A Hardware Trojan Detection Method Based on Side-channel Analysis

Hardware Trojans (HTs) pose a serious threat to integrated circuit (IC) security. Detection of HTs is extremely challenging due to their stealthy nature. Side-channel analysis techniques have emerged as promising approaches for HT detection by observing anomalies in physical parameters like power or delay. More recently, machine learning (ML) methods have been explored to enhance the accuracy and efficiency of side-channel based HT detection. Background: This paper presents a novel approach using machine learning techniques to detect stealthy hardware Trojans through side-channel analysis. Hardware Trojans, malicious modifications inserted into integrated circuits during manufacturing, pose significant threats to the integrity and security of electronic systems. Traditional methods of detecting these Trojans often rely on known signatures or specific patterns, making them ineffective against subtle and sophisticated attacks. Method: This paper provides a comprehensive review of research advancements in applying ML for side-channel based HT detection. First, an overview of HT attacks, their classification, threat models and detection challenges is presented. Next, various side-channel parameters like power, temperature, delay and electromagnetic emanations used for HT detection are discussed along with their merits and demerits. Furthermore, the application of supervised, unsupervised and semi-supervised ML algorithms for automated feature extraction and intelligent decision making is elucidated in detail. Result: Specifically, the data collection strategies, feature extraction techniques, ML models and performance evaluation metrics adopted in existing literature are critically reviewed. In addition, the limitations of current approaches and promising future research directions like on-chip ML implementation, hierarchical ML and explainable ML models tailored for HT detection are highlighted. Conclusion: Case studies on benchmark circuits are also presented to demonstrate the efficacy of ML-based side-channel HT detection methods. Through an extensive literature review and incisive analysis, this paper provides contemporary insights on the advancement of ML techniques to enable robust side-channel based HT detection for securing next-generation ICs.

Offshore fabrication, assembling and packaging challenge chip security, as original chip designs may be tampered by malicious insertions, known as hardware Trojans (HTs). HT detection is imperative to guarantee the chip performance and safety. Existing HT detection methods have limited capability to detect small-scale HTs and are further challenged by the increased process variation. To increase HT detection sensitivity and reduce chip authorization time, we propose to exploit the inherent feature of differential cascade voltage switch logic (DCVSL) to detect HTs at runtime. In normal operation, a system implemented with DCVSL always produces complementary logic values in internal nets and final outputs. Noncomplementary values on inputs and internal nets in DCVSL systems potentially result in abnormal power behavior and even system failures. By examining special power characteristics of DCVSL systems upon HT insertion, we can detect HTs, even if the HT size is small. Simulation results show that the proposed method achieves up to 100% HT detection rate. The evaluation on ISCAS benchmark circuits shows that the proposed method obtains a HT detection rate in the range of 66% to 98%.

This work proposes a plausible detection scheme for Hardware Trojan (HT) detection in frequency domain analysis. Due to shrinking technology every node consumes low power values (in the range of $\mu$ W) which are difficult to manipulate for HT detection using conventional methods. The proposed method utilizes the time domain power signals which is converted to frequency domain that represents the implausible signals and analyzed. The precision of HT detection is found to be increased because of the magnified power values in frequency domain. This work uses ISCAS89 bench mark circuits for conducting experiments. In this, the wide range of power values that spans from $695 \mu \mathrm{W}$ to 22.3 $\mu \mathrm{W}$ are observed in frequency domain whereas the respective powers in time domain have narrow span of $2.29 \mu \mathrm{W}$ to 0.783 $\mu \mathrm{W}$ which is unconvincing. This work uses the wide span of power values to identify HT and observed that the mid-band of frequencies have larger footprints than the side bands. These methods intend to help the designers in easy identification of HT even of single gate events.

