip rate, signal and clock delay anomaly, power consumption anomaly and layout blocking anomaly, and comprehensively evaluates to locate a module in which a Trojan exists in the to-be-detected IP soft core.

The present invention relates to an RTL-level hardware Trojan detection method based on subgraph isomorphism, belonging to the technical field of RTL-level hardware security analysis. The RTL-level hardware Trojan detection method based on subgraph isomorphism provided by the present invention optimizes the subgraph isomorphism algorithm by adding constraint and pruning conditions, quickly and accurately determines the location of the Trojan at a low cost, and gives the confidence level and graphical representation of the detection result, without relying on a reference model, which is convenient for use and popularization.

A kind of hardware Trojan detection and positioning method based on graph convolutional neural network, based on graph learning method, circuit structure is converted into graph structure, and the basic structure features of node are extracted in this process;Based on the construction of two new features Cov and Lfp with depth search strategy and topological logic analysis method to improve the feature information of circuit node;Based on the neighbor feature of GCN aggregation node and update its own node feature information to improve the local perception and generalization ability of node;Using the global feature fusion method based on attention mechanism to extract and update the global feature of graph, and fuse with the node feature vector after aggregating neighbor feature;Based on the idea of stochastic gradient descent and combined with small batch over-sampling and under-sampling method to balance training data;Using multilayer perception machine model to train balanced data based on leave-one-out cross-validation method, and predicting unknown circuit, identifying potential HTs node in circuit.The present application realizes the detection and positioning of HTs.

The application discloses a GPU delay type hardware Trojan design method for NVLink interconnection triggering, belongs to the field of integrated circuit security, and is suitable for a multi-GPU system adopting an NVLink high-speed interconnection. The method implants a hardware Trojan into an NVLink control circuit of a host GPU, collects and counts traffic features of multiple NVLink ports within a preset time window, and judges whether a triggering condition is met based on correlation measurement values between the ports. When the correlation measurement values exceed a preset threshold, delay control is preferentially exerted on control type transactions, atomic transactions and other time delay sensitive transactions in a target port. The application adopts a random bit sequence mapping mode to generate delay strength, and randomly implements non-uniform communication delay without analyzing communication content, so that communication time delay in a multi-GPU cooperative calculation process is increased and overall execution efficiency of the system is reduced.

The application discloses a gate-level netlist hardware Trojan test set generation method based on a large language model, and relates to the field of hardware security. The method firstly uses a carefully designed prompt word to make the large language model provide a hardware Trojan design service; then the large language model generates final design code after continuously iterating and reflecting according to the provided knowledge base and restriction constraints; the design code is evaluated by an evaluator, and the Trojan can be mounted on the parent netlist; the triggering node is determined by analyzing the node concealment, and finally the netlist file after mounting the Trojan is generated.

A method for online monitoring and tracing of hardware Trojans implanted in AI accelerators based on heterogeneous side-channel perception is proposed. This method collaboratively schedules heterogeneous native monitoring resources on FPGAs to capture multi-dimensional side-channel feature fingerprints in situ. It utilizes deep neural networks for spatiotemporal joint modeling and behavior reconstruction, and integrates adaptive compensation strategies to resist thermal drift interference. This enables autonomous monitoring of hardware Trojan behavior and precise physical region tracing within the AI ​​accelerator. This method significantly improves the robustness of hardware Trojan detection under complex conditions without requiring external audit intervention or significantly impacting accelerator inference performance. It also demonstrates good detection generalization ability for various unknown triggering mechanisms, providing a key technical path for the security assessment and risk hardening of convolutional neural network accelerators.

The application belongs to the technical field of integrated circuit hardware security, and discloses a hardware Trojan detection method based on machine learning and mixed sampling. First, the interconnection structure of all gates in the netlist is matched through the inducted low-flip-rate structure; all gates in the netlist are mixed sampled, if the gate does not belong to the low-flip-rate structure, the n-level circuit around the gate is searched and a subgraph is established; if the gate belongs to the low-flip-rate structure, the logic cone where the gate is located is wholly sampled; all connection structures in the feature subgraph are one-hot code encoded, and then accumulated to obtain a fixed-length feature vector; finally, all feature vectors are input to the trained machine learning classifier for node classification, and the hardware Trojan node is detected. The application retains part of the high-dimensional features of the graph, and adopts the mixed sampling mode to expand the feature difference between the hardware Trojan and the normal node, so that the machine learning model can better train and distinguish the hardware Trojan and the normal node, and the detection precision of the detection model is improved.

The application discloses a chip Trojan horse test set generation method based on vulnerability analysis, which comprises the following steps: first, a register transfer level (RTL) code of a circuit is used to obtain a chip layout result, and a chip layout information point set is obtained from the chip layout result; then, a layout space margin and a routing channel margin after chip layout wiring is completed are analyzed to obtain a chip layout vulnerability matrix; and finally, a vulnerable point in the chip layout vulnerability matrix is selected for hardware Trojan horse implantation to generate a chip layout level hidden hardware Trojan horse test set. The application analyzes physical resources such as a layout space margin and a routing channel margin of a chip layout, analyzes power consumption characteristics of the chip layout on the basis, designs a vulnerability index of the chip layout, selects a vulnerable point, and obtains a chip layout hidden by a hardware Trojan horse, namely, a chip Trojan horse test set. The application promotes the development of a hardware Trojan horse detection technology and improves the defense capability of a chip.

