Using outliers to detect stealthy hardware trojan triggering?

Hardware Trojans (HTs) are malicious alterations to a circuit introduced at design or manufacturing phases by an adversary. Due to their diversity, detecting and/or locating them are challenging tasks. Among the different kinds of detection methods, methods based on logic testing aim to reveal the presence of HTs thanks to their logical activation and observation through primary outputs. However, HTs are stealthy in nature, i.e. mostly inactive unless triggered by a very rare condition. Furthermore, test patterns must be developed without any knowledge on the location and function implemented by the HT. A procedure has recently been proposed to identify in a netlist suspicious signals that may be part of a HT introduced at design stage: these so-called "outliers" present an activity poorly correlated with other signals. In this paper, we undertake to use outliers in order to detect a HT introduced at manufacturing stage. We propose a test pattern generation technique based on the exploration of outliers. Our assumption is that such signals may be selected by an attacker in order to trigger his/her HT.