The design complexity and outsourcing trend of modern integrated circuits (ICs) have increased the chance for adversaries to implant hardware Trojans (HTs) in the development process. To effectively defend against this hardware-based security threat, many solutions have been reported in the literature, including dynamic and static techniques. However, there is still a lack of methods that can simultaneously detect and diagnose HT circuits with high accuracy and low time complexity. Therefore, to overcome these limitations, this paper presents an HT detection and diagnosis method for gate-level netlists (GLNs) based on different machine learning (ML) algorithms. Given a GLN, the proposed method first partitions it into several circuit cones and extracts seven HT-related features from each cone. Then, we repeat this process for the sample GLN to construct a dataset for the next step. After that, we use K-Nearest Neighbor (KNN), Decision Tree (DT) and Naive Bayes (NB) to classify all circuit cones of the target GLN. Finally, we determine whether each circuit cone is HT-implanted through the label, completing the HT detection and diagnosis for target GLN. We have applied our method to 11 GLNs from ISCAS’85 and ISCAS’89 benchmark suites. As shown in experimental results of the three ML algorithms used in our method: (1) NB costs shortest time and achieves the highest average true positive rate (ATPR) of 100%; (2) DT costs longest time but achieve the highest average true negative rate (ATNR) of 98.61%; (3) Compared to NB and DT, KNN costs a slightly longer time than NB but the ATPR and ATNR values are approximately close to DT. Moreover, it can also report the possible implantation location of a Trojan instance according to the detecting results.

With the rapid development of integrated circuit technology, hardware Trojans have attracted widespread attention as a growing threat. Positioned at the hardware level of electronic devices and integrated circuits, hardware Trojans possess concealment and destructiveness, potentially leading to severe security threats. This paper conducts an in-depth exploration of the threats posed by hardware Trojans, including typical and special instances of hardware Trojans. Regarding the detection of hardware Trojans, this paper introduces methods such as destructive and non-destructive detection and explores the application of machine learning in hardware Trojan detection. Additionally, this paper proposes a series of strategies for preventing hardware Trojans, including reinforcement measures for detection and physical security measures, aiming to address the evolving threat of hardware Trojans. Finally, this paper discusses the development trends of hardware Trojans from the perspectives of attackers and defenders. Through comprehensive research and analysis, this paper aims to deepen the understanding of the issue of hardware Trojans and provide robust support for ensuring the security of digital infrastructure.

Recently Hardware Trojan has been widely studied for its threat to IC security. The method based on power side-channel information is an effective one in various Hardware Trojan detection methods proposed at present. However, there is a problem that Hardware Trojan power is difficult to be distinguished and easy to be drowned by the noise if using the power information to recognize Hardware Trojan through direct power difference during detection process. On the base of power component analysis, this paper proposes that we can extract the feature character of power information based on the feature difference between Hardware Trojan power and noise to manifest the power caused by Hardware Trojan. Then it gives out the power feature extraction algorithm and Trojan power identification model. In the experiment, the AES circuit is used as attack carrier embedded into the hardware Trojan circuit, then simulating the power, the results show that the feature extraction algorithm and convergence and divergence identification model can detect Hardware Trojans effectively.

Pre-Silicon hardware Trojan detection has been studied for years. The most popular benchmark circuits are from the Trust-Hub. Their common feature is that the probability of activating hardware Trojans is very low. This leads to a series of machine learning based hardware Trojan detection methods which try to find the nets with low signal probability of 0 or 1. On the other hand, it is considered that, if the probability of activating hardware Trojans is high, these hardware Trojans can be easily found through behaviour simulations or during functional test. This paper explores the grey zone between these two opposite scenarios: if the activation probability of a hardware Trojan is not low enough for machine learning to detect it and is not high enough for behaviour simulation or functional test to find it, it can escape from detection. Experiments show the existence of such hardware Trojans, and this paper suggests a new set of hardware Trojan benchmark circuits for future study.