The invention provides a hardware circuit Trojan horse detection method and system based on machine learning, and the method comprises the steps: obtaining a reference model and a target model which have the same structure, inputting a circuit diagram data set of a known label into the reference model for learning training, and recording the loss as FLr; inputting the to-be-tested circuit and the pseudo benign node and the pseudo Trojan horse node of the to-be-tested circuit into the target model for learning and training, and recording the loss as FLt; performing weighted summation on the loss FLr and the loss FLt to obtain a joint loss FLtot, and performing adjustment and optimization by using the joint loss FLtot; after the training of the target model Ht is completed, marking the adjusted and optimized target model Ht as a GTD-SR model; and inputting all nodes of the circuit Gt to be detected into the GTD-SR model for Trojan horse detection, and outputting the final probability that each node in the circuit Gt to be detected has a hardware circuit Trojan horse through the GTD-SR model. According to the method, an unknown circuit and a novel hardware Trojan horse can be directly operated on the gate-level netlist, and a logic gate infected by the Trojan horse can be accurately positioned.

The present invention discloses a defense mechanism for avoiding the triggering of instruction sequence-triggered hardware Trojans, which is applied to the field of processor hardware security. Aiming at the problems that the existing mechanism of instruction obfuscation at the software level is easily bypassed by attackers and the deficiencies of the existing mechanism of instruction obfuscation at the hardware level; during the operation of the processor program, the established instruction stream input from the instruction cache to the IF first passes through an instruction fine-grained encryption module for encryption; when the encrypted established instruction is input from the IF to the newly added pipeline IO, a decryption operation is first performed; then, according to the control information 1 given by the newly added pipeline IO, the dynamic random module is driven to generate control information 2, and several custom OPCode instructions are randomly selected from the obfuscation instruction library composed of custom OPCode instructions and inserted between the established instructions of the processor; finally, the obfuscated instruction stream is input to the ID, so as to achieve that the processor avoids the triggering of instruction sequence-triggered hardware Trojans.

The invention relates to a hardware Trojan horse detection method and device, equipment, a medium and a program product. The hardware Trojan horse detection method comprises the steps of obtaining a power consumption curve of a target chip; extracting dynamic power consumption data of the target chip from the power consumption curve; extracting power consumption characteristic data in the dynamic power consumption data; and inputting the power consumption characteristic data into a pre-trained Trojan horse detection model to obtain a Trojan horse detection result of the target chip. Through the method, whether the Trojan horse exists in the target chip or not can be quickly and accurately judged, and Trojan horse detection efficiency and detection accuracy of the target chip can be improved.

The application discloses a hardware Trojan defense method based on game theory and relates to the technical field of integrated circuit security. The method comprises the following steps: S1, defining participants and a strategy space; S2, establishing a hardware Trojan attack and defense income model; S3, calculating a payoff matrix of attack and defense; S4, constructing a non-cooperative finite dynamic game model; and S5, determining an optimal defense strategy. The application simulates the strategy selection and income calculation of attackers and defenders, combines mixed strategy game, optimal response dynamics and strategy probability updating, and enables the attackers and the defenders to confront each other in multiple rounds, the strategy can be adjusted in each round, the strategy evolution and optimal solution are researched according to the result of the last round, and whether there is a stable strategy combination or periodic change in long-term confrontation is researched, so that the final optimal defense strategy is determined according to the stable strategy combination or single strategy.

The invention relates to the technical field of integrated circuit hardware security, in particular to a robust hardware Trojan horse detection model generation method based on adversarial training, and the method comprises the steps: obtaining an integrated circuit design infected by a hardware Trojan horse; flattening each integrated circuit design, converting the integrated circuit design into a control-data flow diagram, and extracting a statement path from an input signal to an output signal; carrying out segmentation and label labeling on each extracted statement path, generating an original sample set to train the initial network, and further generating an original hardware Trojan horse detection model; on the basis of the signal significance score and an original hardware Trojan horse detection model, carrying out adversarial attack on all original hardware Trojan horse samples in the original sample set, and generating a hardware Trojan horse adversarial sample set; and confrontation training is performed on the original hardware Trojan horse detection model based on the two sample sets to generate the robust hardware Trojan horse detection model, so that confrontation sample attack in the hardware Trojan horse detection process can be effectively resisted, and the detection precision is improved.