This article introduces an on-chip anomaly monitoring system design approach that is based on thermal profiling and side-channel analysis. The strategy aims at the realization of nonintrusive hardware Trojan (HT) detection over the lifetime of the circuit under test (CUT). To evaluate the capability of the proposed HT detection system, the on-chip electrothermal coupling is modeled as part of the simulation technique, which associates local thermal activities with circuit-level power consumption using a standard electrical simulator. To monitor the thermal profiles on chips with high sensitivity to local temperature changes and the resilience to flicker noise, the sensor architecture described in this article is the first differential temperature sensor equipped with a chopping mechanism. A methodology is described to utilize principal component analysis (PCA) to extract critical information from the quantized output of the system for effective HT detection in the presence of noise. The complete sensor signal path of the system was designed and simulated with foundry-supplied device models (130-nm CMOS technology), and the impact due to process variations have been considered via Monte Carlo simulations. The results indicate that small Trojans with approximately 2 μW of power can be detected within the thermal profile of a CUT consuming more than 500 μW. As the first step to prove the feasibility of on-chip quantization in the HT detection system, a prototype 8-bit successive approximation register (SAR) analog-to-digital converter (ADC) was fabricated with 130-nm CMOS technology.

The high cost of integrated circuit chip production has driven more and more chip design companies to use overseas production services. Since the integrated circuit production cannot be closely monitored, the security of integrated circuit chips has become a major concern. Hardware Trojan (HT) insertion is one type of the hardware attack. HTs are extremely stealthy due to their small sizes and low triggering rates. HTs inserted during manufacturing can have minimum impact on the timing and power. In fact, this impact can be smaller than the timing and power variations caused by the process variations. Therefore, these HTs cannot be easily detected using traditional electrical methods. In this article, we propose a novel optical method, where we image the integrated circuit chip from the backside. Our method, can easily detect any replacements, modifications, or rearrangements of fill cells or functional cells for HT insertion. We use a noise-based detection method to achieve high HT detection rates in different testbenches. To further improve the robustness of our method, we strategically place high reflectance fill cells in the designs. Our approach provides high-resolution, nondestructive, and rapid means to detect HTs inserted during fabrication. We evaluate our approach using various hardware blocks where the HTs can occupy less than 0.1% of the total area or consist of fewer than three gates. In addition, we analyze our method with various magnitudes of noise, process variations, detection window sizes, and resolutions.

The globalization of the semiconductor industry introduces vulnerabilities like hardware Trojans that compromise hardware security and pose serious risks to critical applications such as military and medical systems. Traditional hardware Trojan detection methods including reverse engineering (destructive) and golden chip comparison (non-destructive) are often associated with high costs and limited practicality. The emergence of machine learning and deep learning models has enhanced the feasibility of hardware Trojan detection, as these models can learn complex patterns and representations from extensive datasets. This research presents an attention-based non-local convolution model integrated with a simple recurrent unit (Att_NLC-SRU) for hardware Trojan classification effectively eliminating the need for a golden chip. In this approach, a non-local convolutional neural network embedded with an attention module plays a crucial role in efficiently extracting global spatial features from relevant regions. Furthermore, temporal features are extracted using recurrent neural networks such as the simple recurrent unit. The integration of these methodologies has proven to be significantly effective. The proposed model was validated using the advanced encryption standard (AES) benchmarks, achieving the highest accuracy of 99% on the AES-T1600 benchmark.

Hardware Trojans (HTs) have become a major threat for the integrated circuit industry and supply chain and have motivated numerous developments of HT detection schemes. Although the side-channel HT detection approach is among the most promising solutions, most of the previous methods require a trusted golden chip reference. Furthermore, detection accuracy is often influenced by environmental noise and process variations. In this article, a novel electromagnetic (EM) side-channel fingerprinting-based HT detection method is proposed. Different from previous methods, the proposed solution eliminates the requirement of a trusted golden fabricated chip. Rather, only the genuine RTL code is required to generate the EM signatures as references. A factor analysis method is utilized to extract the spectral features of the HT trigger’s EM radiation, and then a k -means clustering method is applied for HT detection. Experimentation on two selected sets of Trust-Hub benchmarks has been performed on FPGA platforms, and the results show that the proposed framework can detect all dormant HTs with a high confidence level.