The embodiment of the present application provides a hardware Trojan detection method that integrates structural information and semantic information, which can solve the technical problem of poor hardware Trojan detection capabilities. The method includes: determining a first file; the first file includes multiple code files for a chip design; establishing an abstract syntax tree based on the first file; extracting node features and node adjacency relationships based on the abstract syntax tree; obtaining structural information based on the node features and node adjacency relationships; obtaining code semantic features based on multiple code files; fusing structural information and code semantic features based on a cross-attention mechanism to obtain a target feature vector; training a hardware Trojan detection model based on the target feature vector; inputting the code to be tested into the hardware Trojan detection model to obtain a hardware Trojan detection result. In this way, there is no need to manually process and analyze suspicious signals or statements, which improves the degree of automation and thus improves the hardware Trojan detection capability.

The application provides a circuit gate-level feature hardware Trojan detection method based on a pre-trained NLP model. The Verilog file of the gate-level netlist is preprocessed, only the gate and its connection relationship are retained, and the description form of the netlist is naturalized, so that it is suitable for NLP model processing. Then the extracted text information is represented in a vector form, so that it is compatible with the Transformer structure. Finally, the self-attention mechanism in the Transformer structure is used to capture the complex relationship of the circuit components and their connections, and the detection of the hardware Trojan is realized. This method can make full use of the knowledge learned in the natural language processing task, effectively migrate to the hardware Trojan detection task, and realize efficient and accurate hardware Trojan detection.

The present invention discloses a hardware Trojan detection and recovery method, device, medium and processor for RISC-V, belonging to the technical field of hardware security, including: when the RISC-V processor executes an input instruction, backing up the information written to the general-purpose register bank to obtain backup information; constructing a pipeline architecture to perform hardware Trojan detection on one or more detection paths to obtain the Trojan detection results of each detection path; when there is a hardware Trojan attack in any one of the detection paths, suspending the pipeline architecture operation and resetting all stored data; retrieving the original information tampered with by the hardware Trojan from the backup information and writing it back to the corresponding position in the general-purpose register bank; using the pipeline architecture to perform fetching, decoding and execution operations again, and restoring the RISC-V processor to a normal state by using the written-back information. The detection and recovery structure proposed by the present invention is faster in speed and lower in power consumption.

The application discloses a hardware Trojan detection method, device and equipment and a storage medium. The method comprises the following steps: classifying a plurality of chip samples in different ways to obtain a normal sample set and a Trojan sample set; obtaining sample data of each sample in the normal sample set and the Trojan sample set to obtain a normal sample data set and a Trojan sample data set; constructing a sample data training set according to the normal sample data set and the Trojan sample data set; training a preset classification model by using the sample data training set to obtain a trained classification model; and detecting whether a to-be-detected sample contains a hardware Trojan by using the trained classification model. Thus, the efficiency and accuracy of Trojan detection can be improved, and the method is simple, easy to implement and low in cost.

The invention provides a lightweight hardware Trojan horse detection method based on multi-feature fusion MobileViT to solve the problem that weak electric signals generated when hardware Trojan horses are triggered are difficult to detect, and the problem seriously threatens hardware safety. According to the innovative method, a feature pyramid network is introduced for the first time, and a jump connection network is improved and expanded for the first time, so that the MobileViT model based on multi-feature fusion for hardware Wagramer difference field horse detection is provided, and an IEEE Dataport hardware Trojan side channel power time sequence data set is used as a basis; one-dimensional time sequence data is converted into a two-dimensional image by adopting a Gramer difference field method, the two-dimensional image is used for model training, and the performance of the model is improved. The hardware Trojan horse detection method is superior to a traditional method in the aspect of hardware Trojan horse detection, the accuracy of hardware Trojan horse detection is remarkably improved, and important practical significance and guiding significance are provided for guaranteeing hardware safety and information safety.

The present invention discloses a method for generating a test set of stealthy hardware Trojans at the chip layout level. The method first obtains the chip layout result from the register transfer level (RTL) code of a circuit, and thereby obtains a set of chip layout information points; then analyzes the blank layout space and the unused wiring space after wiring completion in the chip layout result to obtain a chip layout vulnerability matrix; selects low-vulnerability points in the chip layout vulnerability matrix for hardware Trojan implantation to generate a test set of stealthy hardware Trojans at the chip layout level. Based on the vulnerability analysis of the integrated circuit physical field, the present invention proposes a method for generating a test set of hardware Trojans for the hardware Trojan attack mode at the layout level. By analyzing the chip layout information and modifying the chip layout, a test set of hardware Trojans with better concealment is obtained, which can promote the development of hardware Trojan detection technology and enhance the defense ability of the chip.

This invention relates to a hardware Trojan side-channel detection method based on an autoencoder, belonging to the field of network security side-channel analysis technology, specifically a side-channel detection method for artificial intelligence hardware Trojans based on an autoencoder. The method of this invention is easy to implement, the normal data used for training is easy to collect, and the autoencoder method has relatively low computational cost, making it suitable for application in practical scenarios. This method uses side-channel information as input to the autoencoder and performs anomaly detection based on the encoding results obtained by the encoder, providing intuitive and accurate results.