Detecting hardware Trojan is a difficult task in general. The context is that of a fabless design house that sells IP blocks as GDSII hard macros, and wants to check that final products have not been infected by Trojan during the foundry stage. In this paper we analyzed hardware Trojan horses insertion and detection in Scalable Encryption Algorithm (SEA) crypto. We inserted Trojan at different levels in the ASIC design flow of SEA crypto and most importantly we focused on Gate level and layout level Trojan insertions. We choose path delays in order to detect Trojan at both levels in design phase. Because the path delays detection technique is cost effective and efficient method to detect Trojan. The comparison of path delays makes small Trojan circuits significant from a delay point of view. We used typical, fast and slow 90nm libraries in order to estimate the efficiency of path delay technique in different operating conditions. The experiment's results show that the detection rate on payload Trojan is 100%.

The globalized semiconductor supply chain significantly increases the risk of exposing System-on-Chip (SoC) designs to malicious implants, popularly known as hardware Trojans. Traditional simulation-based validation is unsuitable for detection of carefully-crafted hardware Trojans with extremely rare trigger conditions. While machine learning (ML) based Trojan detection approaches are promising due to their scalability as well as detection accuracy, ML-based methods themselves are vulnerable from Trojan attacks. In this paper, we propose a robust backdoor attack on ML-based Trojan detection algorithms to demonstrate this serious vulnerability. The proposed framework is able to design an AI Trojan and implant it inside the ML model that can be triggered by specific inputs. Experimental results demonstrate that the proposed AI Trojans can bypass state-of-the-art defense algorithms. Moreover, our approach provides a fast and cost-effective solution in achieving 100% attack success rate that significantly outperforms state-of-the art approaches based on adversarial attacks.

Hardware Trojan (HT) has recently drawn much attention in both industry and academia due to the global outsourcing trend in semiconductor manufacturing, where a malicious logic can be inserted into the security critical ICs at almost any stages. HT severity mainly stems from its low-cost and stealthy nature where the HT only functions at a strict condition to purposely alter the logic or physical behavior for leaking secrets. This fact makes HT detection very challenging in practice. In this paper, we propose a novel HT detection technique based on machine learning approach. The described solution is constructed over one-class SVM and is shown to be more robust compared to the template based detection techniques. An unsupervised approach is also applied in our solution for mitigating the golden model dependencies. To evaluate the solution, a practical HT design was inserted into an AES coprocessor implemented in a Xilinx FPGA. Based on the partial reconfiguration, the HT size can be dynamically changed without altering cipher part, which helps to precisely evaluate the HT influence. The experimental results have shown that our proposed detection technique achieve a high performance accuracy.

In recent years, with the prosperity and globalization of the semiconductor industry, hardware security issues have become another major problem besides software security. To reduce the development costs, integrated circuits are often outsourced to various external vendors. This provides malicious third-party vendors a good chance to implant Trojans in the circuit design and manufacture phases. It is crucial to find effective solution to hardware Trojan detection. This paper proposes a hybrid hardware Trojan detection method for gate-level netlist based on XGBoost algorithm. The detection method affirms each network as a node and aims to detect all Trojan networks existing in the circuit. Firstly, according to the difference between the features of the Trojan circuit and the normal circuit, the effective features of the circuit are extracted. Then the XGBoost algorithm is applied to train the optimum feature set and classify the circuit into suspicious Trojan circuits and normal circuits. To obtain a higher accuracy, the dynamic detection method is applied to make up for the shortcomings of the static detection. The experimental results on the Trust-HUB benchmarks show that the detection method can achieve accurate detection of hardware Trojan circuits. The detection method can finally achieve 90.9% average True Positive Rate (TPR) and 99.0% average True Negative Rate (TNR).